style(frontend): format account usage summary

Co-authored-by: Codex <noreply@openai.com>

.github/workflows/_container.yml

@@ -45,7 +45,7 @@ jobs:
           ref: ${{ inputs.ref }}
 
       - name: Setup Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       - name: Build runtime image
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
@@ -55,6 +55,9 @@ jobs:
           target: runtime
           load: true
           tags: ${{ env.CPR_IMAGE }}
+          no-cache-filters: |
+            runtime-base
+            runtime
           cache-from: type=gha,scope=runtime-ci
           cache-to: type=gha,mode=max,scope=runtime-ci
 
@@ -76,7 +79,7 @@ jobs:
           ${{ hashFiles('trivy-results.sarif') != '' &&
               (github.event_name != 'pull_request' ||
                github.event.pull_request.head.repo.full_name == github.repository) }}
-        uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
         with:
           sarif_file: trivy-results.sarif
           category: runtime-container

.github/workflows/release.yml

@@ -448,7 +448,7 @@ jobs:
           PY
 
       - name: Setup Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       - name: Login to GHCR
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
@@ -468,6 +468,9 @@ jobs:
           push: true
           build-args: |
             CPR_PREBUILT_DIR=dist/docker
+          no-cache-filters: |
+            runtime-base
+            runtime-prebuilt
           cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache-${{ matrix.os }}-${{ matrix.arch }}
           cache-to: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache-${{ matrix.os }}-${{ matrix.arch }},mode=min
           provenance: mode=max
@@ -516,7 +519,7 @@ jobs:
           path: dist/release
 
       - name: Setup Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       - name: Install Cosign
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2

README.md

@@ -12,31 +12,32 @@
 [![GHCR](https://img.shields.io/badge/GHCR-codex--proxy--rs-2496ED?logo=docker&logoColor=white&style=flat-square)](https://github.com/zyycn/codex-proxy-rs/pkgs/container/codex-proxy-rs)
 [![MIT](https://img.shields.io/badge/License-MIT-blue.svg?style=flat-square)](https://opensource.org/license/mit)
 
-[快速开始](#快速开始) · [客户端接入](#客户端接入) · [运维](#运维) · [部署](deploy/README.md) · [接口](docs/api.md) · [架构](docs/architecture.md)
+[快速开始](#快速开始) · [客户端接入](#客户端接入) · [运行维护](#运行维护) · [部署](deploy/README.md) · [接口](docs/api.md) · [架构](docs/architecture.md)
 
 </div>
 
 > [!NOTE]
-> 只支持 OpenAI Responses API，不提供 `/v1/chat/completions`。
+> 数据面支持 OpenAI Responses、Images 和模型目录协议，不提供 `/v1/chat/completions`。
 
-## 能力
+## 功能
 
-| 领域     | 实现                                                                                                  |
-| -------- | ----------------------------------------------------------------------------------------------------- |
-| 协议     | OpenAI Responses JSON、SSE、WebSocket 与模型目录                                                       |
-| Provider | 固定 OpenAI、xAI 两个 Provider；各自管理 OAuth、账号、额度与模型目录                                    |
-| 路由     | Client Key 绑定 Provider、全局模型映射、会话亲和与同 Provider 安全 fallback                             |
-| 透明边界 | OpenAI 请求保留未知字段和字段顺序，SSE 与 WebSocket 原样转发业务字节；xAI 在 Provider 内做协议转换          |
-| 延续     | OpenAI native/replay continuation；xAI 使用客户端提交的完整历史                                          |
-| 账号     | 导入、OAuth、credential 刷新、主动额度刷新，以及正常响应中的被动额度/状态观测                              |
-| 管理     | Client Key、账号、模型目录、设置、观测、系统更新与 OAuth                                                 |
-| 计量     | 模型请求 Token、费用、延迟、账号与 Provider 归因，并记录响应确认的实际 `service_tier`                      |
+| 领域 | 当前能力 |
+| --- | --- |
+| 数据面 | Responses JSON、SSE、WebSocket、review 子代理、Images 生成/编辑与模型目录 |
+| Provider | 固定 `openai`、`xai` 两个 Provider，各自拥有 OAuth、credential、额度、目录与 transport |
+| 路由 | Client Key 限定账号分组；按模型能力编译 Provider 候选；支持全局精确模型映射、会话亲和和安全 fallback |
+| 透明边界 | OpenAI 保留未知请求字段及字段顺序，并原样转发 SSE、WebSocket 与 Images 业务字节；xAI 在 Provider 内转换协议 |
+| 账号 | OAuth、OpenAI AT/RT 与账号文件导入，credential/额度刷新、账号恢复及主动额度重置卡 |
+| 管理 | 账号与分组、Client Key、运行设置、用量/错误观测、S3/R2 备份、系统更新与回滚 |
+| 计量 | Token、图片、费用、延迟、账号与 Provider 归因，并记录上游响应确认的实际 `service_tier` |
+
+架构边界、状态所有权和请求不变量见 [架构文档](docs/architecture.md)。
 
 ## 快速开始
 
 需要 Docker Engine 与 Docker Compose Plugin。
 
-### 1. 准备
+### 1. 准备配置和目录
 
 ```bash
 git clone https://github.com/zyycn/codex-proxy-rs.git
@@ -56,16 +57,16 @@ openssl rand -hex 24
 openssl rand -hex 24
 ```
 
-把两个结果写入 `deploy/config.yaml`，并单独设置管理员初始密码：
+把两个结果分别写入 `deploy/config.yaml`，再设置管理员初始密码：
 
-| 配置                       | 约束                         |
-| -------------------------- | ---------------------------- |
-| `store.database.password`  | 48 位十六进制                 |
-| `store.redis.password`     | 48 位十六进制                 |
-| `admin.default_password`   | 至少 12 位，不能包含 `$`      |
+| 配置 | 约束 |
+| --- | --- |
+| `store.database.password` | 48 位十六进制 |
+| `store.redis.password` | 48 位十六进制 |
+| `admin.default_password` | 至少 12 位，不能包含 `$` |
 
-PostgreSQL、Redis 容器和应用通过同一份 `config.yaml` 使用这两个基础设施密码，不需要额外
-导出环境变量。管理员密码只在首次创建管理员时生效。
+PostgreSQL、Redis 和应用从同一份 `config.yaml` 读取基础设施密码，不需要额外导出环境变量。
+管理员密码只在首次创建管理员时生效。
 
 Linux 需要允许容器组写入运行目录：
 
@@ -83,37 +84,36 @@ docker compose -f deploy/compose.yaml up -d --no-build
 curl -i http://127.0.0.1:8080/healthz
 ```
 
-`204 No Content` 表示应用、PostgreSQL 与 Redis 均可用。管理端地址：
+`204 No Content` 表示应用、PostgreSQL 与 Redis 均可用。管理端地址为
 `http://127.0.0.1:8080`。
 
-### 3. 初始化
+### 3. 初始化网关
 
 1. 使用 `admin@cpr.local` 与初始密码登录。
-2. 在账号页选择对应 Provider：OpenAI 支持 OAuth、账号文件与 Agent Identity；xAI 支持 OAuth
-   和兼容账号文件导入。
-3. 按需配置客户端模型到上游模型的全局映射；未命中映射的模型名原样透传。
-4. 创建 `sk_...` Client Key，绑定 `openai` 或 `xai`，并设置速率与并发限制。
+2. 导入或授权 Provider 账号：OpenAI 支持 OAuth、逐行 AT/RT 与 OAuth JSON；
+   xAI 支持 OAuth 和账号 JSON。
+3. 创建账号分组并按需配置全局模型映射。未命中的模型名原样交给候选 Provider。
+4. 创建 `sk_...` Client Key，选择可用账号分组，并设置速率和并发限制；空分组范围表示全部账号。
 
-OpenAI 账号导入和首次 OAuth 创建在 credential 提交后会立即尝试一次额度观测；额度接口临时失败不会
-回滚已提交的账号。Free、K12 等套餐共用同一套额度与状态转换逻辑，套餐字段只作为账号事实并隔离
-对应的模型目录 cache。credential 刷新、额度刷新和正常请求中的被动额度观测是三条独立链路，详见
-[账号接口](docs/api.md#5-账号)。
+OpenAI RT 导入会先向官方 token endpoint 换取 AT；仅 AT 的账号不具备自动续期能力，
+能否参与调度仍取决于 token 中可验证的身份与后续上游事实。账号导入和首次 OAuth 创建会尽力读取一次额度，
+额度上游暂时失败不会回滚已提交的账号。
+
+OpenAI 账号的主动重置卡只在用户打开相应弹窗或手工刷新时查询。消费成功后管理端重新查询卡片与额度；
+系统不会通过修改本地 `reset_at` 伪造重置。完整账号合同见 [账号接口](docs/api.md#5-账号)。
 
 > [!IMPORTANT]
 > xAI 使用 OAuth session，不支持把 xAI API Key 作为上游 credential。
 
-> [!NOTE]
-> `admin.default_password` 只在首次创建管理员时生效。
-
-完整部署、权限和密码轮换规则见 [deploy/README.md](deploy/README.md)。
+完整的权限、密码轮换、备份和升级规则见 [部署文档](deploy/README.md)。
 
 ## 客户端接入
 
-| 配置     | 值                                       |
-| -------- | ---------------------------------------- |
-| Base URL | `http://127.0.0.1:8080/v1`               |
-| API Key  | 管理端创建的 `sk_...`                    |
-| 鉴权     | `Authorization: Bearer <client-api-key>` |
+| 配置 | 值 |
+| --- | --- |
+| Base URL | `http://127.0.0.1:8080/v1` |
+| API Key | 管理端创建的 `sk_...` |
+| 鉴权 | `Authorization: Bearer <client-api-key>` |
 
 ```bash
 curl http://127.0.0.1:8080/v1/models \
@@ -130,67 +130,70 @@ curl http://127.0.0.1:8080/v1/responses \
 ```
 
 <details>
-<summary>API 路由</summary>
+<summary>公开数据面路由</summary>
 
-| 路由                               | 用途                           |
-| ---------------------------------- | ------------------------------ |
-| `POST /v1/responses`               | JSON 响应或 SSE Responses 流    |
-| `GET /v1/responses`                | Responses WebSocket 升级        |
-| `POST /v1/responses/review`        | review 子代理请求               |
-| `GET /v1/models`                   | 当前 Client Key 可用的模型列表   |
-| `GET /v1/models/catalog`           | Codex 客户端展示用模型目录      |
-| `GET /v1/models/{model_id}/info`   | Codex 客户端展示用模型详情      |
-| `GET /v1/models/{model_id}`        | OpenAI 兼容模型详情             |
+| 路由 | 用途 |
+| --- | --- |
+| `POST /v1/responses` | JSON 响应或 SSE Responses 流 |
+| `GET /v1/responses` | Responses WebSocket 升级 |
+| `POST /v1/responses/review` | review 子代理请求 |
+| `POST /v1/images/generations` | OpenAI Images 生成 JSON 透明转发 |
+| `POST /v1/images/edits` | OpenAI Images 编辑 JSON 透明转发 |
+| `GET /v1/models` | 当前 Client Key 账号范围内的模型列表 |
+| `GET /v1/models/catalog` | Codex 客户端展示用模型目录 |
+| `GET /v1/models/{model_id}/info` | Codex 客户端展示用模型详情 |
+| `GET /v1/models/{model_id}` | OpenAI 兼容模型详情 |
 
-所有 `/v1/*` 路由都需要客户端 API Key。
+所有 `/v1/*` 路由都需要 Client Key。Images 是 OpenAI Provider 自有端点，不读取模型字段，也不参与
+文本模型映射。
 
 </details>
 
-完整的客户端与管理端路由、鉴权和 mutation 规则见 [接口文档](docs/api.md)。
+完整的客户端与管理端路由、鉴权、请求字段和 mutation 语义见 [接口文档](docs/api.md)。
 
-## 运维
+## 运行维护
 
 ```bash
-# 实例升级
+# 同一大版本内升级发布镜像
 docker compose -f deploy/compose.yaml pull codex-proxy-rs
 docker compose -f deploy/compose.yaml up -d --no-build
 
-# 日志
+# 查看日志
 docker compose -f deploy/compose.yaml logs -f codex-proxy-rs
 
-# 从源码构建
+# 从当前源码构建
 docker compose -f deploy/compose.yaml build codex-proxy-rs
 docker compose -f deploy/compose.yaml up -d
 ```
 
 > [!IMPORTANT]
-> `.runtime/` 保存 PostgreSQL、Redis、日志、OpenAI 会话锚点密钥和自更新状态。删除该目录会永久清除
-> 运行状态。
+> `.runtime/` 保存 PostgreSQL、Redis、日志、OpenAI 会话锚点和在线更新状态。删除该目录会永久清除
+> 本地运行状态。
 
 > [!WARNING]
-> 不支持跨大版本在线升级。升级到新的大版本时，请使用全新的 `.runtime/` 数据目录重新部署，
-> 并重新导入或重新授权 Provider 账号与客户端 Key。
+> 不支持跨大版本在线升级。升级到新的大版本时请使用全新的 `.runtime/` 数据目录，并重新导入或授权
+> Provider 账号与 Client Key。
 
-Compose 默认只绑定 `127.0.0.1`。公网接入应使用 HTTPS 反向代理，转发 WebSocket
-upgrade 与真实客户端 IP；不要暴露 PostgreSQL 或 Redis。
+Compose 默认只绑定 `127.0.0.1`。公网接入应使用 HTTPS 反向代理，转发 WebSocket upgrade 与真实客户端
+IP；不要暴露 PostgreSQL 或 Redis。当前运行拓扑为单副本，不能通过复制应用容器扩容。
 
 ## 维护与发布
 
-发布仓库版本必须从干净、已同步上游的发布分支运行：
+仓库版本只能从干净、已同步上游的发布分支发布：
 
 ```bash
 release/publish <version>
 ```
 
-脚本依赖已登录的 GitHub CLI（`gh auth login`）。它会更新 `release/version.yaml`、创建约定提交与带
-注释的 `v<version>` tag，原子推送分支和 tag，再从发布分支触发 Release 构建，使构建缓存可以跨版本
-复用。不要手工修改版本后单独打 tag。该脚本不会登录服务器，也不会改变任何运行实例；源码提交、
-仓库发版和实例升级是三个独立状态。
+脚本依赖已登录的 GitHub CLI（`gh auth login`），会更新 `release/version.yaml`、创建约定提交和带注释的
+`v<version>` tag，原子推送分支与 tag，再触发 Release 构建。源码提交、仓库发版和运行实例升级是三个
+独立状态；脚本不会登录服务器或改变任何运行实例。
 
 ## 文档
 
-- [部署](deploy/README.md)
+- [部署与运维](deploy/README.md)
 - [客户端与管理端接口](docs/api.md)
-- [架构与数据边界](docs/architecture.md)
+- [系统架构](docs/architecture.md)
+- [数据库迁移规则](backend/migrations/README.md)
 - [Release](https://github.com/zyycn/codex-proxy-rs/releases)
 - [容器镜像](https://github.com/zyycn/codex-proxy-rs/pkgs/container/codex-proxy-rs)

backend/Cargo.lock

@@ -8,16 +8,6 @@ version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
 
-[[package]]
-name = "aead"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0"
-dependencies = [
- "crypto-common 0.1.7",
- "generic-array",
-]
-
 [[package]]
 name = "aho-corasick"
 version = "1.1.4"
@@ -120,9 +110,9 @@ dependencies = [
 
 [[package]]
 name = "async-trait"
-version = "0.1.91"
+version = "0.1.92"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae36dc4177970ef04fde5178d3e2429882def40e57a451f919c098f72baa6cec"
+checksum = "82f6aeea286b8eb4dd3431a1be1b59d290ace00f5bfd8e2a159bc2a05e2c1667"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -216,9 +206,9 @@ dependencies = [
 
 [[package]]
 name = "aws-sdk-s3"
-version = "1.141.0"
+version = "1.142.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9f9420d3a2467eed22ed3635ca653653162c386a0b0f65c78189f9bd3c1379e"
+checksum = "f9e15a5c55e05f4b0b7e483160b3c85cccdf77cff02c95504f3e71d460855cd2"
 dependencies = [
  "arc-swap",
  "aws-credential-types",
@@ -308,9 +298,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-eventstream"
-version = "0.61.1"
+version = "0.61.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a9381123ab62d20c13082b151f30f962a3b112b727345394536dfa39a482944"
+checksum = "6de526c7b567420a31bc283657a7921b45c4cafe0827fdf2490713dcc770c28f"
 dependencies = [
  "aws-smithy-types",
  "bytes",
@@ -341,9 +331,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-http-client"
-version = "1.2.0"
+version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "635d23afda0a6ab48d666c4d447c4873e8d1e83518a2be2093122397e50b838e"
+checksum = "3c1c8a04cb31ba74d0115af5a890bb8c0d48fba64b52812fa13929a6ef0cc83c"
 dependencies = [
  "aws-smithy-async",
  "aws-smithy-runtime-api",
@@ -385,9 +375,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-runtime"
-version = "1.12.1"
+version = "1.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07505b34e8f4b3591a4fa69e9792b52289b95488dbbc68c3c0075b7bedb245e1"
+checksum = "483b858ff67522011c4786310c5cd8fd88d0be7ea3d5f1a48328446300c4269e"
 dependencies = [
  "aws-smithy-async",
  "aws-smithy-http",
@@ -411,9 +401,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-runtime-api"
-version = "1.14.0"
+version = "1.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b98f2e1fd67ec06618f9c291e5e495a468e60519e44c9c1979cd0521f3affdb"
+checksum = "954c563ce84507722d2679f07a35d21b9c6466b3872d513020d0281fc8112ac9"
 dependencies = [
  "aws-smithy-async",
  "aws-smithy-runtime-api-macros",
@@ -451,9 +441,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-types"
-version = "1.6.1"
+version = "1.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6dc683efb34b9e755675b37fedbe0103141e5b6df7bdc9eb6967756a8c167d8"
+checksum = "fce83ce9abbb198d25bc7131e468d0f9fe1257125e58c39f3f9fc9f5098c9647"
 dependencies = [
  "base64-simd",
  "bytes",
@@ -721,17 +711,6 @@ dependencies = [
  "phf 0.12.1",
 ]
 
-[[package]]
-name = "cipher"
-version = "0.4.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
-dependencies = [
- "crypto-common 0.1.7",
- "inout",
- "zeroize",
-]
-
 [[package]]
 name = "cmake"
 version = "0.1.58"
@@ -801,9 +780,9 @@ checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
 
 [[package]]
 name = "cookie"
-version = "0.18.1"
+version = "0.18.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ddef33a339a91ea89fb53151bd0a4689cfce27055c291dfa69945475d22c747"
+checksum = "1a373e3602691c3cdea496d2f0ee5935151e6168fe87739483c463db1b2f2f87"
 dependencies = [
  "percent-encoding",
  "time",
@@ -961,7 +940,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
 dependencies = [
  "generic-array",
- "rand_core 0.6.4",
  "typenum",
 ]
 
@@ -976,36 +954,6 @@ dependencies = [
  "rand_core 0.10.1",
 ]
 
-[[package]]
-name = "crypto_box"
-version = "0.9.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "16182b4f39a82ec8a6851155cc4c0cda3065bb1db33651726a29e1951de0f009"
-dependencies = [
- "aead",
- "blake2",
- "crypto_secretbox",
- "curve25519-dalek 4.1.3",
- "salsa20",
- "subtle",
- "zeroize",
-]
-
-[[package]]
-name = "crypto_secretbox"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9d6cf87adf719ddf43a805e92c6870a531aedda35ff640442cbaf8674e141e1"
-dependencies = [
- "aead",
- "cipher",
- "generic-array",
- "poly1305",
- "salsa20",
- "subtle",
- "zeroize",
-]
-
 [[package]]
 name = "ctutils"
 version = "0.4.2"
@@ -1016,48 +964,6 @@ dependencies = [
  "subtle",
 ]
 
-[[package]]
-name = "curve25519-dalek"
-version = "4.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97fb8b7c4503de7d6ae7b42ab72a5a59857b4c937ec27a3d4539dba95b5ab2be"
-dependencies = [
- "cfg-if",
- "cpufeatures 0.2.17",
- "curve25519-dalek-derive",
- "fiat-crypto 0.2.9",
- "rustc_version",
- "subtle",
- "zeroize",
-]
-
-[[package]]
-name = "curve25519-dalek"
-version = "5.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5eed333089e2e1c1ac8c6c0398e5e2497b4c9926ca6d0365ed1e099afa5bc23"
-dependencies = [
- "cfg-if",
- "cpufeatures 0.3.0",
- "curve25519-dalek-derive",
- "digest 0.11.3",
- "fiat-crypto 0.3.0",
- "rustc_version",
- "subtle",
- "zeroize",
-]
-
-[[package]]
-name = "curve25519-dalek-derive"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f46882e17999c6cc590af592290432be3bce0428cb0d5f8b6715e4dc7b383eb3"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
 [[package]]
 name = "data-encoding"
 version = "2.11.0"
@@ -1169,31 +1075,6 @@ dependencies = [
  "zeroize",
 ]
 
-[[package]]
-name = "ed25519"
-version = "3.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "29fcf32e6c73d1079f83ab4d782de2d81620346a5f38c6237a86a22f8368980a"
-dependencies = [
- "pkcs8",
- "signature 3.0.0",
-]
-
-[[package]]
-name = "ed25519-dalek"
-version = "3.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ebaa1a2bf1290ab3bfe5a7b771d050ebffab2711c19a81691c683a5144a25de"
-dependencies = [
- "curve25519-dalek 5.0.0",
- "ed25519",
- "serde",
- "sha2 0.11.0",
- "signature 3.0.0",
- "subtle",
- "zeroize",
-]
-
 [[package]]
 name = "either"
 version = "1.16.0"
@@ -1295,18 +1176,6 @@ dependencies = [
  "subtle",
 ]
 
-[[package]]
-name = "fiat-crypto"
-version = "0.2.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"
-
-[[package]]
-name = "fiat-crypto"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "64cd1e32ddd350061ae6edb1b082d7c54915b5c672c389143b9a63403a109f24"
-
 [[package]]
 name = "filetime"
 version = "0.2.29"
@@ -1384,9 +1253,9 @@ checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
 
 [[package]]
 name = "futures"
-version = "0.3.33"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a88cf1f829d945f548cf8fec32c61b1f202b6d93b45848602fc02af4b12ad218"
+checksum = "9a31d2a3fbaaeb2af2368bbdd904aa8e812d3c04a1ee10d3171f52d556e5d0a3"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -1399,9 +1268,9 @@ dependencies = [
 
 [[package]]
 name = "futures-channel"
-version = "0.3.33"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "262590f4fe6afeb0bc83be1daa64e52657fe185690a958af7f3ad0e92085c5ae"
+checksum = "b1f9e3d69d39e4862ffed03ed071a76f9a13ba1d9109d355b0f0aa6b15e393c4"
 dependencies = [
  "futures-core",
  "futures-sink",
@@ -1409,15 +1278,15 @@ dependencies = [
 
 [[package]]
 name = "futures-core"
-version = "0.3.33"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2cd50c473c80f6d7c3670a752354b8e569b1a7cbfdc0419ec88e5edad85e0dc7"
+checksum = "92d699e522242e69e3003b94ecc1f960f3a5e015aa7c5d7486e65ad01dd94f5e"
 
 [[package]]
 name = "futures-executor"
-version = "0.3.33"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6754879cc9f2c66f88c6e5c35344bb0bdb0708b0352b1201815667c7eabc7458"
+checksum = "031b47cf1a3c6cc8bc2fc76cd437f521619387907d469316e7c0bc278f1f5432"
 dependencies = [
  "futures-core",
  "futures-task",
@@ -1437,32 +1306,32 @@ dependencies = [
 
 [[package]]
 name = "futures-io"
-version = "0.3.33"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4577ecaa3c4f96589d473f679a71b596316f6641bc350038b962a5daf0085d7a"
+checksum = "53c0fa8157de1303bfffdaa1cc2a673bfffb60102f76b0ef4441659124373fed"
 
 [[package]]
 name = "futures-macro"
-version = "0.3.33"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d6d3cde68c518367be28956066ddfef33813991b77a55005a69dae04bf3b10b"
+checksum = "9fb9654ba8355388abeb8dcb4fc62f511300867002afc858860463bdd9fe0c44"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.119",
+ "syn 3.0.3",
 ]
 
 [[package]]
 name = "futures-sink"
-version = "0.3.33"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e34418ac499d6305c2fb5ad0ed2f6ac998c5f8ca209b4510f7f94242c647e307"
+checksum = "1944426bf7d03f1d14f708785e4b33efd750b36d48a157b836b3efc15ede8e1d"
 
 [[package]]
 name = "futures-task"
-version = "0.3.33"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b231ed28831efb4a61a08580c4bc233ec56bc009f4cd8f52da2c3cb97df0c109"
+checksum = "cd417de3d1d015fc3bfd2b1ea46dfc7bab72ef86f1cc7cc9c78e728b34a6d1fd"
 
 [[package]]
 name = "futures-timer"
@@ -1472,9 +1341,9 @@ checksum = "af43fadb8a98512d547e37b4e92e0ced13e205c061b87b4623eff01d918d6968"
 
 [[package]]
 name = "futures-util"
-version = "0.3.33"
+version = "0.3.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a77a90a256fce34da66415271e30f94ee91c57b04b8a2c042d9cf3220179deaa"
+checksum = "0d50a92467f8ba5dd6e3ee5d4bd04d73ab2e4e1c44474a0674821dfce14b79bc"
 dependencies = [
  "futures-channel",
  "futures-core",
@@ -1631,7 +1500,6 @@ checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
 dependencies = [
  "typenum",
  "version_check",
- "zeroize",
 ]
 
 [[package]]
@@ -1686,9 +1554,9 @@ dependencies = [
 
 [[package]]
 name = "h2"
-version = "0.4.15"
+version = "0.4.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6cb093c84e8bd9b188d4c4a8cb6579fc016968d14c99882163cd3ff402a4f155"
+checksum = "a9f37a958b41b3b19ee2707c06439c0e9e547e847223eb791ecb0cb821c65e27"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -2073,15 +1941,6 @@ dependencies = [
  "hashbrown 0.17.1",
 ]
 
-[[package]]
-name = "inout"
-version = "0.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01"
-dependencies = [
- "generic-array",
-]
-
 [[package]]
 name = "ipnet"
 version = "2.12.0"
@@ -2318,12 +2177,6 @@ version = "1.21.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
 
-[[package]]
-name = "opaque-debug"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
-
 [[package]]
 name = "openssl-probe"
 version = "0.2.1"
@@ -2498,17 +2351,6 @@ version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
 
-[[package]]
-name = "poly1305"
-version = "0.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8159bd90725d2df49889a078b54f4f79e87f1f8a8444194cdca81d38f5393abf"
-dependencies = [
- "cpufeatures 0.2.17",
- "opaque-debug",
- "universal-hash",
-]
-
 [[package]]
 name = "potential_utf"
 version = "0.1.5"
@@ -2579,8 +2421,7 @@ dependencies = [
  "bytes",
  "chrono",
  "cookie",
- "crypto_box",
- "ed25519-dalek",
+ "flate2",
  "futures",
  "gateway-admin",
  "gateway-core",
@@ -2608,6 +2449,7 @@ dependencies = [
  "tracing-subscriber",
  "tungstenite 0.27.0",
  "url",
+ "urlencoding",
  "uuid",
  "wiremock",
  "zstd",
@@ -2811,9 +2653,9 @@ dependencies = [
 
 [[package]]
 name = "redis"
-version = "1.5.0"
+version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3257df217f7eab0044627a268c9cc6cdb60c0c421c88f83ac41c4e31520b6b84"
+checksum = "e37a4ca5c6ca42aa3e6df2fd32b987a65d32a4c2159a6f3fe0fd1df306a2658f"
 dependencies = [
  "arc-swap",
  "arcstr",
@@ -3047,15 +2889,6 @@ version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
 
-[[package]]
-name = "salsa20"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97a22f5af31f73a954c10289c93e8a50cc23d971e80ee446f1f6f7137a088213"
-dependencies = [
- "cipher",
-]
-
 [[package]]
 name = "schannel"
 version = "0.1.29"
@@ -3623,7 +3456,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
  "fastrand",
- "getrandom 0.3.4",
+ "getrandom 0.4.3",
  "once_cell",
  "rustix",
  "windows-sys 0.61.2",
@@ -3631,18 +3464,18 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "2.0.19"
+version = "2.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09a43598840e33d5b0331f38c5e30d13bb11c11210a4b58f0d9b18a5a5eefcd9"
+checksum = "ec86235f5fcc2a73650310756d2ac5b138a5780bbbdfae3eeccec992c435ba4f"
 dependencies = [
  "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "2.0.19"
+version = "2.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "43cbfe0cf76104d42a574802844187e84a305e531ed54455f11fbde0f10541cd"
+checksum = "bc04cd3e1236dd4a98afca4569f2deb3f120e5422a4023be2cb683f8486292af"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -4044,16 +3877,6 @@ version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7df058c713841ad818f1dc5d3fd88063241cc61f49f5fbea4b951e8cf5a8d71d"
 
-[[package]]
-name = "universal-hash"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc1de2c688dc15305988b563c3854064043356019f97a4b46276fe734c4f07ea"
-dependencies = [
- "crypto-common 0.1.7",
- "subtle",
-]
-
 [[package]]
 name = "untrusted"
 version = "0.7.1"
@@ -4078,6 +3901,12 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "urlencoding"
+version = "2.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "daf8dba3b7eb870caf1ddeed7bc9d2a049f3cfdfae7cb521b087cc33ae4c49da"
+
 [[package]]
 name = "utf-8"
 version = "0.7.6"
@@ -4092,9 +3921,9 @@ checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
 
 [[package]]
 name = "uuid"
-version = "1.24.0"
+version = "1.24.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf3923a6f5c4c6382e0b653c4117f48d631ea17f38ed86e2a828e6f7412f5239"
+checksum = "2cefc03fd367c0c6d4305de1b312cf00248c4114f4a0418ce6a6af769e3b0bd9"
 dependencies = [
  "getrandom 0.4.3",
  "js-sys",

backend/apps/gateway/src/bootstrap.rs

@@ -27,8 +27,9 @@ impl LoadableConfig for GatewayConfig {
             return Err(ConfigError::InvalidField("schema_version"));
         }
         self.host.resolve_and_validate(source_dir)?;
+        let runtime_data_dir = self.host.runtime_data_dir().to_path_buf();
         self.store
-            .resolve_and_validate(source_dir)
+            .resolve_and_validate(&runtime_data_dir)
             .map_err(|_| ConfigError::InvalidField("store"))?;
         self.admin
             .resolve_and_validate(source_dir)
@@ -37,7 +38,7 @@ impl LoadableConfig for GatewayConfig {
             .resolve_and_validate(source_dir)
             .map_err(|_| ConfigError::InvalidField("api"))?;
         self.openai
-            .resolve_and_validate(source_dir)
+            .resolve_and_validate(&runtime_data_dir)
             .map_err(|_| ConfigError::InvalidField("openai"))?;
         self.xai
             .resolve_and_validate(source_dir)

backend/apps/gateway/tests/bootstrap.rs

@@ -18,10 +18,18 @@ fn config_loader_should_load_complete_terminal_example() {
 fn config_loader_should_resolve_paths_relative_to_config_file() {
     let (config, _directory) = parse_config(&valid_config()).expect("resolved config");
     let debug = format!("{config:?}");
+    assert!(debug.contains(".runtime/data"));
     assert!(debug.contains(".runtime/logs"));
     assert!(debug.contains("frontend/dist"));
 }
 
+#[test]
+fn config_loader_should_reject_missing_runtime_data_dir() {
+    let config = valid_config().replace("  runtime_data_dir: '../.runtime/data'\n", "");
+
+    assert!(parse_config(&config).is_err());
+}
+
 #[test]
 fn config_loader_should_inject_connection_passwords_into_urls() {
     parse_config(&valid_config()).expect("Store validates password injection into both URLs");
@@ -135,7 +143,10 @@ fn config_loader_should_reject_removed_fingerprint_section() {
 
 #[test]
 fn config_loader_should_reject_invalid_codex_cli_version() {
-    assert_rejected(valid_config().replace("codex_version: '0.146.0'", "codex_version: 'latest'"));
+    assert_rejected(valid_config().replace(
+        "codex_version: '0.147.0-alpha.6.6'",
+        "codex_version: 'latest'",
+    ));
 }
 
 #[test]
@@ -154,7 +165,7 @@ fn config_loader_should_reject_zero_server_port() {
 
 #[test]
 fn config_loader_should_reject_invalid_desktop_profile_fields() {
-    assert_rejected(valid_config().replace("desktop_build: '6119'", "desktop_build: 'build'"));
+    assert_rejected(valid_config().replace("desktop_build: '6415'", "desktop_build: 'build'"));
 }
 
 fn assert_rejected(config: String) {

backend/crates/gateway-admin/src/backup/policy.rs

@@ -119,11 +119,11 @@ pub struct RetentionDecision {
 
 /// 从按完成时间倒序的 completed 计划备份中决定纳入删除流程的记录。
 ///
-/// 规则（`docs/s3-backup-design-audit.md` §4.4）：
+/// 自动保留规则：
 /// - `retentionDays = 0` 时不按天数清理；`retentionCount = 0` 时不按份数清理。
 /// - 自动计划备份满足任一启用阈值即可进入删除。
 /// - 无论阈值如何，至少保留最近一个成功的计划备份（倒序下标 0）。
-/// - 手动备份不受自动阈值影响；无 TTL，仅由管理员手动删除。
+/// - 手动备份不进入本规则；手工/计划记录各自的 `expires_at` 由到期扫描处理。
 #[must_use]
 pub fn decide_retention(
     retention_days: u32,

backend/crates/gateway-admin/src/lib.rs

@@ -347,7 +347,10 @@ fn map_provider_registry_error(error: ProviderAdminError) -> AdminError {
         }
         ProviderAdminErrorKind::NotFound => AdminErrorKind::NotFound,
         ProviderAdminErrorKind::Conflict => AdminErrorKind::Conflict,
-        ProviderAdminErrorKind::Unavailable => AdminErrorKind::Unavailable,
+        ProviderAdminErrorKind::Unavailable | ProviderAdminErrorKind::CredentialRefreshRequired => {
+            AdminErrorKind::Unavailable
+        }
+        ProviderAdminErrorKind::BadGateway => AdminErrorKind::BadGateway,
         ProviderAdminErrorKind::Internal => AdminErrorKind::Internal,
     };
     AdminError::new(kind, "Provider registry initialization failed")

backend/crates/gateway-admin/src/model/backup.rs

@@ -288,7 +288,7 @@ pub struct BackupRecord {
     pub error_message: Option<String>,
     pub started_at: Option<DateTime<Utc>>,
     pub completed_at: Option<DateTime<Utc>>,
-    /// 手动过期时间；创建时确定，到期自动清理。
+    /// 创建时确定的过期时间；手工和计划备份均可设置，到期自动清理。
     pub expires_at: Option<DateTime<Utc>>,
     pub created_at: DateTime<Utc>,
     pub updated_at: DateTime<Utc>,

backend/crates/gateway-admin/src/model/observability.rs

@@ -557,7 +557,7 @@ pub struct UsageRecord {
     pub operation: String,
     pub endpoint: String,
     pub client_transport: String,
-    pub requested_model_id: String,
+    pub requested_model_id: Option<String>,
     pub provider_kind: Option<String>,
     pub provider_account_ref: Option<String>,
     pub provider_account_name: Option<String>,

backend/crates/gateway-admin/src/model/provider_credentials.rs

@@ -3,11 +3,12 @@
 use std::fmt;
 
 use async_trait::async_trait;
-use chrono::{DateTime, Utc};
+use chrono::{DateTime, NaiveDate, Utc};
 use gateway_core::{
     engine::credential::{OpaqueProviderData, ProviderAccountId, ProviderAccountIdentity},
     routing::{ProviderKind, UpstreamModelId},
 };
+use uuid::Uuid;
 
 use super::{
     AdminError, MutationActor, MutationContext, PageSize, Revision,
@@ -570,13 +571,34 @@ pub enum QuotaLocalUsageAttribution {
     Unavailable,
 }
 
+/// Provider quota bucket 中窗口的官方位置语义。
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum ProviderQuotaWindowRole {
+    Primary,
+    Secondary,
+    Monthly,
+}
+
+impl ProviderQuotaWindowRole {
+    #[must_use]
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::Primary => "primary",
+            Self::Secondary => "secondary",
+            Self::Monthly => "monthly",
+        }
+    }
+}
+
 /// 一个 Provider quota 窗口的公共投影。
 #[derive(Debug, Clone, PartialEq)]
 pub struct ProviderQuotaWindow {
     pub key: String,
     pub group: String,
     pub label: String,
-    pub source: Option<String>,
+    pub limit_id: Option<String>,
+    pub limit_name: Option<String>,
+    pub role: Option<ProviderQuotaWindowRole>,
     pub local_usage_attribution: QuotaLocalUsageAttribution,
     pub window_seconds: Option<u64>,
     pub used_percent: Option<f64>,
@@ -605,11 +627,96 @@ pub struct ProviderQuota {
     pub provider_data: Option<ProviderDocument>,
 }
 
+/// Provider 官方个人资料中的累计摘要。
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ProviderProfileStatisticsSummary {
+    pub total_text_tokens: Option<u64>,
+    pub peak_tokens: Option<u64>,
+    pub longest_task_duration_ms: Option<u64>,
+    pub current_streak_days: Option<u64>,
+    pub longest_streak_days: Option<u64>,
+}
+
+/// Provider 官方个人资料中的单日 Token bucket。
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ProviderProfileDailyUsage {
+    pub date: NaiveDate,
+    pub tokens: u64,
+}
+
+/// Provider 官方个人资料中的插件或 Skill 调用排行。
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ProviderProfileInvocation {
+    pub invocation_type: String,
+    pub plugin_id: Option<String>,
+    pub plugin_name: Option<String>,
+    pub skill_id: Option<String>,
+    pub skill_name: Option<String>,
+    pub usage_count: Option<u64>,
+}
+
+/// Provider 官方个人资料中的活动洞察。
+#[derive(Debug, Clone, PartialEq)]
+pub struct ProviderProfileActivityInsights {
+    pub fast_mode_percent: Option<f64>,
+    pub reasoning_effort: Option<String>,
+    pub reasoning_effort_percent: Option<f64>,
+    pub skills_explored: Option<u64>,
+    pub total_skills_used: Option<u64>,
+    pub total_threads: Option<u64>,
+    pub invocations: Option<Vec<ProviderProfileInvocation>>,
+}
+
+/// Provider 已解释的官方个人资料统计。
+#[derive(Debug, Clone, PartialEq)]
+pub struct ProviderProfileStatistics {
+    pub display_name: Option<String>,
+    pub username: Option<String>,
+    pub image_url: Option<String>,
+    pub has_stats_error: bool,
+    pub summary: ProviderProfileStatisticsSummary,
+    pub daily_usage: Option<Vec<ProviderProfileDailyUsage>>,
+    pub activity_insights: ProviderProfileActivityInsights,
+}
+
+/// Provider 返回的一张安全主动额度重置卡。
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ProviderResetCredit {
+    pub id: String,
+    pub status: Option<String>,
+    pub title: Option<String>,
+    pub expires_at: Option<DateTime<Utc>>,
+    pub reset_type: Option<String>,
+}
+
+/// Provider 主动额度重置卡列表。
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ProviderResetCredits {
+    pub available_count: u64,
+    pub credits: Vec<ProviderResetCredit>,
+}
+
+/// 一次主动额度重置卡消费命令。
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ConsumeProviderResetCredit {
+    pub account_id: ProviderAccountId,
+    pub credit_id: Option<String>,
+    pub redeem_request_id: Uuid,
+}
+
+/// Provider 返回的主动额度重置卡消费结果。
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ProviderResetCreditResult {
+    pub code: String,
+    pub credit: Option<ProviderResetCredit>,
+}
+
 impl ProviderQuota {
     /// 返回账号展开面板使用的当前额度窗口用量。
     ///
-    /// 只选择具备完整时间边界且可按账号归属的窗口；优先级与 Dashboard
-    /// 代表性额度窗口一致，同一优先级保持 Provider 投影顺序。
+    /// Provider 已提供账号级本地用量时，固定窗口和无固定重置点的滚动窗口
+    /// 都可作为代表用量；优先级与 Dashboard 代表性额度窗口一致，
+    /// 同一优先级保持 Provider 投影顺序。
     #[must_use]
     pub fn representative_window_usage(&self) -> Option<&AccountUsage> {
         self.windows
@@ -618,7 +725,6 @@ impl ProviderQuota {
             .filter(|(_, window)| {
                 window.local_usage_attribution == QuotaLocalUsageAttribution::AccountWide
                     && window.window_seconds.is_some()
-                    && window.reset_at.is_some()
                     && window.local_usage.is_some()
             })
             .min_by_key(|(index, window)| (quota_usage_priority(window), *index))
@@ -627,39 +733,94 @@ impl ProviderQuota {
 
     /// 返回 Dashboard 使用的代表性额度比例。
     ///
-    /// 优先使用短周期窗口，再依次使用周、月和其它窗口；同一优先级取较高的已用比例。
-    /// 这里只解释跨 Provider 共享的窗口语义，绝不读取 Provider 私有 JSON。
+    /// 优先使用覆盖账号全部请求的窗口；同一归属范围内再依次使用短周期、周、月
+    /// 和其它窗口，同一优先级取较高的已用比例。这里只解释跨 Provider 共享的窗口
+    /// 语义，绝不读取 Provider 私有 JSON。
     #[must_use]
     pub fn representative_used_percent(&self) -> Option<f64> {
+        if self.limit_reached {
+            return Some(100.0);
+        }
+        self.representative_used_window()
+            .map(|(_, used_percent)| used_percent)
+    }
+
+    /// 将已确认的账号级额度耗尽事实投影到展示窗口。
+    ///
+    /// Provider 已指出具体触顶窗口时只归一化这些窗口；否则归一化 Dashboard
+    /// 同样会选择的代表窗口，避免把多个独立额度窗口全部伪造成已用尽。
+    pub fn apply_limit_reached_display(&mut self) {
+        if !self.limit_reached {
+            return;
+        }
+        let reached_windows = self
+            .windows
+            .iter()
+            .enumerate()
+            .filter_map(|(index, window)| window.limit_reached.then_some(index))
+            .collect::<Vec<_>>();
+        if !reached_windows.is_empty() {
+            for index in reached_windows {
+                self.windows[index].used_percent = Some(100.0);
+            }
+            return;
+        }
+        let representative = self
+            .representative_used_window()
+            .map(|(index, _)| index)
+            .or_else(|| {
+                self.windows
+                    .iter()
+                    .enumerate()
+                    .min_by_key(|(index, window)| (quota_usage_priority(window), *index))
+                    .map(|(index, _)| index)
+            });
+        if let Some(index) = representative {
+            self.windows[index].used_percent = Some(100.0);
+            self.windows[index].limit_reached = true;
+        }
+    }
+
+    fn representative_used_window(&self) -> Option<(usize, f64)> {
         self.windows
             .iter()
+            .enumerate()
             .filter_map(|window| {
+                let (index, window) = window;
                 let used_percent = window
                     .used_percent
                     .filter(|value| value.is_finite())
                     .map(|value| value.clamp(0.0, 100.0))?;
-                Some((quota_usage_priority(window), used_percent))
+                Some((index, quota_usage_priority(window), used_percent))
             })
-            .fold(None::<(u8, f64)>, |selected, candidate| match selected {
-                Some(current)
-                    if current.0 < candidate.0
-                        || (current.0 == candidate.0 && current.1 >= candidate.1) =>
-                {
+            .fold(
+                None::<(usize, (u8, u8), f64)>,
+                |selected, candidate| match selected {
                     Some(current)
-                }
-                _ => Some(candidate),
-            })
-            .map(|(_, used_percent)| used_percent)
+                        if current.1 < candidate.1
+                            || (current.1 == candidate.1 && current.2 >= candidate.2) =>
+                    {
+                        Some(current)
+                    }
+                    _ => Some(candidate),
+                },
+            )
+            .map(|(index, _, used_percent)| (index, used_percent))
     }
 }
 
-fn quota_usage_priority(window: &ProviderQuotaWindow) -> u8 {
-    match window.group.as_str() {
+fn quota_usage_priority(window: &ProviderQuotaWindow) -> (u8, u8) {
+    let attribution = match window.local_usage_attribution {
+        QuotaLocalUsageAttribution::AccountWide => 0,
+        QuotaLocalUsageAttribution::Unavailable => 1,
+    };
+    let duration = match window.group.as_str() {
         "shortTerm" if window.window_seconds.is_some_and(is_week_window) => 1,
         "shortTerm" => 0,
         "monthly" => 2,
         _ => 3,
-    }
+    };
+    (attribution, duration)
 }
 
 fn is_week_window(seconds: u64) -> bool {

backend/crates/gateway-admin/src/ports/provider.rs

@@ -13,11 +13,12 @@ use crate::model::observability::{
     CalculatedBillingBreakdown, DashboardWireProfile, ProviderBillingInput,
 };
 use crate::model::provider_credentials::{
-    AuthorizationStarted, CompleteAuthorization, PendingAuthorizationMutation,
-    PrepareCredentialImport, PrepareCredentialRefresh, PrepareCredentialRotation,
-    PreparedAuthorizationCommit, PreparedCredentialImport, PreparedCredentialRotation,
-    ProviderExport, ProviderExportCredentialInput, ProviderModels, ProviderQuota,
-    ProviderQuotaRequest,
+    AuthorizationStarted, CompleteAuthorization, ConsumeProviderResetCredit,
+    PendingAuthorizationMutation, PrepareCredentialImport, PrepareCredentialRefresh,
+    PrepareCredentialRotation, PreparedAuthorizationCommit, PreparedCredentialImport,
+    PreparedCredentialRotation, ProviderExport, ProviderExportCredentialInput, ProviderModels,
+    ProviderProfileStatistics, ProviderQuota, ProviderQuotaRequest, ProviderResetCreditResult,
+    ProviderResetCredits,
 };
 
 /// Provider 管理失败的稳定分类。
@@ -28,26 +29,56 @@ pub enum ProviderAdminErrorKind {
     NotFound,
     Conflict,
     Unavailable,
+    CredentialRefreshRequired,
+    BadGateway,
     Internal,
 }
 
-/// 不泄漏 OAuth material 与 Provider 响应体的管理错误。
-#[derive(Debug, Clone, PartialEq, Eq, thiserror::Error)]
+/// 不携带 OAuth 请求材料的管理错误。
+///
+/// `message` 用于当前认证管理请求展示；上游没有标准 `error.message` 时，
+/// Provider 可以按其官方契约回退为完整的非成功响应正文。
+#[derive(Clone, PartialEq, Eq, thiserror::Error)]
 #[error("provider admin operation failed: {kind:?}")]
 pub struct ProviderAdminError {
     kind: ProviderAdminErrorKind,
+    message: Option<String>,
+}
+
+impl std::fmt::Debug for ProviderAdminError {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("ProviderAdminError")
+            .field("kind", &self.kind)
+            .field("message", &self.message.as_ref().map(|_| "<redacted>"))
+            .finish()
+    }
 }
 
 impl ProviderAdminError {
     #[must_use]
     pub const fn new(kind: ProviderAdminErrorKind) -> Self {
-        Self { kind }
+        Self {
+            kind,
+            message: None,
+        }
+    }
+
+    #[must_use]
+    pub fn with_message(mut self, message: impl Into<String>) -> Self {
+        self.message = Some(message.into());
+        self
     }
 
     #[must_use]
     pub const fn kind(&self) -> ProviderAdminErrorKind {
         self.kind
     }
+
+    #[must_use]
+    pub fn message(&self) -> Option<&str> {
+        self.message.as_deref()
+    }
 }
 
 /// 一个具体 Provider 对管理控制面提供的解析、验证、上游交互与运行时资源回收能力。
@@ -116,6 +147,30 @@ pub trait ProviderAdmin: Send + Sync {
         request: ProviderQuotaRequest,
     ) -> Result<ProviderQuota, ProviderAdminError>;
 
+    /// 查询 Provider 官方个人资料统计；不支持该能力的 Provider 使用默认拒绝。
+    async fn profile_statistics(
+        &self,
+        _account_id: &ProviderAccountId,
+    ) -> Result<ProviderProfileStatistics, ProviderAdminError> {
+        Err(ProviderAdminError::new(ProviderAdminErrorKind::Unsupported))
+    }
+
+    /// 查询 Provider 主动额度重置卡；不支持该能力的 Provider 使用默认拒绝。
+    async fn reset_credits(
+        &self,
+        _account_id: &ProviderAccountId,
+    ) -> Result<ProviderResetCredits, ProviderAdminError> {
+        Err(ProviderAdminError::new(ProviderAdminErrorKind::Unsupported))
+    }
+
+    /// 消费 Provider 主动额度重置卡；不支持该能力的 Provider 使用默认拒绝。
+    async fn consume_reset_credit(
+        &self,
+        _command: ConsumeProviderResetCredit,
+    ) -> Result<ProviderResetCreditResult, ProviderAdminError> {
+        Err(ProviderAdminError::new(ProviderAdminErrorKind::Unsupported))
+    }
+
     async fn models(
         &self,
         account_id: &ProviderAccountId,

backend/crates/gateway-admin/src/use_case/accounts.rs

@@ -24,8 +24,9 @@ use crate::{
         observability::TimeRange,
         provider_credentials::{
             AccountDirectoryItem, AccountDirectoryPage, AccountExportBundle, AccountRefreshResult,
-            PrepareCredentialRefresh, ProviderModels, ProviderQuota, ProviderQuotaRequest,
-            ProviderQuotaWindow, QuotaLocalUsageAttribution,
+            ConsumeProviderResetCredit, PrepareCredentialRefresh, ProviderModels,
+            ProviderProfileStatistics, ProviderQuota, ProviderQuotaRequest, ProviderQuotaWindow,
+            ProviderResetCreditResult, ProviderResetCredits, QuotaLocalUsageAttribution,
         },
     },
     ports::{provider::ProviderAdminRegistry, store::AccountStore},
@@ -79,6 +80,35 @@ pub trait AccountsService: Send + Sync {
         refresh: bool,
     ) -> Result<AccountDirectoryItem, AdminError>;
 
+    async fn profile_statistics(
+        &self,
+        _account_id: &ProviderAccountId,
+    ) -> Result<ProviderProfileStatistics, AdminError> {
+        Err(AdminError::invalid(
+            "Provider profile statistics are not supported",
+        ))
+    }
+
+    async fn reset_credits(
+        &self,
+        _context: &MutationContext,
+        _account_id: ProviderAccountId,
+    ) -> Result<ProviderResetCredits, AdminError> {
+        Err(AdminError::invalid(
+            "Provider reset credits are not supported",
+        ))
+    }
+
+    async fn consume_reset_credit(
+        &self,
+        _context: &MutationContext,
+        _command: ConsumeProviderResetCredit,
+    ) -> Result<ProviderResetCreditResult, AdminError> {
+        Err(AdminError::invalid(
+            "Provider reset credits are not supported",
+        ))
+    }
+
     async fn models(
         &self,
         account_id: &ProviderAccountId,
@@ -97,11 +127,13 @@ pub(crate) struct DefaultAccountsService {
     providers: ProviderAdminRegistry,
     snapshot: Arc<dyn SnapshotControl>,
     probe: Arc<dyn AccountProbe>,
+    reset_credit_locks:
+        Arc<futures::lock::Mutex<BTreeMap<ProviderAccountId, Arc<futures::lock::Mutex<()>>>>>,
 }
 
 impl DefaultAccountsService {
     #[must_use]
-    pub(crate) const fn new(
+    pub(crate) fn new(
         accounts: Arc<dyn AccountStore>,
         providers: ProviderAdminRegistry,
         snapshot: Arc<dyn SnapshotControl>,
@@ -112,9 +144,22 @@ impl DefaultAccountsService {
             providers,
             snapshot,
             probe,
+            reset_credit_locks: Arc::new(futures::lock::Mutex::new(BTreeMap::new())),
         }
     }
 
+    async fn reset_credit_lock(
+        &self,
+        account_id: &ProviderAccountId,
+    ) -> Arc<futures::lock::Mutex<()>> {
+        let mut locks = self.reset_credit_locks.lock().await;
+        Arc::clone(
+            locks
+                .entry(account_id.clone())
+                .or_insert_with(|| Arc::new(futures::lock::Mutex::new(()))),
+        )
+    }
+
     async fn load_account(
         &self,
         account_id: &ProviderAccountId,
@@ -502,6 +547,68 @@ impl AccountsService for DefaultAccountsService {
         self.load_directory_item(account_id, refresh).await
     }
 
+    async fn profile_statistics(
+        &self,
+        account_id: &ProviderAccountId,
+    ) -> Result<ProviderProfileStatistics, AdminError> {
+        let (_, provider) = self.provider_for_account(account_id).await?;
+        provider
+            .profile_statistics(account_id)
+            .await
+            .map_err(|error| map_provider_error(error, "provider profile statistics"))
+    }
+
+    async fn reset_credits(
+        &self,
+        context: &MutationContext,
+        account_id: ProviderAccountId,
+    ) -> Result<ProviderResetCredits, AdminError> {
+        let (_, provider) = self.provider_for_account(&account_id).await?;
+        match provider.reset_credits(&account_id).await {
+            Ok(credits) => Ok(credits),
+            Err(error)
+                if error.kind()
+                    == crate::ports::provider::ProviderAdminErrorKind::CredentialRefreshRequired =>
+            {
+                self.refresh(context, account_id.clone()).await?;
+                let (_, provider) = self.provider_for_account(&account_id).await?;
+                provider
+                    .reset_credits(&account_id)
+                    .await
+                    .map_err(map_reset_credits_error_after_refresh)
+            }
+            Err(error) => Err(map_provider_error(error, "provider reset credits")),
+        }
+    }
+
+    async fn consume_reset_credit(
+        &self,
+        context: &MutationContext,
+        command: ConsumeProviderResetCredit,
+    ) -> Result<ProviderResetCreditResult, AdminError> {
+        let account_id = command.account_id.clone();
+        // 覆盖 credential refresh + 同键重试的完整账号级临界区，避免 401 两次调用
+        // 之间插入另一笔不可逆消费。
+        let lock = self.reset_credit_lock(&account_id).await;
+        let _guard = lock.lock().await;
+        let (_, provider) = self.provider_for_account(&account_id).await?;
+        match provider.consume_reset_credit(command.clone()).await {
+            Ok(result) => Ok(result),
+            Err(error)
+                if error.kind()
+                    == crate::ports::provider::ProviderAdminErrorKind::CredentialRefreshRequired =>
+            {
+                self.refresh(context, account_id.clone()).await?;
+                let (_, provider) = self.provider_for_account(&account_id).await?;
+                provider
+                    .consume_reset_credit(command)
+                    .await
+                    .map_err(map_reset_credits_error_after_refresh)
+            }
+            Err(error) => Err(map_provider_error(error, "provider reset-credit consume")),
+        }
+    }
+
     async fn models(
         &self,
         account_id: &ProviderAccountId,
@@ -565,11 +672,7 @@ impl AccountsService for DefaultAccountsService {
                     let upstream_body = error
                         .upstream_response()
                         .map(|response| String::from_utf8_lossy(response.body()).into_owned());
-                    let message = upstream_body
-                        .as_deref()
-                        .filter(|body| !body.is_empty())
-                        .unwrap_or_else(|| error.client_message())
-                        .to_owned();
+                    let message = error.client_message().to_owned();
                     vec![AccountConnectionTestEvent::Failed {
                         message,
                         provider_error_code: error.client_error_code().map(ToOwned::to_owned),
@@ -586,6 +689,19 @@ impl AccountsService for DefaultAccountsService {
     }
 }
 
+fn map_reset_credits_error_after_refresh(
+    error: crate::ports::provider::ProviderAdminError,
+) -> AdminError {
+    if error.kind() == crate::ports::provider::ProviderAdminErrorKind::CredentialRefreshRequired {
+        return AdminError::bad_gateway(
+            error
+                .message()
+                .unwrap_or("OpenAI reset-credit upstream rejected the refreshed credential"),
+        );
+    }
+    map_provider_error(error, "provider reset credits")
+}
+
 /// 账号目录中单个账号 quota 读取失败时使用的空额度投影。
 fn empty_quota() -> ProviderQuota {
     ProviderQuota {

backend/crates/gateway-admin/src/use_case/mod.rs

@@ -57,9 +57,15 @@ fn map_provider_error(
         ProviderAdminErrorKind::NotFound => AdminErrorKind::NotFound,
         ProviderAdminErrorKind::Conflict => AdminErrorKind::Conflict,
         ProviderAdminErrorKind::Unavailable => AdminErrorKind::Unavailable,
+        ProviderAdminErrorKind::CredentialRefreshRequired => AdminErrorKind::Unavailable,
+        ProviderAdminErrorKind::BadGateway => AdminErrorKind::BadGateway,
         ProviderAdminErrorKind::Internal => AdminErrorKind::Internal,
     };
-    AdminError::new(kind, format!("{resource} operation failed"))
+    let message = error
+        .message()
+        .map(ToOwned::to_owned)
+        .unwrap_or_else(|| format!("{resource} operation failed"));
+    AdminError::new(kind, message)
 }
 
 async fn publish_committed(

backend/crates/gateway-admin/tests/main.rs

@@ -6,6 +6,7 @@ use gateway_core::engine::credential::OpaqueProviderData;
 use gateway_admin::{
     model::{
         PageSize, Revision,
+        accounts::AccountUsage,
         auth::LoginCommand,
         client_keys::ClientKeyPageSize,
         observability::{DecimalAmount, RequestOutcome, TimeRange},
@@ -135,6 +136,115 @@ fn representative_quota_should_prefer_short_window_and_highest_usage() {
     assert_eq!(quota.representative_used_percent(), Some(45.0));
 }
 
+#[test]
+fn representative_quota_should_prefer_account_wide_window_over_model_specific_window() {
+    let mut model_specific = quota_window("shortTerm", Some(18_000), Some(64.0));
+    model_specific.local_usage_attribution = QuotaLocalUsageAttribution::Unavailable;
+    let quota = ProviderQuota {
+        observed_at: None,
+        refresh_token_expires_at: None,
+        windows: vec![
+            model_specific,
+            quota_window("shortTerm", Some(604_800), Some(5.0)),
+        ],
+        limit_reached: false,
+        provider_data: None,
+    };
+
+    assert_eq!(quota.representative_used_percent(), Some(5.0));
+}
+
+#[test]
+fn representative_window_usage_should_accept_account_wide_rolling_window_without_reset() {
+    let usage = AccountUsage {
+        account_id: "acct_xai".to_owned(),
+        request_count: 5,
+        success_count: 5,
+        input_tokens: Some(100),
+        output_tokens: Some(20),
+        cached_tokens: Some(80),
+        cache_write_tokens: Some(0),
+        reasoning_tokens: Some(0),
+        image_input_tokens: Some(0),
+        image_output_tokens: Some(0),
+        image_request_count: 0,
+        image_request_failed_count: 0,
+        total_tokens: Some(120),
+        cost_coverage: Default::default(),
+        costs: Vec::new(),
+        last_used_at: Some(Utc::now()),
+        request_buckets: Vec::new(),
+        models: Vec::new(),
+    };
+    let quota = ProviderQuota {
+        observed_at: None,
+        refresh_token_expires_at: None,
+        windows: vec![ProviderQuotaWindow {
+            key: "free-rolling-24h".to_owned(),
+            group: "shortTerm".to_owned(),
+            label: "日限额".to_owned(),
+            limit_id: None,
+            limit_name: None,
+            role: None,
+            local_usage_attribution: QuotaLocalUsageAttribution::AccountWide,
+            window_seconds: Some(86_400),
+            used_percent: None,
+            reset_at: None,
+            limit_reached: false,
+            local_usage: Some(usage.clone()),
+            provider_data: None,
+        }],
+        limit_reached: false,
+        provider_data: None,
+    };
+
+    assert_eq!(quota.representative_window_usage(), Some(&usage));
+}
+
+#[test]
+fn exhausted_quota_should_project_full_usage_to_only_the_representative_window() {
+    let mut quota = ProviderQuota {
+        observed_at: None,
+        refresh_token_expires_at: None,
+        windows: vec![
+            quota_window("monthly", Some(2_592_000), Some(99.0)),
+            quota_window("shortTerm", Some(604_800), Some(80.0)),
+            quota_window("shortTerm", Some(18_000), Some(30.0)),
+            quota_window("shortTerm", Some(14_400), Some(95.0)),
+        ],
+        limit_reached: true,
+        provider_data: None,
+    };
+
+    assert_eq!(quota.representative_used_percent(), Some(100.0));
+    quota.apply_limit_reached_display();
+
+    assert_eq!(quota.windows[0].used_percent, Some(99.0));
+    assert_eq!(quota.windows[1].used_percent, Some(80.0));
+    assert_eq!(quota.windows[2].used_percent, Some(30.0));
+    assert_eq!(quota.windows[3].used_percent, Some(100.0));
+    assert!(quota.windows[3].limit_reached);
+}
+
+#[test]
+fn exhausted_quota_should_preserve_the_provider_identified_reached_window() {
+    let mut reached = quota_window("monthly", Some(2_592_000), Some(98.0));
+    reached.limit_reached = true;
+    let mut quota = ProviderQuota {
+        observed_at: None,
+        refresh_token_expires_at: None,
+        windows: vec![reached, quota_window("shortTerm", Some(18_000), Some(95.0))],
+        limit_reached: true,
+        provider_data: None,
+    };
+
+    quota.apply_limit_reached_display();
+
+    assert_eq!(quota.windows[0].used_percent, Some(100.0));
+    assert_eq!(quota.windows[1].used_percent, Some(95.0));
+    assert!(!quota.windows[1].limit_reached);
+}
+
 fn quota_window(
     group: &str,
     window_seconds: Option<u64>,
@@ -144,7 +254,9 @@ fn quota_window(
         key: group.to_owned(),
         group: group.to_owned(),
         label: group.to_owned(),
-        source: None,
+        limit_id: None,
+        limit_name: None,
+        role: None,
         local_usage_attribution: QuotaLocalUsageAttribution::AccountWide,
         window_seconds,
         used_percent,

backend/crates/gateway-admin/tests/use_case/accounts.rs

@@ -30,14 +30,16 @@ use gateway_admin::{
         provider_credentials::{
             AuthorizationCommit, AuthorizationCommitGuard, AuthorizationCredentialCommit,
             AuthorizationMutationTarget, AuthorizationStarted, CompleteAuthorization,
-            CredentialCommitGuard, CredentialDetails, CredentialImportCommit,
-            CredentialImportResult, CredentialListQuery, CredentialMutationResult, CredentialPage,
-            CredentialRotationCommit, PendingAuthorizationMutation, PrepareCredentialImport,
-            PrepareCredentialRefresh, PrepareCredentialRotation, PreparedAuthorizationCommit,
+            ConsumeProviderResetCredit, CredentialCommitGuard, CredentialDetails,
+            CredentialImportCommit, CredentialImportResult, CredentialListQuery,
+            CredentialMutationResult, CredentialPage, CredentialRotationCommit,
+            PendingAuthorizationMutation, PrepareCredentialImport, PrepareCredentialRefresh,
+            PrepareCredentialRotation, PreparedAuthorizationCommit,
             PreparedAuthorizationCredential, PreparedCredentialCreate, PreparedCredentialImport,
             PreparedCredentialRotation, PreparedCredentialRotationFacts, ProviderDocument,
             ProviderExport, ProviderExportCredentialInput, ProviderModels, ProviderQuota,
-            ProviderQuotaRequest, ProviderQuotaWindow, QuotaLocalUsageAttribution,
+            ProviderQuotaRequest, ProviderQuotaWindow, ProviderResetCreditResult,
+            QuotaLocalUsageAttribution,
         },
         settings::{
             AdminApiKey, AdminApiKeyMutation, ReplaceRuntimeSettings, RotationStrategy,
@@ -60,7 +62,7 @@ pub(super) type EventLog = Arc<Mutex<Vec<&'static str>>>;
 pub(super) struct FakeProviderAdmin {
     kind: ProviderKind,
     events: EventLog,
-    failure: Mutex<Option<ProviderAdminErrorKind>>,
+    failure: Mutex<Option<ProviderAdminError>>,
     quota_failure: Mutex<Option<ProviderAdminErrorKind>>,
     pending: Arc<Mutex<Option<PendingAuthorizationMutation>>>,
     retry_authorization_after_abort: Mutex<bool>,
@@ -69,6 +71,7 @@ pub(super) struct FakeProviderAdmin {
     quota_requests: Mutex<Vec<ProviderQuotaRequest>>,
     quota: Mutex<ProviderQuota>,
     current_credential_revision: Mutex<Revision>,
+    reset_credit_commands: Mutex<Vec<ConsumeProviderResetCredit>>,
 }
 
 impl FakeProviderAdmin {
@@ -85,11 +88,17 @@ impl FakeProviderAdmin {
             quota_requests: Mutex::new(Vec::new()),
             quota: Mutex::new(empty_quota()),
             current_credential_revision: Mutex::new(revision(1)),
+            reset_credit_commands: Mutex::new(Vec::new()),
         })
     }
 
     pub(super) fn fail_next(&self, kind: ProviderAdminErrorKind) {
-        *self.failure.lock().expect("provider failure") = Some(kind);
+        *self.failure.lock().expect("provider failure") = Some(ProviderAdminError::new(kind));
+    }
+
+    fn fail_next_with_message(&self, kind: ProviderAdminErrorKind, message: &str) {
+        *self.failure.lock().expect("provider failure") =
+            Some(ProviderAdminError::new(kind).with_message(message));
     }
 
     pub(super) fn fail_next_quota(&self, kind: ProviderAdminErrorKind) {
@@ -113,6 +122,13 @@ impl FakeProviderAdmin {
             .clone()
     }
 
+    fn reset_credit_commands(&self) -> Vec<ConsumeProviderResetCredit> {
+        self.reset_credit_commands
+            .lock()
+            .expect("provider reset-credit commands")
+            .clone()
+    }
+
     pub(super) fn set_quota(&self, quota: ProviderQuota) {
         *self.quota.lock().expect("provider quota") = quota;
     }
@@ -145,7 +161,7 @@ impl FakeProviderAdmin {
 
     fn require_available(&self) -> Result<(), ProviderAdminError> {
         match self.failure.lock().expect("provider failure").take() {
-            Some(kind) => Err(ProviderAdminError::new(kind)),
+            Some(error) => Err(error),
             None => Ok(()),
         }
     }
@@ -344,6 +360,22 @@ impl ProviderAdmin for FakeProviderAdmin {
         Ok(self.quota.lock().expect("provider quota").clone())
     }
 
+    async fn consume_reset_credit(
+        &self,
+        command: ConsumeProviderResetCredit,
+    ) -> Result<ProviderResetCreditResult, ProviderAdminError> {
+        self.record("provider.consume_reset_credit");
+        self.reset_credit_commands
+            .lock()
+            .expect("provider reset-credit commands")
+            .push(command);
+        self.require_available()?;
+        Ok(ProviderResetCreditResult {
+            code: "reset".to_owned(),
+            credit: None,
+        })
+    }
+
     async fn models(
         &self,
         _: &ProviderAccountId,
@@ -1257,7 +1289,9 @@ async fn accounts_list_should_degrade_quota_failure_to_empty_window_without_drop
             key: "primary".to_owned(),
             group: "shortTerm".to_owned(),
             label: "5小时限额".to_owned(),
-            source: None,
+            limit_id: None,
+            limit_name: None,
+            role: None,
             local_usage_attribution: QuotaLocalUsageAttribution::AccountWide,
             window_seconds: Some(5 * 60 * 60),
             used_percent: Some(97.0),
@@ -1386,7 +1420,9 @@ async fn accounts_list_should_not_derive_rate_limited_from_provider_quota_view()
             key: "primary".to_owned(),
             group: "shortTerm".to_owned(),
             label: "5小时限额".to_owned(),
-            source: None,
+            limit_id: None,
+            limit_name: None,
+            role: None,
             local_usage_attribution: QuotaLocalUsageAttribution::AccountWide,
             window_seconds: Some(5 * 60 * 60),
             used_percent: Some(100.0),
@@ -1431,7 +1467,9 @@ async fn accounts_list_should_not_derive_exhaustion_from_provider_quota_view() {
             key: "primary".to_owned(),
             group: "shortTerm".to_owned(),
             label: "5小时限额".to_owned(),
-            source: None,
+            limit_id: None,
+            limit_name: None,
+            role: None,
             local_usage_attribution: QuotaLocalUsageAttribution::AccountWide,
             window_seconds: Some(5 * 60 * 60),
             used_percent: Some(100.0),
@@ -1477,7 +1515,9 @@ async fn accounts_list_should_attach_local_usage_to_quota_windows() {
             key: "primary".to_owned(),
             group: "shortTerm".to_owned(),
             label: "5小时限额".to_owned(),
-            source: None,
+            limit_id: None,
+            limit_name: None,
+            role: None,
             local_usage_attribution: QuotaLocalUsageAttribution::AccountWide,
             window_seconds: Some(5 * 60 * 60),
             used_percent: Some(97.0),
@@ -1542,7 +1582,9 @@ async fn accounts_list_should_not_attach_account_usage_to_model_specific_quota_w
                 key: "core-primary".to_owned(),
                 group: "weekly".to_owned(),
                 label: "周额度".to_owned(),
-                source: Some("codex".to_owned()),
+                limit_id: Some("codex".to_owned()),
+                limit_name: None,
+                role: None,
                 local_usage_attribution: QuotaLocalUsageAttribution::AccountWide,
                 window_seconds: Some(7 * 24 * 60 * 60),
                 used_percent: Some(1.0),
@@ -1554,8 +1596,10 @@ async fn accounts_list_should_not_attach_account_usage_to_model_specific_quota_w
             ProviderQuotaWindow {
                 key: "codex-bengalfox-primary".to_owned(),
                 group: "weekly".to_owned(),
-                label: "GPT-5.3-Codex-Spark · 周额度".to_owned(),
-                source: Some("codex_bengalfox".to_owned()),
+                label: "周额度".to_owned(),
+                limit_id: Some("codex_bengalfox".to_owned()),
+                limit_name: Some("GPT-5.3-Codex-Spark".to_owned()),
+                role: None,
                 local_usage_attribution: QuotaLocalUsageAttribution::Unavailable,
                 window_seconds: Some(7 * 24 * 60 * 60),
                 used_percent: Some(0.0),
@@ -1650,6 +1694,59 @@ async fn accounts_refresh_provider_failure_should_not_call_store_commit() {
     );
 }
 
+#[tokio::test]
+async fn reset_credit_oauth_refresh_should_reuse_the_exact_consume_command() {
+    let events = events();
+    let provider = FakeProviderAdmin::new("openai", events.clone());
+    provider.fail_next(ProviderAdminErrorKind::CredentialRefreshRequired);
+    let store = FakeAccountStore::new("openai", events.clone());
+    let services = accounts_service(provider.clone(), store).await;
+    let redeem_request_id =
+        uuid::Uuid::parse_str("8fbf302d-11df-4bd5-82e4-08e4b3df7874").expect("UUID v4");
+    let command = ConsumeProviderResetCredit {
+        account_id: ProviderAccountId::new("acct_test").expect("account ID"),
+        credit_id: Some("credit_1".to_owned()),
+        redeem_request_id,
+    };
+
+    let result = services
+        .accounts()
+        .consume_reset_credit(&context("reset-credit-refresh"), command.clone())
+        .await
+        .expect("consume after OAuth refresh");
+
+    assert_eq!(result.code, "reset");
+    assert_eq!(provider.reset_credit_commands(), [command.clone(), command]);
+    assert!(recorded(&events).contains(&"provider.prepare_refresh"));
+    assert!(recorded(&events).contains(&"store.commit_refresh"));
+}
+
+#[tokio::test]
+async fn accounts_refresh_should_preserve_the_provider_failure_message() {
+    let events = events();
+    let provider = FakeProviderAdmin::new("openai", events.clone());
+    let upstream_message = "Your refresh token has already been used.";
+    provider.fail_next_with_message(ProviderAdminErrorKind::Conflict, upstream_message);
+    let store = FakeAccountStore::new("openai", events.clone());
+    let services = accounts_service(provider, store).await;
+
+    let error = services
+        .accounts()
+        .refresh(
+            &context("refresh-provider-message"),
+            ProviderAccountId::new("acct_test").expect("account ID"),
+        )
+        .await
+        .expect_err("Provider preparation must fail");
+
+    assert_eq!(error.kind(), gateway_admin::model::AdminErrorKind::Conflict);
+    assert_eq!(error.to_string(), upstream_message);
+    assert_eq!(
+        recorded(&events),
+        ["store.load_account", "provider.prepare_refresh"]
+    );
+}
+
 #[tokio::test]
 async fn accounts_refresh_store_failure_should_drop_guard_after_commit_attempt() {
     let events = events();

backend/crates/gateway-admin/tests/use_case/observability.rs

@@ -662,7 +662,7 @@ fn total_record(
         operation: "generate".to_owned(),
         endpoint: "/v1/responses".to_owned(),
         client_transport: "http_sse".to_owned(),
-        requested_model_id: "gpt-5.5".to_owned(),
+        requested_model_id: Some("gpt-5.5".to_owned()),
         provider_kind: provider_kind.map(str::to_owned),
         provider_account_ref: None,
         provider_account_name: None,

backend/crates/gateway-api/src/admin/accounts.rs

@@ -25,10 +25,13 @@ use gateway_admin::model::{
     },
     provider_credentials::{
         AccountDirectoryItem, AccountDirectoryPage, AccountExportBundle, AccountRefreshResult,
-        AuthorizationStarted, CompleteAuthorization, CredentialDeletion, CredentialDeletionResult,
-        CredentialImportResult, CredentialMutation, CredentialMutationResult, ImportCredentials,
-        ProviderDocument, ProviderModels, ProviderQuota, ProviderQuotaWindow, RotateCredential,
-        StartAuthorization,
+        AuthorizationStarted, CompleteAuthorization, ConsumeProviderResetCredit,
+        CredentialDeletion, CredentialDeletionResult, CredentialImportResult, CredentialMutation,
+        CredentialMutationResult, ImportCredentials, ProviderDocument, ProviderModels,
+        ProviderProfileActivityInsights, ProviderProfileDailyUsage, ProviderProfileInvocation,
+        ProviderProfileStatistics, ProviderProfileStatisticsSummary, ProviderQuota,
+        ProviderQuotaWindow, ProviderResetCredit, ProviderResetCreditResult, ProviderResetCredits,
+        RotateCredential, StartAuthorization,
     },
 };
 use gateway_core::{
@@ -37,6 +40,7 @@ use gateway_core::{
 };
 use serde::{Deserialize, Deserializer, Serialize};
 use serde_json::{Map, Value};
+use uuid::{Uuid, Version};
 
 use super::presenter::{format_compact_number, format_decimal_currency, format_number};
 use super::{
@@ -305,8 +309,12 @@ pub struct AccountQuotaView {
 pub struct AccountQuotaWindowView {
     pub key: String,
     pub group: String,
+    pub limit_id: Option<String>,
+    pub limit_name: Option<String>,
+    pub role: Option<String>,
     pub window_seconds: Option<u64>,
     pub label_display: String,
+    pub window_label_display: String,
     pub used_percent: Option<f64>,
     pub used_percent_display: String,
     pub limit_reached: bool,
@@ -472,6 +480,48 @@ impl AccountActionRequest {
     }
 }
 
+/// 主动额度重置卡消费请求。幂等键由 UI 生成并在不确定重试时复用，与官方一致。
+#[derive(Debug, Clone, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct AccountResetCreditConsumeRequest {
+    pub account_id: String,
+    #[serde(default)]
+    pub credit_id: Option<String>,
+    pub redeem_request_id: String,
+}
+
+impl AccountResetCreditConsumeRequest {
+    pub fn validate(&self) -> Result<(), WireValidationError> {
+        require_account_id(&self.account_id, "accountId")?;
+        if self.credit_id.as_deref().is_some_and(|value| {
+            let value = value.trim();
+            value.is_empty() || value.len() > 512 || value.chars().any(char::is_control)
+        }) {
+            return Err(WireValidationError::new("creditId"));
+        }
+        let value = self.redeem_request_id.trim();
+        let redeem_request_id =
+            Uuid::parse_str(value).map_err(|_| WireValidationError::new("redeemRequestId"))?;
+        if redeem_request_id.get_version() != Some(Version::Random)
+            || redeem_request_id.hyphenated().to_string() != value
+        {
+            return Err(WireValidationError::new("redeemRequestId"));
+        }
+        Ok(())
+    }
+
+    fn into_command(self) -> Result<ConsumeProviderResetCredit, WireValidationError> {
+        self.validate()?;
+        Ok(ConsumeProviderResetCredit {
+            account_id: ProviderAccountId::new(self.account_id)
+                .map_err(|_| WireValidationError::new("accountId"))?,
+            credit_id: self.credit_id.map(|value| value.trim().to_owned()),
+            redeem_request_id: Uuid::parse_str(&self.redeem_request_id)
+                .map_err(|_| WireValidationError::new("redeemRequestId"))?,
+        })
+    }
+}
+
 /// 手工 OAuth 刷新会变更持久 credential。
 #[derive(Debug, Clone, Deserialize)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
@@ -539,6 +589,186 @@ pub struct AccountQuotaData {
     pub account: AccountView,
 }
 
+/// Provider 官方个人资料统计响应。
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct AccountProfileStatisticsData {
+    pub display_name: Option<String>,
+    pub username: Option<String>,
+    pub image_url: Option<String>,
+    pub has_stats_error: bool,
+    pub summary: AccountProfileStatisticsSummaryView,
+    pub daily_usage: Option<Vec<AccountProfileDailyUsageView>>,
+    pub activity_insights: AccountProfileActivityInsightsView,
+}
+
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct AccountProfileStatisticsSummaryView {
+    pub total_text_tokens: Option<u64>,
+    pub peak_tokens: Option<u64>,
+    pub longest_task_duration_ms: Option<u64>,
+    pub current_streak_days: Option<u64>,
+    pub longest_streak_days: Option<u64>,
+}
+
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct AccountProfileDailyUsageView {
+    pub date: String,
+    pub tokens: u64,
+}
+
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct AccountProfileActivityInsightsView {
+    pub fast_mode_percent: Option<f64>,
+    pub reasoning_effort: Option<String>,
+    pub reasoning_effort_percent: Option<f64>,
+    pub skills_explored: Option<u64>,
+    pub total_skills_used: Option<u64>,
+    pub total_threads: Option<u64>,
+    pub invocations: Option<Vec<AccountProfileInvocationView>>,
+}
+
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct AccountProfileInvocationView {
+    #[serde(rename = "type")]
+    pub invocation_type: String,
+    pub plugin_id: Option<String>,
+    pub plugin_name: Option<String>,
+    pub skill_id: Option<String>,
+    pub skill_name: Option<String>,
+    pub usage_count: Option<u64>,
+}
+
+impl From<ProviderProfileStatistics> for AccountProfileStatisticsData {
+    fn from(statistics: ProviderProfileStatistics) -> Self {
+        Self {
+            display_name: statistics.display_name,
+            username: statistics.username,
+            image_url: statistics.image_url,
+            has_stats_error: statistics.has_stats_error,
+            summary: profile_statistics_summary_view(statistics.summary),
+            daily_usage: statistics
+                .daily_usage
+                .map(|daily| daily.into_iter().map(profile_daily_usage_view).collect()),
+            activity_insights: profile_activity_insights_view(statistics.activity_insights),
+        }
+    }
+}
+
+const fn profile_statistics_summary_view(
+    summary: ProviderProfileStatisticsSummary,
+) -> AccountProfileStatisticsSummaryView {
+    AccountProfileStatisticsSummaryView {
+        total_text_tokens: summary.total_text_tokens,
+        peak_tokens: summary.peak_tokens,
+        longest_task_duration_ms: summary.longest_task_duration_ms,
+        current_streak_days: summary.current_streak_days,
+        longest_streak_days: summary.longest_streak_days,
+    }
+}
+
+fn profile_daily_usage_view(daily: ProviderProfileDailyUsage) -> AccountProfileDailyUsageView {
+    AccountProfileDailyUsageView {
+        date: daily.date.to_string(),
+        tokens: daily.tokens,
+    }
+}
+
+fn profile_activity_insights_view(
+    insights: ProviderProfileActivityInsights,
+) -> AccountProfileActivityInsightsView {
+    AccountProfileActivityInsightsView {
+        fast_mode_percent: insights.fast_mode_percent,
+        reasoning_effort: insights.reasoning_effort,
+        reasoning_effort_percent: insights.reasoning_effort_percent,
+        skills_explored: insights.skills_explored,
+        total_skills_used: insights.total_skills_used,
+        total_threads: insights.total_threads,
+        invocations: insights.invocations.map(|invocations| {
+            invocations
+                .into_iter()
+                .map(profile_invocation_view)
+                .collect()
+        }),
+    }
+}
+
+fn profile_invocation_view(invocation: ProviderProfileInvocation) -> AccountProfileInvocationView {
+    AccountProfileInvocationView {
+        invocation_type: invocation.invocation_type,
+        plugin_id: invocation.plugin_id,
+        plugin_name: invocation.plugin_name,
+        skill_id: invocation.skill_id,
+        skill_name: invocation.skill_name,
+        usage_count: invocation.usage_count,
+    }
+}
+
+/// 主动额度重置卡列表响应。
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct AccountResetCreditsData {
+    pub available_count: u64,
+    pub credits: Vec<AccountResetCreditView>,
+}
+
+/// 一张安全主动额度重置卡视图。
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct AccountResetCreditView {
+    pub id: String,
+    pub status: Option<String>,
+    pub title: Option<String>,
+    pub expires_at: Option<String>,
+    pub reset_type: Option<String>,
+}
+
+/// 主动额度重置卡消费响应。
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct AccountResetCreditResultData {
+    pub code: String,
+    pub credit: Option<AccountResetCreditView>,
+}
+
+impl From<ProviderResetCredit> for AccountResetCreditView {
+    fn from(credit: ProviderResetCredit) -> Self {
+        Self {
+            id: credit.id,
+            status: credit.status,
+            title: credit.title,
+            expires_at: credit.expires_at.map(|value| value.to_rfc3339()),
+            reset_type: credit.reset_type,
+        }
+    }
+}
+
+impl From<ProviderResetCredits> for AccountResetCreditsData {
+    fn from(credits: ProviderResetCredits) -> Self {
+        Self {
+            available_count: credits.available_count,
+            credits: credits
+                .credits
+                .into_iter()
+                .map(AccountResetCreditView::from)
+                .collect(),
+        }
+    }
+}
+
+impl From<ProviderResetCreditResult> for AccountResetCreditResultData {
+    fn from(result: ProviderResetCreditResult) -> Self {
+        Self {
+            code: result.code,
+            credit: result.credit.map(AccountResetCreditView::from),
+        }
+    }
+}
+
 /// Provider-owned 明文导出文档；Debug 永远不输出内部 JSON。
 #[derive(Serialize)]
 #[serde(transparent)]
@@ -1051,6 +1281,14 @@ where
             post(batch_update_accounts::<S>),
         )
         .route("/api/admin/accounts/quota", get(account_quota::<S>))
+        .route(
+            "/api/admin/accounts/profile-statistics",
+            get(account_profile_statistics::<S>),
+        )
+        .route(
+            "/api/admin/accounts/reset-credits",
+            get(account_reset_credits::<S>).post(consume_account_reset_credit::<S>),
+        )
         .route(
             "/api/admin/accounts/quota/refresh",
             post(refresh_account_quota::<S>),
@@ -1381,6 +1619,27 @@ where
     Ok(AdminResponse::new(StatusCode::OK, AdminEnvelope::ok(data)))
 }
 
+async fn account_profile_statistics<S>(
+    _auth: AdminAuth,
+    State(state): State<S>,
+    Query(query): Query<AccountIdQuery>,
+) -> Result<impl IntoResponse, AdminError>
+where
+    S: AdminSessionState + Send + Sync,
+{
+    let account_id = query.into_id().map_err(map_wire_error)?;
+    let result = state
+        .admin_services()
+        .accounts()
+        .profile_statistics(&account_id)
+        .await
+        .map_err(map_service_error)?;
+    Ok(AdminResponse::new(
+        StatusCode::OK,
+        AdminEnvelope::ok(AccountProfileStatisticsData::from(result)),
+    ))
+}
+
 async fn refresh_account_quota<S>(
     _auth: AdminAuth,
     State(state): State<S>,
@@ -1402,6 +1661,48 @@ where
     Ok(AdminResponse::new(StatusCode::OK, AdminEnvelope::ok(data)))
 }
 
+async fn account_reset_credits<S>(
+    auth: AdminAuth,
+    State(state): State<S>,
+    Query(query): Query<AccountIdQuery>,
+) -> Result<impl IntoResponse, AdminError>
+where
+    S: AdminSessionState + Send + Sync,
+{
+    let account_id = query.into_id().map_err(map_wire_error)?;
+    let result = state
+        .admin_services()
+        .accounts()
+        .reset_credits(&auth.context().mutation_context(), account_id)
+        .await
+        .map_err(map_service_error)?;
+    Ok(AdminResponse::new(
+        StatusCode::OK,
+        AdminEnvelope::ok(AccountResetCreditsData::from(result)),
+    ))
+}
+
+async fn consume_account_reset_credit<S>(
+    auth: AdminAuth,
+    State(state): State<S>,
+    Json(request): Json<AccountResetCreditConsumeRequest>,
+) -> Result<impl IntoResponse, AdminError>
+where
+    S: AdminSessionState + Send + Sync,
+{
+    let command = request.into_command().map_err(map_wire_error)?;
+    let result = state
+        .admin_services()
+        .accounts()
+        .consume_reset_credit(&auth.context().mutation_context(), command)
+        .await
+        .map_err(map_service_error)?;
+    Ok(AdminResponse::new(
+        StatusCode::OK,
+        AdminEnvelope::ok(AccountResetCreditResultData::from(result)),
+    ))
+}
+
 async fn account_models<S>(
     _auth: AdminAuth,
     State(state): State<S>,
@@ -1574,10 +1875,11 @@ fn account_view(item: AccountDirectoryItem, now: DateTime<Utc>) -> AccountView {
 }
 
 fn account_quota_view(
-    quota: ProviderQuota,
+    mut quota: ProviderQuota,
     rate_limited_until: Option<DateTime<Utc>>,
     now: DateTime<Utc>,
 ) -> (AccountQuotaView, Option<String>) {
+    quota.apply_limit_reached_display();
     let refresh_token_expires_at = quota
         .refresh_token_expires_at
         .map(|value| china_rfc3339(&value));
@@ -1602,7 +1904,9 @@ fn quota_window_view(window: ProviderQuotaWindow) -> AccountQuotaWindowView {
         key,
         group,
         label,
-        source: _,
+        limit_id,
+        limit_name,
+        role,
         local_usage_attribution: _,
         window_seconds,
         used_percent,
@@ -1611,10 +1915,17 @@ fn quota_window_view(window: ProviderQuotaWindow) -> AccountQuotaWindowView {
         local_usage,
         provider_data: _,
     } = window;
+    let label_display = limit_name
+        .as_ref()
+        .map_or_else(|| label.clone(), |name| format!("{name} · {label}"));
     AccountQuotaWindowView {
-        label_display: label,
+        label_display,
+        window_label_display: label,
         key,
         group,
+        limit_id,
+        limit_name,
+        role: role.map(|value| value.as_str().to_owned()),
         window_seconds,
         used_percent,
         used_percent_display: used_percent
@@ -1771,7 +2082,7 @@ fn account_currency_cost_view(cost: &AccountCost) -> CurrencyCostView {
     CurrencyCostView {
         currency: cost.currency.clone(),
         estimated_amount: cost.amount.as_str().to_owned(),
-        estimated_amount_display: format!("{} {}", cost.currency, cost.amount.as_str()),
+        estimated_amount_display: format_decimal_currency(cost.amount.as_str(), &cost.currency),
     }
 }
 

backend/crates/gateway-api/src/admin/observability/presenter.rs

@@ -142,11 +142,19 @@ pub(crate) fn format_service_tier(service_tier: Option<&str>) -> String {
     match service_tier {
         Some("priority" | "fast") => "Fast".to_owned(),
         Some("flex") => "Flex".to_owned(),
-        Some("default") | None => "Default".to_owned(),
-        Some(other) => other.to_owned(),
+        Some("default" | "standard") | None => "Standard".to_owned(),
+        Some(other) => capitalize_first(other),
     }
 }
 
+fn capitalize_first(value: &str) -> String {
+    let mut chars = value.chars();
+    chars
+        .next()
+        .map(|first| first.to_uppercase().chain(chars).collect())
+        .unwrap_or_default()
+}
+
 pub(crate) fn billing_view(billing: Option<&domain::UsageBilling>) -> Option<BillingView> {
     match billing? {
         domain::UsageBilling::Total { total, .. } => Some(BillingView {
@@ -222,7 +230,7 @@ pub(crate) fn usage_record_view(record: domain::UsageRecord) -> UsageRecordView
     let model = record
         .upstream_model_id
         .clone()
-        .unwrap_or_else(|| record.requested_model_id.clone());
+        .or_else(|| record.requested_model_id.clone());
     let transport = record
         .upstream_transport
         .clone()
@@ -243,7 +251,7 @@ pub(crate) fn usage_record_view(record: domain::UsageRecord) -> UsageRecordView
         account_name: record.provider_account_name,
         route: record.endpoint,
         model,
-        requested_model: Some(record.requested_model_id),
+        requested_model: record.requested_model_id,
         upstream_model: record.upstream_model_id,
         service_tier: record.service_tier,
         status_code,
@@ -351,9 +359,7 @@ pub(crate) fn usage_attempt_view(attempt: domain::UsageAttempt) -> UsageAttemptV
         provider: attempt
             .provider_kind
             .unwrap_or_else(|| "unknown".to_owned()),
-        model: attempt
-            .upstream_model_id
-            .unwrap_or_else(|| "unknown".to_owned()),
+        model: attempt.upstream_model_id,
         transport: attempt
             .upstream_transport
             .unwrap_or_else(|| "unknown".to_owned()),
@@ -731,21 +737,19 @@ pub(crate) fn dashboard_view(
             last_used: relative_time(credential.last_used_at, range.end),
         });
     }
+    let unavailable_accounts = provider_accounts
+        .total
+        .saturating_sub(provider_accounts.normal);
+
     DashboardDataView {
         cards: DashboardCardsView {
             credentials: DashboardCredentialsCardView {
-                total: format_compact_number(provider_accounts.total),
+                total: provider_accounts.total.to_string(),
                 total_value: provider_accounts.total,
-                available: format_compact_number(provider_accounts.normal),
+                available: provider_accounts.normal.to_string(),
                 available_value: provider_accounts.normal,
-                unavailable: format_compact_number(
-                    provider_accounts
-                        .total
-                        .saturating_sub(provider_accounts.normal),
-                ),
-                unavailable_value: provider_accounts
-                    .total
-                    .saturating_sub(provider_accounts.normal),
+                unavailable: unavailable_accounts.to_string(),
+                unavailable_value: unavailable_accounts,
             },
             traffic: DashboardTrafficCardView {
                 today_requests: format_compact_number(today.request_count),

backend/crates/gateway-api/src/admin/observability/wire.rs

@@ -94,7 +94,7 @@ pub struct UsageRecordView {
     pub account_email: Option<String>,
     pub account_name: Option<String>,
     pub route: String,
-    pub model: String,
+    pub model: Option<String>,
     pub requested_model: Option<String>,
     pub upstream_model: Option<String>,
     pub service_tier: Option<String>,
@@ -183,7 +183,7 @@ pub struct UsageAttemptView {
     pub attempt_index: u32,
     pub trigger: String,
     pub provider: String,
-    pub model: String,
+    pub model: Option<String>,
     pub transport: String,
     pub send_state: String,
     pub outcome: String,

backend/crates/gateway-api/src/admin/presenter.rs

@@ -1,7 +1,7 @@
 //! Admin API 的展示层辅助：数值格式化。
 //!
-//! 按 docs/project-redundancy-boundary-audit.md BE-02 的目标，display 字段最终
-//! 迁移到前端；过渡期统一由本模块提供，避免 accounts/observability 各自维护。
+//! 当前 wire 仍保留 display 字段；统一由本模块提供，避免 accounts/observability
+//! 各自维护格式化规则。
 
 use gateway_core::accounting::Decimal;
 

backend/crates/gateway-api/src/health.rs

@@ -1,4 +1,4 @@
-//! `/healthz` 对 Core、Store 与 Host worker 健康事实的聚合。
+//! `/healthz` 对 Core、Store 与 Host 关键 worker 健康事实的聚合。
 
 use std::sync::Arc;
 use std::time::Duration;
@@ -6,8 +6,10 @@ use std::time::Duration;
 use axum::{extract::State, http::StatusCode};
 use futures::future::join_all;
 use gateway_core::health::{
-    HealthProbe, HealthState, WorkerHealthSnapshot, WorkerHealthSource, WorkerRuntimeState,
+    HealthProbe, HealthState, WorkerHealthKey, WorkerHealthSnapshot, WorkerHealthSource,
+    WorkerRuntimeState,
 };
+use gateway_core::task::WorkerKind;
 
 use crate::ApiState;
 
@@ -32,7 +34,13 @@ impl HealthStatus {
     }
 
     pub(crate) async fn healthy(&self) -> bool {
-        if !self.workers.snapshot().iter().all(worker_is_healthy) {
+        if !self
+            .workers
+            .snapshot()
+            .iter()
+            .filter(|worker| worker_affects_healthz(worker))
+            .all(worker_is_healthy)
+        {
             return false;
         }
         let checks = self.probes.iter().map(|probe| probe.check());
@@ -54,6 +62,16 @@ pub(crate) async fn healthz(State(state): State<ApiState>) -> StatusCode {
     }
 }
 
+fn worker_affects_healthz(worker: &WorkerHealthSnapshot) -> bool {
+    let WorkerHealthKey::Task(id) = &worker.key else {
+        return false;
+    };
+    !matches!(
+        id.kind(),
+        WorkerKind::OAuthRefresh | WorkerKind::QuotaCatalogHealth
+    )
+}
+
 fn worker_is_healthy(worker: &WorkerHealthSnapshot) -> bool {
     match worker.state {
         WorkerRuntimeState::Disabled | WorkerRuntimeState::Standby => true,

backend/crates/gateway-api/src/openai/images/http.rs

@@ -0,0 +1,233 @@
+//! Codex Images 非流式 HTTP adapter。
+
+use std::net::SocketAddr;
+
+use axum::{
+    body::{Body, Bytes},
+    extract::{Extension, State, connect_info::ConnectInfo},
+    http::{HeaderMap, HeaderName, HeaderValue, StatusCode, header::CONTENT_TYPE},
+    response::{IntoResponse, Response},
+};
+use gateway_core::engine::execution::StartedExecution;
+use gateway_core::error::{GatewayError, GatewayErrorKind};
+use gateway_core::event::{ProviderEvent, ProviderResponseHeader};
+use gateway_core::operation::{ImageRequest, ImageRequestKind, Operation, RawJsonPayload};
+use serde_json::{Map, Value};
+
+use crate::ApiState;
+use crate::openai::{
+    auth::{authenticate_client, authentication_error_response},
+    error::{engine_error_response, gateway_error_response, protocol_error_response},
+    responses::{PendingExecution, ProtocolError, ProtocolErrorBody, request_client_context},
+};
+
+const OPENAI_PROTOCOL: &str = "openai";
+const IMAGE_TURN_ID_CONTEXT_KEY: &str = "image_turn_id";
+
+/// `POST /v1/images/generations`。
+pub(crate) async fn image_generations(
+    State(state): State<ApiState>,
+    connect_info: Option<Extension<ConnectInfo<SocketAddr>>>,
+    headers: HeaderMap,
+    body: Bytes,
+) -> Response {
+    handle_image_request(
+        state,
+        connect_info,
+        headers,
+        body,
+        ImageRequestKind::Generation,
+        "/v1/images/generations",
+    )
+    .await
+}
+
+/// `POST /v1/images/edits`。
+pub(crate) async fn image_edits(
+    State(state): State<ApiState>,
+    connect_info: Option<Extension<ConnectInfo<SocketAddr>>>,
+    headers: HeaderMap,
+    body: Bytes,
+) -> Response {
+    handle_image_request(
+        state,
+        connect_info,
+        headers,
+        body,
+        ImageRequestKind::Edit,
+        "/v1/images/edits",
+    )
+    .await
+}
+
+async fn handle_image_request(
+    state: ApiState,
+    connect_info: Option<Extension<ConnectInfo<SocketAddr>>>,
+    headers: HeaderMap,
+    body: Bytes,
+    kind: ImageRequestKind,
+    endpoint: &'static str,
+) -> Response {
+    let service = state.openai();
+    let client = match authenticate_client(service, &headers) {
+        Ok(client) => client,
+        Err(error) => return authentication_error_response(error),
+    };
+    let (client_ip, user_agent) = request_client_context(
+        &headers,
+        connect_info.map(|Extension(ConnectInfo(address))| address),
+    );
+    let operation = match image_operation(body, &headers, kind) {
+        Ok(operation) => operation,
+        Err(error) => return gateway_error_response(&error),
+    };
+    let started = match service
+        .start_image(client, operation, client_ip, user_agent, endpoint)
+        .await
+    {
+        Ok(started) => started,
+        Err(error) => return gateway_error_response(&error),
+    };
+    collect_image_response(started).await
+}
+
+fn image_operation(
+    body: Bytes,
+    headers: &HeaderMap,
+    kind: ImageRequestKind,
+) -> Result<Operation, GatewayError> {
+    let mut context = Map::new();
+    if let Some(turn_id) = headers
+        .get("x-codex-image-turn-id")
+        .and_then(|value| value.to_str().ok())
+    {
+        context.insert(
+            IMAGE_TURN_ID_CONTEXT_KEY.to_owned(),
+            Value::String(turn_id.to_owned()),
+        );
+    }
+    let payload = RawJsonPayload::new(OPENAI_PROTOCOL, body)
+        .map_err(|_| {
+            GatewayError::new(
+                GatewayErrorKind::Internal,
+                "OpenAI protocol identifier is invalid",
+            )
+        })?
+        .with_context(context);
+    Ok(Operation::GenerateImage(ImageRequest::from_raw_json(
+        kind, payload,
+    )))
+}
+
+async fn collect_image_response(started: StartedExecution) -> Response {
+    let mut execution = PendingExecution::new(started.session);
+    let Some(session) = execution.session_mut() else {
+        return invalid_upstream_response();
+    };
+    let events = match session.collect_uncommitted().await {
+        Ok(events) => events,
+        Err(error) => {
+            let response = engine_error_response(&error);
+            return execution.record_response_status(response).await;
+        }
+    };
+    let body = match raw_json_body(events) {
+        Some(body) => body,
+        None => {
+            let response = invalid_upstream_response();
+            let response = execution.record_response_status(response).await;
+            execution.cancel_and_finalize().await;
+            return response;
+        }
+    };
+    let status = session
+        .response_status_code()
+        .and_then(|status| StatusCode::from_u16(status).ok())
+        .filter(StatusCode::is_success)
+        .unwrap_or(StatusCode::OK);
+    let response_headers = session.response_headers().to_vec();
+    let response = json_body_response(body, status, &response_headers);
+    let Some(session) = execution.session_mut() else {
+        return invalid_upstream_response();
+    };
+    if let Err(error) = session.commit_downstream(Some(status.as_u16())).await {
+        execution.cancel_and_finalize().await;
+        let response = engine_error_response(&error);
+        return execution.record_response_status(response).await;
+    }
+    if !session.is_finalized() {
+        execution.cancel_and_finalize().await;
+        return invalid_upstream_response();
+    }
+    execution.disarm();
+    response
+}
+
+fn raw_json_body(events: Vec<ProviderEvent>) -> Option<Bytes> {
+    let mut body = None;
+    for event in events {
+        let (_, wire) = event.into_parts();
+        let Some(wire) = wire.filter(|wire| wire.protocol() == "openai") else {
+            continue;
+        };
+        let Some(raw) = wire.into_raw_json_body() else {
+            continue;
+        };
+        if body.replace(raw).is_some() {
+            return None;
+        }
+    }
+    body
+}
+
+fn json_body_response(
+    body: Bytes,
+    status: StatusCode,
+    response_headers: &[ProviderResponseHeader],
+) -> Response {
+    let mut response = Response::new(Body::from(body));
+    *response.status_mut() = status;
+    response
+        .headers_mut()
+        .insert(CONTENT_TYPE, HeaderValue::from_static("application/json"));
+    apply_response_headers(response, response_headers)
+}
+
+fn apply_response_headers(
+    mut response: Response,
+    response_headers: &[ProviderResponseHeader],
+) -> Response {
+    let connection_options =
+        crate::openai::responses::response_connection_options(response_headers);
+    for header in response_headers {
+        if !crate::openai::responses::response_header_is_forwardable(
+            header.name(),
+            &connection_options,
+        ) {
+            continue;
+        }
+        let Ok(name) = HeaderName::from_bytes(header.name().as_bytes()) else {
+            continue;
+        };
+        let Ok(value) = HeaderValue::from_bytes(header.value()) else {
+            continue;
+        };
+        response.headers_mut().append(name, value);
+    }
+    response
+}
+
+fn invalid_upstream_response() -> Response {
+    protocol_error_response(
+        StatusCode::BAD_GATEWAY,
+        ProtocolErrorBody {
+            error: ProtocolError {
+                kind: "server_error",
+                code: "invalid_upstream_response",
+                message: "The gateway could not forward the upstream image response.".to_owned(),
+                param: None,
+            },
+        },
+    )
+    .into_response()
+}

backend/crates/gateway-api/src/openai/images/mod.rs

@@ -0,0 +1,5 @@
+//! OpenAI/Codex Images JSON 透明 adapter。
+
+mod http;
+
+pub(crate) use http::{image_edits, image_generations};

backend/crates/gateway-api/src/openai/mod.rs

@@ -2,6 +2,7 @@
 
 pub mod auth;
 pub mod error;
+pub mod images;
 pub mod models;
 pub mod responses;
 pub mod router;

backend/crates/gateway-api/src/openai/responses/http.rs

@@ -123,7 +123,7 @@ async fn handle_responses(
 }
 
 /// 从 socket 与标准转发头提取旧 Usage 页面使用的诊断事实。
-pub(super) fn request_client_context(
+pub(in crate::openai) fn request_client_context(
     headers: &HeaderMap,
     peer_address: Option<SocketAddr>,
 ) -> (Option<IpAddr>, Option<String>) {
@@ -367,22 +367,24 @@ fn internal_gateway_response(message: &'static str) -> Response {
     gateway_error_response(&GatewayError::new(GatewayErrorKind::Internal, message))
 }
 
-pub(super) struct PendingExecution {
+pub(in crate::openai) struct PendingExecution {
     session: Option<Box<dyn ExecutionSession>>,
 }
 
 impl PendingExecution {
-    pub(super) fn new(session: Box<dyn ExecutionSession>) -> Self {
+    pub(in crate::openai) fn new(session: Box<dyn ExecutionSession>) -> Self {
         Self {
             session: Some(session),
         }
     }
 
-    pub(super) fn session_mut(&mut self) -> Option<&mut (dyn ExecutionSession + 'static)> {
+    pub(in crate::openai) fn session_mut(
+        &mut self,
+    ) -> Option<&mut (dyn ExecutionSession + 'static)> {
         self.session.as_deref_mut()
     }
 
-    async fn cancel_and_finalize(&mut self) {
+    pub(in crate::openai) async fn cancel_and_finalize(&mut self) {
         if let Some(session) = self.session.as_mut() {
             session.cancel();
             if !session.is_finalized() {
@@ -391,7 +393,10 @@ impl PendingExecution {
         }
     }
 
-    async fn record_response_status(&mut self, response: Response) -> Response {
+    pub(in crate::openai) async fn record_response_status(
+        &mut self,
+        response: Response,
+    ) -> Response {
         if let Some(session) = self.session.as_mut() {
             let _ = session
                 .record_client_status(response.status().as_u16())
@@ -400,7 +405,7 @@ impl PendingExecution {
         response
     }
 
-    pub(super) fn disarm(&mut self) {
+    pub(in crate::openai) fn disarm(&mut self) {
         self.session = None;
     }
 

backend/crates/gateway-api/src/openai/responses/mod.rs

@@ -6,7 +6,8 @@ mod request;
 mod response;
 mod websocket;
 
-pub use error::{ProtocolErrorBody, RequestDecodeError, ResponseEncodeError};
+pub use error::{ProtocolError, ProtocolErrorBody, RequestDecodeError, ResponseEncodeError};
+pub(super) use http::{PendingExecution, request_client_context};
 pub use http::{collect_execution_response, stream_execution_response};
 pub(crate) use http::{responses, review_responses};
 pub use request::{
@@ -73,7 +74,6 @@ pub(super) fn response_header_is_forwardable(name: &str, connection_options: &[S
             | "x-openai-organization"
             | "x-openai-project"
             | "x-codex-installation-id"
-            | "x-codex-turn-state"
             | "x-codex-turn-metadata"
     )
 }

backend/crates/gateway-api/src/openai/responses/request.rs

@@ -165,7 +165,6 @@ impl fmt::Debug for ContinuationIntent {
 #[derive(Clone, PartialEq, Eq)]
 pub struct ResponsesRequestMetadata {
     requested_model: String,
-    public_model: String,
     stream: bool,
     store: bool,
     continuation: ContinuationIntent,
@@ -180,12 +179,6 @@ impl ResponsesRequestMetadata {
         &self.requested_model
     }
 
-    /// 返回协议层公开模型候选。
-    #[must_use]
-    pub fn public_model(&self) -> &str {
-        &self.public_model
-    }
-
     /// 返回客户端是否请求 SSE。
     #[must_use]
     pub const fn stream(&self) -> bool {
@@ -222,7 +215,6 @@ impl fmt::Debug for ResponsesRequestMetadata {
         formatter
             .debug_struct("ResponsesRequestMetadata")
             .field("requested_model", &self.requested_model)
-            .field("public_model", &self.public_model)
             .field("stream", &self.stream)
             .field("store", &self.store)
             .field("continuation", &self.continuation)
@@ -366,8 +358,7 @@ pub(super) fn decode_request_object(
     Ok(DecodedResponsesRequest {
         operation,
         metadata: ResponsesRequestMetadata {
-            requested_model: model.clone(),
-            public_model: model,
+            requested_model: model,
             stream,
             store,
             continuation,

backend/crates/gateway-api/src/openai/router.rs

@@ -7,6 +7,7 @@ use axum::{
 };
 
 use super::{
+    images::{image_edits, image_generations},
     models::{model_catalog, model_detail, model_info, models},
     responses::{responses, responses_websocket, review_responses},
 };
@@ -16,6 +17,8 @@ use crate::ApiState;
 /// 构造 OpenAI 客户端协议路由。
 pub(crate) fn router() -> Router<ApiState> {
     Router::new()
+        .route("/v1/images/generations", post(image_generations))
+        .route("/v1/images/edits", post(image_edits))
         .route("/v1/responses", get(responses_websocket).post(responses))
         .route("/v1/responses/review", post(review_responses))
         .route("/v1/models", get(models))
@@ -23,7 +26,7 @@ pub(crate) fn router() -> Router<ApiState> {
         .route("/v1/models/{model_id}/info", get(model_info))
         // 官方 OpenAI 模型详情合同使用 path ID；它不属于 Admin API 约束。
         .route("/v1/models/{model_id}", get(model_detail))
-        // Responses 正文属于 OpenAI/Codex 协议；代理不能用私有大小上限提前拒绝
+        // OpenAI 数据面正文属于客户端/上游协议；代理不能用私有大小上限提前拒绝
         // 上游本可接受的未来 payload。
         .layer(DefaultBodyLimit::disable())
 }

backend/crates/gateway-api/src/openai/service.rs

@@ -1,11 +1,12 @@
 //! OpenAI wire adapter 到 Core 执行用例的唯一映射。
 
+use std::net::IpAddr;
 use std::sync::Arc;
 
 use gateway_core::engine::continuation::PreviousResponseId;
 use gateway_core::engine::execution::{
     AuthenticatedClient, ClientAuthenticationError, ClientTransport, ExecutionRequestMetadata,
-    ExecutionService, StartExecution, StartedExecution,
+    ExecutionService, StartExecution, StartProviderExecution, StartedExecution,
 };
 use gateway_core::error::{GatewayError, GatewayErrorKind};
 use gateway_core::lifecycle::{ConnectionDraining, ConnectionGuard, ConnectionLifecycle};
@@ -74,13 +75,13 @@ impl OpenAiService {
         endpoint: &'static str,
     ) -> Result<StartedExecution, GatewayError> {
         let (operation, metadata) = request.into_parts();
-        let public_model = PublicModelId::from_client_wire(metadata.public_model().to_owned())
+        let public_model = PublicModelId::from_client_wire(metadata.requested_model().to_owned())
             .map_err(|_| {
-                GatewayError::new(
-                    GatewayErrorKind::ModelNotFound,
-                    "requested model was not found",
-                )
-            })?;
+            GatewayError::new(
+                GatewayErrorKind::ModelNotFound,
+                "requested model was not found",
+            )
+        })?;
         let previous_response_id = match metadata.continuation() {
             ContinuationIntent::None => None,
             ContinuationIntent::PreviousResponseId(value) => {
@@ -105,6 +106,38 @@ impl OpenAiService {
             .await
     }
 
+    pub(crate) async fn start_image(
+        &self,
+        client: AuthenticatedClient,
+        operation: gateway_core::operation::Operation,
+        client_ip: Option<IpAddr>,
+        user_agent: Option<String>,
+        endpoint: &'static str,
+    ) -> Result<StartedExecution, GatewayError> {
+        let provider = gateway_core::routing::ProviderKind::new("openai").map_err(|_| {
+            GatewayError::new(
+                GatewayErrorKind::Internal,
+                "OpenAI provider identifier is invalid",
+            )
+        })?;
+        self.execution
+            .start_provider_endpoint(StartProviderExecution {
+                client,
+                provider,
+                operation,
+                metadata: ExecutionRequestMetadata {
+                    protocol: "openai".to_owned(),
+                    endpoint: endpoint.to_owned(),
+                    transport: ClientTransport::HttpJson,
+                    stream: false,
+                    client_ip,
+                    user_agent,
+                    previous_response_id: None,
+                },
+            })
+            .await
+    }
+
     pub(crate) fn try_register_connection(
         &self,
     ) -> Result<Box<dyn ConnectionGuard>, ConnectionDraining> {

backend/crates/gateway-api/tests/admin/accounts.rs

@@ -70,6 +70,72 @@ mod query {
     }
 }
 
+mod profile_statistics {
+    use chrono::NaiveDate;
+    use gateway_admin::model::provider_credentials::{
+        ProviderProfileActivityInsights, ProviderProfileDailyUsage, ProviderProfileInvocation,
+        ProviderProfileStatistics, ProviderProfileStatisticsSummary,
+    };
+    use gateway_api::admin::accounts::AccountProfileStatisticsData;
+    use serde_json::json;
+
+    #[test]
+    fn profile_statistics_response_preserves_nullable_official_fields() {
+        let response = AccountProfileStatisticsData::from(ProviderProfileStatistics {
+            display_name: Some("Ada".to_owned()),
+            username: Some("ada".to_owned()),
+            image_url: Some("https://example.test/avatar.png".to_owned()),
+            has_stats_error: false,
+            summary: ProviderProfileStatisticsSummary {
+                total_text_tokens: Some(409_500_000),
+                peak_tokens: Some(267_000_000),
+                longest_task_duration_ms: Some(51_900_000),
+                current_streak_days: Some(16),
+                longest_streak_days: Some(32),
+            },
+            daily_usage: Some(vec![ProviderProfileDailyUsage {
+                date: NaiveDate::from_ymd_opt(2026, 8, 25).expect("usage date"),
+                tokens: 42,
+            }]),
+            activity_insights: ProviderProfileActivityInsights {
+                fast_mode_percent: Some(0.0),
+                reasoning_effort: Some("high".to_owned()),
+                reasoning_effort_percent: Some(48.0),
+                skills_explored: Some(8),
+                total_skills_used: Some(61),
+                total_threads: Some(2_391),
+                invocations: Some(vec![ProviderProfileInvocation {
+                    invocation_type: "plugin".to_owned(),
+                    plugin_id: Some("plugin_1".to_owned()),
+                    plugin_name: Some("example".to_owned()),
+                    skill_id: None,
+                    skill_name: None,
+                    usage_count: Some(29),
+                }]),
+            },
+        });
+        let value = serde_json::to_value(response).expect("serialize profile statistics");
+
+        assert_eq!(value["displayName"], "Ada");
+        assert_eq!(value["summary"]["totalTextTokens"], 409_500_000);
+        assert_eq!(
+            value["dailyUsage"][0],
+            json!({"date": "2026-08-25", "tokens": 42})
+        );
+        assert_eq!(
+            value["activityInsights"]["invocations"][0]["type"],
+            "plugin"
+        );
+        assert_eq!(
+            value["activityInsights"]["invocations"][0]["usageCount"],
+            29
+        );
+        assert!(value.get("cycle").is_none());
+        assert!(value.get("models").is_none());
+        assert!(value.get("estimatedCost").is_none());
+    }
+}
+
 mod batch_update {
     use gateway_api::admin::accounts::{BatchUpdateAccountsRequest, UpdateAccountRequest};
     use serde_json::json;
@@ -266,8 +332,8 @@ mod actions {
         AccountActionRequest, AccountConnectionTestEvent, AccountDeletionData,
         AccountDeletionRequest, AccountExportData, AccountExportQuery, AccountIdQuery,
         AccountImportData, AccountImportRequest, AccountMutationData, AccountRefreshRequest,
-        AccountTestQuery, CompleteAccountAuthorizationRequest, RotateAccountRequest,
-        StartAccountAuthorizationRequest,
+        AccountResetCreditConsumeRequest, AccountTestQuery, CompleteAccountAuthorizationRequest,
+        RotateAccountRequest, StartAccountAuthorizationRequest,
     };
     use gateway_core::engine::credential::ProviderAccountId;
     use serde_json::json;
@@ -325,6 +391,44 @@ mod actions {
         );
     }
 
+    #[test]
+    fn reset_credit_consume_should_require_canonical_v4_idempotency_key() {
+        let valid: AccountResetCreditConsumeRequest = serde_json::from_value(json!({
+            "accountId": "acct_1",
+            "creditId": "credit_1",
+            "redeemRequestId": "8fbf302d-11df-4bd5-82e4-08e4b3df7874"
+        }))
+        .expect("decode reset-credit consume");
+        valid.validate().expect("validate reset-credit consume");
+
+        for (redeem_request_id, field) in [
+            ("019c0000-0000-7000-8000-000000000000", "redeemRequestId"),
+            ("8FBF302D-11DF-4BD5-82E4-08E4B3DF7874", "redeemRequestId"),
+            ("invalid", "redeemRequestId"),
+        ] {
+            let request: AccountResetCreditConsumeRequest = serde_json::from_value(json!({
+                "accountId": "acct_1",
+                "redeemRequestId": redeem_request_id
+            }))
+            .expect("decode invalid reset-credit consume");
+            assert_eq!(request.validate().expect_err("reject UUID").field(), field);
+        }
+
+        let invalid_credit: AccountResetCreditConsumeRequest = serde_json::from_value(json!({
+            "accountId": "acct_1",
+            "creditId": " ",
+            "redeemRequestId": "8fbf302d-11df-4bd5-82e4-08e4b3df7874"
+        }))
+        .expect("decode invalid credit");
+        assert_eq!(
+            invalid_credit
+                .validate()
+                .expect_err("reject credit")
+                .field(),
+            "creditId"
+        );
+    }
+
     #[test]
     fn credential_recovery_requests_should_not_accept_client_revision_fences() {
         let authorization: StartAccountAuthorizationRequest = serde_json::from_value(json!({

backend/crates/gateway-api/tests/admin/observability/response.rs

@@ -221,9 +221,9 @@ async fn dashboard_summary_should_include_quota_exhaustion_in_unavailable_headli
         attempts: AttemptMetrics::default(),
         totals: Default::default(),
         provider_accounts: AccountPoolMetrics {
-            total: 807,
-            normal: 15,
-            quota_exhausted: 785,
+            total: 1002,
+            normal: 943,
+            quota_exhausted: 52,
             rate_limited: 0,
             disabled: 3,
             error: 4,
@@ -259,9 +259,21 @@ async fn dashboard_summary_should_include_quota_exhaustion_in_unavailable_headli
             &value["data"]["cards"]["credentials"]["unavailableValue"],
         ),
         (
-            &serde_json::json!(807),
-            &serde_json::json!(15),
-            &serde_json::json!(792)
+            &serde_json::json!(1002),
+            &serde_json::json!(943),
+            &serde_json::json!(59)
+        ),
+    );
+    assert_eq!(
+        (
+            &value["data"]["cards"]["credentials"]["total"],
+            &value["data"]["cards"]["credentials"]["available"],
+            &value["data"]["cards"]["credentials"]["unavailable"],
+        ),
+        (
+            &serde_json::json!("1002"),
+            &serde_json::json!("943"),
+            &serde_json::json!("59")
         ),
     );
 }
@@ -681,7 +693,7 @@ fn usage_record_with_account(
         operation: "responses".to_owned(),
         endpoint: "/v1/responses".to_owned(),
         client_transport: "http_sse".to_owned(),
-        requested_model_id: "coding".to_owned(),
+        requested_model_id: Some("coding".to_owned()),
         provider_kind: Some("openai".to_owned()),
         provider_account_ref: Some(account_id.to_owned()),
         provider_account_name: Some(name.to_owned()),
@@ -810,7 +822,7 @@ async fn usage_route_should_expose_image_and_websocket_facts() {
             operation: "generate".to_owned(),
             endpoint: "/v1/responses".to_owned(),
             client_transport: "http_sse".to_owned(),
-            requested_model_id: "grok-4.5".to_owned(),
+            requested_model_id: Some("grok-4.5".to_owned()),
             provider_kind: Some("xai".to_owned()),
             provider_account_ref: Some("acct_snapshot".to_owned()),
             provider_account_name: Some("Snapshot Alpha".to_owned()),
@@ -820,7 +832,7 @@ async fn usage_route_should_expose_image_and_websocket_facts() {
             upstream_transport: Some("http_sse".to_owned()),
             http_version: Some("h2".to_owned()),
             websocket_pool: Some("reuse".to_owned()),
-            service_tier: Some("priority".to_owned()),
+            service_tier: Some("default".to_owned()),
             provider_metadata_json: Some(
                 serde_json::json!({
                     "effectiveModel": "grok-4.5",
@@ -865,7 +877,7 @@ async fn usage_route_should_expose_image_and_websocket_facts() {
                     output_price_per_million: usd("60.0000"),
                     cache_read_price_per_million: usd("1.0000"),
                     cache_write_price_per_million: usd("12.5000"),
-                    service_tier: Some("priority".to_owned()),
+                    service_tier: Some("default".to_owned()),
                     multiplier_percent: 100,
                 },
             ))),
@@ -921,6 +933,10 @@ async fn usage_route_should_expose_image_and_websocket_facts() {
         value["data"]["items"][0]["billing"]["cacheWritePriceDisplay"],
         "$12.5 / 1M Token"
     );
+    assert_eq!(
+        value["data"]["items"][0]["billing"]["serviceTierDisplay"],
+        "Standard"
+    );
 
     assert_eq!(
         serde_json::json!({
@@ -961,7 +977,7 @@ async fn usage_route_should_expose_image_and_websocket_facts() {
             "routingScope": "groups",
             "routingGroupRefs": ["grp_usage"],
             "routingGroupNamesSnapshot": ["Usage group"],
-            "serviceTier": "priority",
+            "serviceTier": "default",
             "accountId": "acct_snapshot",
             "accountName": "Snapshot Alpha",
             "accountEmail": "alpha@example.invalid",

backend/crates/gateway-api/tests/architecture.rs

@@ -52,6 +52,8 @@ fn source_tree_should_match_frozen_machine_manifest() {
         "src/lib.rs",
         "src/openai/auth.rs",
         "src/openai/error.rs",
+        "src/openai/images/http.rs",
+        "src/openai/images/mod.rs",
         "src/openai/mod.rs",
         "src/openai/models.rs",
         "src/openai/responses/error.rs",
@@ -90,6 +92,7 @@ fn test_tree_should_match_frozen_rust_mirror() {
         "tests/main.rs",
         "tests/openai/auth.rs",
         "tests/openai/error.rs",
+        "tests/openai/images.rs",
         "tests/openai/mod.rs",
         "tests/openai/models.rs",
         "tests/openai/responses/http.rs",

backend/crates/gateway-api/tests/health.rs

@@ -8,10 +8,12 @@ use futures::future::BoxFuture;
 use gateway_core::{
     engine::execution::{
         AuthenticatedClient, ClientAuthenticationError, ExecutionService, StartExecution,
-        StartedExecution,
+        StartProviderExecution, StartedExecution,
     },
     error::GatewayError,
+    health::{WorkerHealthKey, WorkerHealthSnapshot, WorkerHealthSource, WorkerRuntimeState},
     routing::PublicModelId,
+    task::{WorkerId, WorkerKind},
 };
 use tower::ServiceExt;
 
@@ -31,6 +33,75 @@ async fn healthz_should_return_no_content_when_all_inputs_are_healthy() {
     assert_eq!(response.status(), StatusCode::NO_CONTENT);
 }
 
+#[tokio::test]
+async fn healthz_should_ignore_provider_maintenance_worker_failure() {
+    let worker_health = StaticWorkerHealth(vec![worker_snapshot(
+        WorkerKind::QuotaCatalogHealth,
+        WorkerRuntimeState::BackingOff,
+    )]);
+    let response = crate::openai::api_router_with_worker_health(
+        Arc::new(UnusedExecution),
+        Arc::new(worker_health),
+    )
+    .await
+    .oneshot(
+        Request::builder()
+            .uri("/healthz")
+            .body(Body::empty())
+            .expect("health request"),
+    )
+    .await
+    .expect("health response");
+
+    assert_eq!(response.status(), StatusCode::NO_CONTENT);
+}
+
+#[tokio::test]
+async fn healthz_should_reject_critical_worker_failure() {
+    let worker_health = StaticWorkerHealth(vec![worker_snapshot(
+        WorkerKind::RuntimeSnapshotReconciliation,
+        WorkerRuntimeState::BackingOff,
+    )]);
+    let response = crate::openai::api_router_with_worker_health(
+        Arc::new(UnusedExecution),
+        Arc::new(worker_health),
+    )
+    .await
+    .oneshot(
+        Request::builder()
+            .uri("/healthz")
+            .body(Body::empty())
+            .expect("health request"),
+    )
+    .await
+    .expect("health response");
+
+    assert_eq!(response.status(), StatusCode::SERVICE_UNAVAILABLE);
+}
+
+#[derive(Clone)]
+struct StaticWorkerHealth(Vec<WorkerHealthSnapshot>);
+
+impl WorkerHealthSource for StaticWorkerHealth {
+    fn snapshot(&self) -> Vec<WorkerHealthSnapshot> {
+        self.0.clone()
+    }
+}
+
+fn worker_snapshot(kind: WorkerKind, state: WorkerRuntimeState) -> WorkerHealthSnapshot {
+    let id = WorkerId::try_new(kind, "health-test").expect("worker ID");
+    WorkerHealthSnapshot {
+        key: WorkerHealthKey::Task(id),
+        state,
+        consecutive_failures: 1,
+        completed_cycles: 0,
+        last_fencing_token: None,
+        last_success_at: None,
+        last_failure_at: None,
+        last_error: Some("test worker failure".to_owned()),
+    }
+}
+
 struct UnusedExecution;
 
 impl ExecutionService for UnusedExecution {
@@ -49,4 +120,11 @@ impl ExecutionService for UnusedExecution {
     fn start(&self, _: StartExecution) -> BoxFuture<'_, Result<StartedExecution, GatewayError>> {
         Box::pin(async { unreachable!("health check does not execute requests") })
     }
+
+    fn start_provider_endpoint(
+        &self,
+        _: StartProviderExecution,
+    ) -> BoxFuture<'_, Result<StartedExecution, GatewayError>> {
+        Box::pin(async { unreachable!("health check does not execute provider endpoints") })
+    }
 }

backend/crates/gateway-api/tests/openai/images.rs

@@ -0,0 +1,331 @@
+use std::sync::{
+    Arc, Mutex,
+    atomic::{AtomicBool, Ordering},
+};
+use std::time::SystemTime;
+
+use axum::{
+    body::{Body, to_bytes},
+    http::{Request, StatusCode, header::AUTHORIZATION},
+};
+use bytes::Bytes;
+use futures::future::BoxFuture;
+use gateway_core::engine::UpstreamSendState;
+use gateway_core::engine::execution::{
+    AuthenticatedClient, ClientAuthenticationError, ClientTransport, ExecutionService,
+    ExecutionSession, StartExecution, StartProviderExecution, StartedExecution,
+};
+use gateway_core::engine::{CoordinatedEvent, EngineError, ModelRequestId};
+use gateway_core::error::{
+    ClientVisibleUpstreamResponse, GatewayError, GatewayErrorKind, ProviderError, ProviderErrorKind,
+};
+use gateway_core::event::{ProtocolWireEvent, ProviderEvent, ProviderResponseHeader};
+use gateway_core::operation::{ImageRequestKind, Operation};
+use gateway_core::routing::PublicModelId;
+use serde_json::{Value, json};
+use tower::ServiceExt;
+
+use super::{api_router, authenticated_client};
+
+const IMAGE_RESPONSE: &[u8] =
+    br#"{ "created": 1787212800, "data": [{"b64_json":"AAEC"}], "future": 9007199254740993 }"#;
+
+#[derive(Debug, Clone, PartialEq)]
+struct CapturedImageRequest {
+    provider: String,
+    endpoint: String,
+    transport: ClientTransport,
+    kind: ImageRequestKind,
+    body: Bytes,
+    context: Value,
+}
+
+struct ImageExecution {
+    client: AuthenticatedClient,
+    captured: Arc<Mutex<Vec<CapturedImageRequest>>>,
+    committed_statuses: Arc<Mutex<Vec<u16>>>,
+    fail_with_upstream_response: bool,
+}
+
+impl ImageExecution {
+    fn new() -> Arc<Self> {
+        Arc::new(Self {
+            client: authenticated_client("sk_images_test"),
+            captured: Arc::new(Mutex::new(Vec::new())),
+            committed_statuses: Arc::new(Mutex::new(Vec::new())),
+            fail_with_upstream_response: false,
+        })
+    }
+
+    fn failing() -> Arc<Self> {
+        Arc::new(Self {
+            client: authenticated_client("sk_images_test"),
+            captured: Arc::new(Mutex::new(Vec::new())),
+            committed_statuses: Arc::new(Mutex::new(Vec::new())),
+            fail_with_upstream_response: true,
+        })
+    }
+
+    fn captured(&self) -> Vec<CapturedImageRequest> {
+        self.captured.lock().expect("capture lock").clone()
+    }
+
+    fn committed_statuses(&self) -> Vec<u16> {
+        self.committed_statuses
+            .lock()
+            .expect("committed status lock")
+            .clone()
+    }
+}
+
+impl ExecutionService for ImageExecution {
+    fn authenticate(
+        &self,
+        plaintext: &str,
+    ) -> Result<AuthenticatedClient, ClientAuthenticationError> {
+        (plaintext == "sk_images_test")
+            .then(|| self.client.clone())
+            .ok_or(ClientAuthenticationError::InvalidKey)
+    }
+
+    fn public_models(&self, _: &AuthenticatedClient) -> Vec<PublicModelId> {
+        Vec::new()
+    }
+
+    fn contains_public_model(&self, _: &AuthenticatedClient, _: &PublicModelId) -> bool {
+        false
+    }
+
+    fn start(&self, _: StartExecution) -> BoxFuture<'_, Result<StartedExecution, GatewayError>> {
+        Box::pin(async {
+            Err(GatewayError::new(
+                GatewayErrorKind::Internal,
+                "images test must use provider endpoint execution",
+            ))
+        })
+    }
+
+    fn start_provider_endpoint(
+        &self,
+        request: StartProviderExecution,
+    ) -> BoxFuture<'_, Result<StartedExecution, GatewayError>> {
+        Box::pin(async move {
+            let Operation::GenerateImage(image) = &request.operation else {
+                return Err(GatewayError::new(
+                    GatewayErrorKind::Internal,
+                    "images test received a non-image operation",
+                ));
+            };
+            let payload = image.payload();
+            self.captured
+                .lock()
+                .expect("capture lock")
+                .push(CapturedImageRequest {
+                    provider: request.provider.as_str().to_owned(),
+                    endpoint: request.metadata.endpoint,
+                    transport: request.metadata.transport,
+                    kind: image.kind(),
+                    body: payload.body().clone(),
+                    context: Value::Object(payload.context().clone()),
+                });
+            Ok(StartedExecution {
+                request_id: ModelRequestId::new("req_images_test").expect("request ID"),
+                created_at: SystemTime::now(),
+                stream: false,
+                session: Box::new(ImageSession {
+                    response: Some(Bytes::from_static(IMAGE_RESPONSE)),
+                    response_headers: vec![ProviderResponseHeader::new(
+                        "x-image-rate-limit",
+                        Bytes::from_static(b"42"),
+                    )],
+                    committed_statuses: Arc::clone(&self.committed_statuses),
+                    finalized: Arc::new(AtomicBool::new(false)),
+                    fail_with_upstream_response: self.fail_with_upstream_response,
+                }),
+            })
+        })
+    }
+}
+
+struct ImageSession {
+    response: Option<Bytes>,
+    response_headers: Vec<ProviderResponseHeader>,
+    committed_statuses: Arc<Mutex<Vec<u16>>>,
+    finalized: Arc<AtomicBool>,
+    fail_with_upstream_response: bool,
+}
+
+impl ExecutionSession for ImageSession {
+    fn next_event(&mut self) -> BoxFuture<'_, Result<Option<CoordinatedEvent>, EngineError>> {
+        Box::pin(async { unreachable!("buffered image delivery does not stream") })
+    }
+
+    fn collect_uncommitted(&mut self) -> BoxFuture<'_, Result<Vec<ProviderEvent>, EngineError>> {
+        Box::pin(async move {
+            if self.fail_with_upstream_response {
+                return Err(EngineError::Provider(
+                    ProviderError::new(
+                        ProviderErrorKind::InvalidRequest,
+                        UpstreamSendState::Sent,
+                    )
+                    .with_status(StatusCode::UNPROCESSABLE_ENTITY.as_u16())
+                    .with_client_visible_upstream_response(
+                        ClientVisibleUpstreamResponse::new(
+                            StatusCode::UNPROCESSABLE_ENTITY.as_u16(),
+                            Some(b"application/problem+json".to_vec()),
+                            Bytes::from_static(
+                                br#"{ "error":{"message":"future image validation"}, "future":9007199254740993 }"#,
+                            ),
+                        )
+                        .with_headers(vec![ProviderResponseHeader::new(
+                            "x-future-image-error",
+                            Bytes::from_static(b"preserved"),
+                        )]),
+                    ),
+                ));
+            }
+            Ok(vec![ProviderEvent::wire(
+                ProtocolWireEvent::raw_json(
+                    "openai",
+                    self.response.take().expect("single image response"),
+                )
+                .expect("OpenAI protocol"),
+            )])
+        })
+    }
+
+    fn response_headers(&self) -> &[ProviderResponseHeader] {
+        &self.response_headers
+    }
+
+    fn response_status_code(&self) -> Option<u16> {
+        Some(StatusCode::CREATED.as_u16())
+    }
+
+    fn commit_downstream(
+        &mut self,
+        client_status_code: Option<u16>,
+    ) -> BoxFuture<'_, Result<(), EngineError>> {
+        Box::pin(async move {
+            self.committed_statuses
+                .lock()
+                .expect("committed status lock")
+                .push(client_status_code.expect("image response status"));
+            self.finalized.store(true, Ordering::Release);
+            Ok(())
+        })
+    }
+
+    fn record_client_status(&mut self, _: u16) -> BoxFuture<'_, Result<(), EngineError>> {
+        Box::pin(async { Ok(()) })
+    }
+
+    fn is_finalized(&self) -> bool {
+        self.finalized.load(Ordering::Acquire)
+    }
+
+    fn cancel(&self) {
+        self.finalized.store(true, Ordering::Release);
+    }
+
+    fn detach_finalize(self: Box<Self>) -> BoxFuture<'static, ()> {
+        Box::pin(async move {
+            self.finalized.store(true, Ordering::Release);
+        })
+    }
+}
+
+#[tokio::test]
+async fn image_routes_should_not_decode_bodies_and_should_preserve_both_directions() {
+    let execution = ImageExecution::new();
+    let router = api_router(execution.clone()).await;
+    let cases = [
+        (
+            "/v1/images/generations",
+            ImageRequestKind::Generation,
+            br#"{ "model":"gpt-image-future", "prompt":"a lighthouse", "future":9007199254740993 }"#.as_slice(),
+        ),
+        (
+            "/v1/images/edits",
+            ImageRequestKind::Edit,
+            br#"{"model":"gpt-image-2","images":[{"image_url":"data:image/png;base64,AAEC"}],"prompt":"add fog","prompt":"duplicate stays raw"}"#.as_slice(),
+        ),
+    ];
+
+    for (path, _, body) in &cases {
+        let response = router
+            .clone()
+            .oneshot(
+                Request::post(*path)
+                    .header(AUTHORIZATION, "Bearer sk_images_test")
+                    .header("content-type", "application/json")
+                    .header("x-codex-image-turn-id", "turn_image_route")
+                    .body(Body::from(body.to_vec()))
+                    .expect("image request"),
+            )
+            .await
+            .expect("image response");
+        assert_eq!(response.status(), StatusCode::CREATED);
+        assert_eq!(
+            response.headers().get("x-image-rate-limit"),
+            Some(&"42".parse().expect("header value"))
+        );
+        let response_body = to_bytes(response.into_body(), usize::MAX)
+            .await
+            .expect("read image response");
+        assert_eq!(response_body.as_ref(), IMAGE_RESPONSE);
+    }
+
+    let captured = execution.captured();
+    assert_eq!(captured.len(), cases.len());
+    for (captured, (endpoint, kind, body)) in captured.iter().zip(cases.iter()) {
+        assert_eq!(captured.provider, "openai");
+        assert_eq!(captured.endpoint, *endpoint);
+        assert_eq!(captured.transport, ClientTransport::HttpJson);
+        assert_eq!(captured.kind, *kind);
+        assert_eq!(captured.body.as_ref(), *body);
+        assert_eq!(
+            captured.context,
+            json!({"image_turn_id": "turn_image_route"})
+        );
+    }
+    assert_eq!(
+        execution.committed_statuses(),
+        vec![StatusCode::CREATED.as_u16(); cases.len()]
+    );
+}
+
+#[tokio::test]
+async fn image_route_should_return_the_exact_upstream_error_response() {
+    let execution = ImageExecution::failing();
+    let response = api_router(execution)
+        .await
+        .oneshot(
+            Request::post("/v1/images/edits")
+                .header(AUTHORIZATION, "Bearer sk_images_test")
+                .header("content-type", "application/json")
+                .body(Body::from(
+                    br#"{ "model":"gpt-image-2", "future_invalid":9007199254740993 }"#.to_vec(),
+                ))
+                .expect("image request"),
+        )
+        .await
+        .expect("image response");
+
+    assert_eq!(response.status(), StatusCode::UNPROCESSABLE_ENTITY);
+    assert_eq!(
+        response.headers().get("content-type"),
+        Some(&"application/problem+json".parse().expect("content type"))
+    );
+    assert_eq!(
+        response.headers().get("x-future-image-error"),
+        Some(&"preserved".parse().expect("header value"))
+    );
+    let body = to_bytes(response.into_body(), usize::MAX)
+        .await
+        .expect("read image response");
+    assert_eq!(
+        body.as_ref(),
+        br#"{ "error":{"message":"future image validation"}, "future":9007199254740993 }"#
+    );
+}

backend/crates/gateway-api/tests/openai/mod.rs

@@ -1,5 +1,6 @@
 mod auth;
 mod error;
+mod images;
 mod models;
 mod responses;
 mod router;
@@ -44,9 +45,29 @@ pub(super) async fn api_router(execution: Arc<dyn ExecutionService>) -> axum::Ro
     api_router_with_origins(execution, Vec::new()).await
 }
 
+pub(super) async fn api_router_with_worker_health(
+    execution: Arc<dyn ExecutionService>,
+    worker_health: Arc<dyn WorkerHealthSource>,
+) -> axum::Router {
+    api_router_with_origins_and_worker_health(execution, Vec::new(), worker_health).await
+}
+
 pub(super) async fn api_router_with_origins(
     execution: Arc<dyn ExecutionService>,
     cors_allowed_origins: Vec<String>,
+) -> axum::Router {
+    api_router_with_origins_and_worker_health(
+        execution,
+        cors_allowed_origins,
+        Arc::new(EmptyWorkerHealth),
+    )
+    .await
+}
+
+async fn api_router_with_origins_and_worker_health(
+    execution: Arc<dyn ExecutionService>,
+    cors_allowed_origins: Vec<String>,
+    worker_health: Arc<dyn WorkerHealthSource>,
 ) -> axum::Router {
     let admin = crate::admin::AdminTestFixture::new().await;
     gateway_api::initialize(
@@ -59,7 +80,7 @@ pub(super) async fn api_router_with_origins(
         execution,
         admin.services,
         Vec::new(),
-        Arc::new(EmptyWorkerHealth),
+        worker_health,
         Arc::new(TestLifecycle::default()),
     )
     .expect("API bundle")

backend/crates/gateway-api/tests/openai/models.rs

@@ -7,7 +7,7 @@ use axum::{
 use futures::future::BoxFuture;
 use gateway_core::engine::execution::{
     AuthenticatedClient, ClientAuthenticationError, ExecutionService, StartExecution,
-    StartedExecution,
+    StartProviderExecution, StartedExecution,
 };
 use gateway_core::error::{GatewayError, GatewayErrorKind};
 use gateway_core::routing::{
@@ -99,6 +99,18 @@ impl ExecutionService for ModelsExecution {
             ))
         })
     }
+
+    fn start_provider_endpoint(
+        &self,
+        _: StartProviderExecution,
+    ) -> BoxFuture<'_, Result<StartedExecution, GatewayError>> {
+        Box::pin(async {
+            Err(GatewayError::new(
+                GatewayErrorKind::Internal,
+                "models test must not start a provider endpoint",
+            ))
+        })
+    }
 }
 
 fn authorized_request(path: &str) -> Request<Body> {

backend/crates/gateway-api/tests/openai/responses/http.rs

@@ -17,7 +17,7 @@ use bytes::Bytes;
 use futures::future::{BoxFuture, pending};
 use gateway_core::engine::execution::{
     AuthenticatedClient, ClientAuthenticationError, ExecutionService, ExecutionSession,
-    StartExecution, StartedExecution,
+    StartExecution, StartProviderExecution, StartedExecution,
 };
 use gateway_core::engine::{CommitRequirement, CoordinatedEvent, EngineError, UpstreamSendState};
 use gateway_core::error::{
@@ -190,6 +190,18 @@ impl ExecutionService for ContextCaptureExecution {
             ))
         })
     }
+
+    fn start_provider_endpoint(
+        &self,
+        _: StartProviderExecution,
+    ) -> BoxFuture<'_, Result<StartedExecution, GatewayError>> {
+        Box::pin(async {
+            Err(GatewayError::new(
+                GatewayErrorKind::Internal,
+                "responses context test must not start a provider endpoint",
+            ))
+        })
+    }
 }
 
 impl FakeSession {
@@ -788,6 +800,10 @@ async fn streaming_response_should_append_ordinary_headers_and_skip_unrepresenta
     let trace = Arc::new(Trace::default());
     let headers = vec![
         ProviderResponseHeader::new("x-models-etag", Bytes::from_static(b"models-v2")),
+        ProviderResponseHeader::new(
+            "x-codex-turn-state",
+            Bytes::from_static(b"turn-state-from-upstream"),
+        ),
         ProviderResponseHeader::new("x-future-multi", Bytes::from_static(b"first")),
         ProviderResponseHeader::new("x-future-multi", Bytes::from_static(b"second")),
         ProviderResponseHeader::new("x-future-bytes", Bytes::from_static(b"\xffopaque")),
@@ -834,6 +850,13 @@ async fn streaming_response_should_append_ordinary_headers_and_skip_unrepresenta
             .map(HeaderValue::as_bytes),
         Some(b"\xffopaque".as_slice())
     );
+    assert_eq!(
+        response
+            .headers()
+            .get("x-codex-turn-state")
+            .and_then(|value| value.to_str().ok()),
+        Some("turn-state-from-upstream")
+    );
     assert!(response.headers().get("authorization").is_none());
     assert!(response.headers().get("connection").is_none());
     assert!(response.headers().get("x-hop-secret").is_none());

backend/crates/gateway-api/tests/openai/responses/mod.rs

@@ -130,7 +130,7 @@ fn decoder_should_preserve_opaque_client_model_values() {
             "input": "hello"
         }));
 
-        assert_eq!(decoded.metadata().public_model(), model);
+        assert_eq!(decoded.metadata().requested_model(), model);
         assert_eq!(
             openai_wire_body(&decoded)
                 .get("model")
@@ -454,14 +454,20 @@ fn decoder_should_not_reject_large_bodies_using_catalog_context_limits() {
     let snapshot = super::snapshot("sk_context_test", "openai");
     let plan = snapshot
         .plan(
-            &PublicModelId::new(decoded.metadata().public_model()).expect("public model"),
+            &PublicModelId::new(decoded.metadata().requested_model()).expect("public model"),
             decoded.operation(),
             snapshot.all_account_scope(),
             &RoutingContext::default(),
         )
         .expect("large body must not be locally context-gated");
 
-    assert_eq!(plan.candidates()[0].upstream_model().as_str(), "model-a");
+    assert_eq!(
+        plan.candidates()[0]
+            .upstream_model()
+            .expect("model route candidate")
+            .as_str(),
+        "model-a"
+    );
 }
 
 #[test]

backend/crates/gateway-api/tests/openai/responses/websocket.rs

@@ -13,7 +13,7 @@ use futures::{SinkExt, StreamExt, future::BoxFuture};
 use gateway_api::openai::responses::ResponseCreateFrameError;
 use gateway_core::engine::execution::{
     AuthenticatedClient, ClientAuthenticationError, ExecutionService, ExecutionSession,
-    StartExecution, StartedExecution,
+    StartExecution, StartProviderExecution, StartedExecution,
 };
 use gateway_core::engine::{CommitRequirement, CoordinatedEvent, EngineError, UpstreamSendState};
 use gateway_core::error::{GatewayError, ProviderError, ProviderErrorKind};
@@ -271,6 +271,13 @@ impl ExecutionService for AtomicFailureExecution {
             })
         })
     }
+
+    fn start_provider_endpoint(
+        &self,
+        _: StartProviderExecution,
+    ) -> BoxFuture<'_, Result<StartedExecution, GatewayError>> {
+        Box::pin(async { unreachable!("WebSocket test does not execute provider endpoints") })
+    }
 }
 
 fn atomic_failure_batch() -> CoordinatedEvent {
@@ -411,6 +418,10 @@ async fn websocket_response_metadata_should_preserve_ordinary_headers_without_bl
             ProviderResponseHeader::new("x-future-header", Bytes::from_static(b"future-value")),
             ProviderResponseHeader::new("x-future-multi", Bytes::from_static(b"first")),
             ProviderResponseHeader::new("x-future-multi", Bytes::from_static(b"second")),
+            ProviderResponseHeader::new(
+                "x-codex-turn-state",
+                Bytes::from_static(b"turn-state-from-upstream"),
+            ),
             ProviderResponseHeader::new("x-future-bytes", Bytes::from_static(b"\xffopaque")),
             ProviderResponseHeader::new("bad\0name", Bytes::from_static(b"unrepresentable")),
             ProviderResponseHeader::new(
@@ -483,6 +494,10 @@ async fn websocket_response_metadata_should_preserve_ordinary_headers_without_bl
     // 官方 metadata 是 string map，同名多值只能保持既有的后值覆盖语义。
     assert_eq!(headers.get("x-future-multi"), Some(&json!("second")));
     assert_eq!(headers.get("x-request-id"), Some(&json!("req_upstream")));
+    assert_eq!(
+        headers.get("x-codex-turn-state"),
+        Some(&json!("turn-state-from-upstream"))
+    );
     for omitted in [
         "x-future-bytes",
         "bad\0name",

backend/crates/gateway-core/src/engine/coordinator.rs

@@ -455,6 +455,15 @@ where
             .unwrap_or_default()
     }
 
+    /// 返回最终选中 attempt 观察到的上游 HTTP 状态码。
+    #[must_use]
+    pub fn response_status_code(&self) -> Option<u16> {
+        self.current
+            .as_ref()
+            .and_then(|current| current.response_observation.as_ref())
+            .and_then(ProviderResponseObservation::status_code)
+    }
+
     /// 将已完成响应的账号事实与 Provider 私有状态封装为可丢失的亲和记录。
     ///
     /// Core 不读取 `state` 内容；Provider 将在后续同账号 continuation 时自行解释。
@@ -828,7 +837,7 @@ where
             provider_kind: metadata.provider().clone(),
             provider_account_id: metadata.provider_account_id().cloned(),
             provider_account_ref: metadata.provider_account_id().cloned(),
-            upstream_model_id: metadata.upstream_model().clone(),
+            upstream_model_id: metadata.upstream_model().cloned(),
             upstream_transport: metadata.transport().as_str().to_owned(),
             http_version: None,
         };
@@ -1074,7 +1083,7 @@ where
                             trigger: current.trigger,
                             provider_kind: current.metadata.provider().clone(),
                             account_id: current.metadata.provider_account_id().cloned(),
-                            upstream_model_id: current.metadata.upstream_model().clone(),
+                            upstream_model_id: current.metadata.upstream_model().cloned(),
                             upstream_status_code: current
                                 .response_observation
                                 .as_ref()
@@ -1162,10 +1171,11 @@ where
         true
     }
 
-    /// 原生续写的原账号在本地调度阶段已不可用时，改用完整输入重放。
+    /// 原生续写的原账号在本地调度阶段已不可用时，交给 Provider 执行跨账号恢复。
     ///
     /// 这不是强制 Smart：下一次 attempt 仍使用请求配置的调度策略。只有网关持有
-    /// 对应 Provider 的可携带会话状态时，才可安全移除 native handle 并换号。
+    /// 对应 Provider 的会话状态时才进入恢复；是否保留 native handle、执行 probe
+    /// 或使用完整 transcript，由 Provider 自己的协议边界决定。
     fn prepare_unavailable_native_continuation_replay(&mut self, error: &ProviderError) -> bool {
         if self.account_selection.required_account().is_some()
             || self.continuation_attempt != ContinuationAttempt::Native
@@ -1481,8 +1491,13 @@ where
     }
 
     fn image_generation_succeeded(&self) -> Option<bool> {
-        self.image_generation_requested
-            .then(|| self.usage.image_output_tokens.unwrap_or_default() > 0)
+        self.image_generation_requested.then(|| {
+            if matches!(self.operation, Operation::GenerateImage(_)) {
+                self.upstream_complete
+            } else {
+                self.usage.image_output_tokens.unwrap_or_default() > 0
+            }
+        })
     }
 
     fn current_send_state(&self) -> UpstreamSendState {

backend/crates/gateway-core/src/engine/credential.rs

@@ -946,7 +946,28 @@ impl fmt::Debug for LoadedCredential {
     }
 }
 
-/// 刷新成功后的完整 CAS 写回。
+/// 与 credential revision CAS 同事务提交的账号错误事实。
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct CredentialStateWrite {
+    pub credential_state: CredentialState,
+    pub observed_at: SystemTime,
+    pub error_reason: Option<AccountErrorReason>,
+    pub message: Option<String>,
+}
+
+/// [`CredentialCasUpdate`] 跨 store 边界的命名字段。
+pub struct CredentialCasUpdateParts {
+    pub account_id: ProviderAccountId,
+    pub expected_revision: CredentialRevision,
+    pub profile: ProviderAccountUpdate,
+    pub credential: PlaintextCredential,
+    pub has_refresh_token: bool,
+    pub access_token_expires_at: Option<SystemTime>,
+    pub next_refresh_at: Option<SystemTime>,
+    pub account_state: Option<Box<CredentialStateWrite>>,
+}
+
+/// 刷新后的完整 CAS 写回。
 #[derive(Clone, PartialEq)]
 pub struct CredentialCasUpdate {
     account_id: ProviderAccountId,
@@ -956,6 +977,7 @@ pub struct CredentialCasUpdate {
     has_refresh_token: bool,
     access_token_expires_at: Option<SystemTime>,
     next_refresh_at: Option<SystemTime>,
+    account_state: Option<Box<CredentialStateWrite>>,
 }
 
 impl fmt::Debug for CredentialCasUpdate {
@@ -969,6 +991,7 @@ impl fmt::Debug for CredentialCasUpdate {
             .field("has_refresh_token", &self.has_refresh_token)
             .field("access_token_expires_at", &self.access_token_expires_at)
             .field("next_refresh_at", &self.next_refresh_at)
+            .field("account_state", &self.account_state)
             .finish()
     }
 }
@@ -1002,9 +1025,34 @@ impl CredentialCasUpdate {
             has_refresh_token,
             access_token_expires_at,
             next_refresh_at,
+            account_state: None,
         })
     }
 
+    /// 将刷新调度与账号错误事实放入同一个 revision CAS。
+    #[must_use]
+    pub fn with_account_state(
+        mut self,
+        credential_state: CredentialState,
+        observed_at: SystemTime,
+        error_reason: Option<AccountErrorReason>,
+        message: Option<String>,
+    ) -> Self {
+        let message = message.filter(|value| !value.trim().is_empty());
+        let error_reason = if credential_state == CredentialState::Ready {
+            message.as_ref().and(error_reason)
+        } else {
+            error_reason.or_else(|| credential_state.error_reason())
+        };
+        self.account_state = Some(Box::new(CredentialStateWrite {
+            credential_state,
+            observed_at,
+            error_reason,
+            message,
+        }));
+        self
+    }
+
     #[must_use]
     pub const fn account_id(&self) -> &ProviderAccountId {
         &self.account_id
@@ -1041,26 +1089,17 @@ impl CredentialCasUpdate {
     }
 
     #[must_use]
-    pub fn into_parts(
-        self,
-    ) -> (
-        ProviderAccountId,
-        CredentialRevision,
-        ProviderAccountUpdate,
-        PlaintextCredential,
-        bool,
-        Option<SystemTime>,
-        Option<SystemTime>,
-    ) {
-        (
-            self.account_id,
-            self.expected_revision,
-            self.profile,
-            self.credential,
-            self.has_refresh_token,
-            self.access_token_expires_at,
-            self.next_refresh_at,
-        )
+    pub fn into_parts(self) -> CredentialCasUpdateParts {
+        CredentialCasUpdateParts {
+            account_id: self.account_id,
+            expected_revision: self.expected_revision,
+            profile: self.profile,
+            credential: self.credential,
+            has_refresh_token: self.has_refresh_token,
+            access_token_expires_at: self.access_token_expires_at,
+            next_refresh_at: self.next_refresh_at,
+            account_state: self.account_state,
+        }
     }
 }
 
@@ -1102,6 +1141,14 @@ pub enum QuotaWriteOutcome {
     Conflict,
 }
 
+/// 只推进 Provider quota 文档的最后成功查询时间。
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct QuotaObservationTouch {
+    pub account_id: ProviderAccountId,
+    pub expected_revision: CredentialRevision,
+    pub observed_at: SystemTime,
+}
+
 /// 不改 Provider 原始 quota JSON 的额度访问事实写入。
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct QuotaAccessChange {
@@ -1117,9 +1164,13 @@ pub struct AccountStateChange {
     pub expected_revision: CredentialRevision,
     pub credential_state: CredentialState,
     pub observed_at: SystemTime,
-    /// 受控错误原因；恢复 Ready 时必须清空。
+    /// 受控错误原因；无失败事实的 Ready 写入必须清空。
+    ///
+    /// Ready 凭据可以在 AT 过期后继续 RT 恢复，此时允许保留最近一次
+    /// 刷新失败原因，供错误状态投影展示。
     pub error_reason: Option<AccountErrorReason>,
-    /// 已脱敏的上游诊断信息；恢复 Ready 时必须清空。
+    /// 供管理端展示的错误消息；结构化上游失败应保留原始 message，不能写入整个正文。
+    /// 刷新成功或其他无失败事实的 Ready 写入必须清空。
     pub message: Option<String>,
 }
 
@@ -1170,6 +1221,11 @@ pub trait ProviderAccountStore: Send + Sync {
         observation: QuotaObservation,
     ) -> Result<QuotaWriteOutcome, StoreError>;
 
+    async fn touch_quota_observation(
+        &self,
+        touch: QuotaObservationTouch,
+    ) -> Result<QuotaWriteOutcome, StoreError>;
+
     async fn apply_quota_access(
         &self,
         change: QuotaAccessChange,
@@ -1588,14 +1644,26 @@ impl AccountSelector {
 
         let candidate = match context.policy.strategy() {
             RotationStrategy::QuotaResetPriority => {
-                eligible.sort_by_key(|candidate| {
+                let default_concurrency = context.policy.max_concurrent_per_account();
+                eligible.sort_by(|left, right| {
                     (
-                        candidate.signals.quota_reset_at.is_none(),
-                        candidate.signals.quota_reset_at,
-                        candidate.signals.in_flight,
-                        candidate.signals.last_started_at,
-                        candidate.account.id().clone(),
+                        left.signals.quota_reset_at.is_none(),
+                        left.signals.quota_reset_at,
                     )
+                        .cmp(&(
+                            right.signals.quota_reset_at.is_none(),
+                            right.signals.quota_reset_at,
+                        ))
+                        .then_with(|| {
+                            capacity_utilization(left, default_concurrency)
+                                .total_cmp(&capacity_utilization(right, default_concurrency))
+                        })
+                        .then_with(|| {
+                            left.signals
+                                .last_started_at
+                                .cmp(&right.signals.last_started_at)
+                        })
+                        .then_with(|| left.account.id().cmp(right.account.id()))
                 });
                 eligible.first().copied()?
             }
@@ -1604,9 +1672,11 @@ impl AccountSelector {
                 let index = context.round_robin_cursor as usize % eligible.len();
                 eligible.get(index).copied()?
             }
-            RotationStrategy::Smart => {
-                select_smart_candidate(&eligible, context.round_robin_cursor)?
-            }
+            RotationStrategy::Smart => select_smart_candidate(
+                &eligible,
+                context.policy.max_concurrent_per_account(),
+                context.round_robin_cursor,
+            )?,
             RotationStrategy::Sticky => {
                 eligible.sort_by_key(|candidate| {
                     (
@@ -1676,8 +1746,18 @@ const SMART_QUOTA_WEIGHT: f64 = 0.8;
 const SMART_FAILURE_WEIGHT: f64 = 1.0;
 const SMART_LATENCY_WEIGHT: f64 = 0.5;
 
+fn capacity_utilization(candidate: &AccountCandidate, default_concurrency: NonZeroU32) -> f64 {
+    f64::from(candidate.signals.in_flight)
+        / f64::from(
+            candidate
+                .account
+                .effective_concurrency(default_concurrency)
+                .get(),
+        )
+}
+
 struct SmartNormalization {
-    max_in_flight: u32,
+    max_capacity_utilization: f64,
     min_quota: Option<u64>,
     max_quota: Option<u64>,
     min_latency_ms: Option<u64>,
@@ -1685,11 +1765,11 @@ struct SmartNormalization {
 }
 
 impl SmartNormalization {
-    fn from_candidates(candidates: &[&AccountCandidate]) -> Self {
-        let max_in_flight = candidates
+    fn from_candidates(candidates: &[&AccountCandidate], default_concurrency: NonZeroU32) -> Self {
+        let max_capacity_utilization = candidates
             .iter()
-            .map(|candidate| candidate.signals.in_flight)
-            .max()
+            .map(|candidate| capacity_utilization(candidate, default_concurrency))
+            .reduce(f64::max)
             .unwrap_or_default();
         let min_quota = candidates
             .iter()
@@ -1710,7 +1790,7 @@ impl SmartNormalization {
             .filter(|latency| *latency > 0)
             .max();
         Self {
-            max_in_flight,
+            max_capacity_utilization,
             min_quota,
             max_quota,
             min_latency_ms,
@@ -1721,12 +1801,18 @@ impl SmartNormalization {
 
 fn select_smart_candidate<'a>(
     candidates: &[&'a AccountCandidate],
+    default_concurrency: NonZeroU32,
     cursor: u64,
 ) -> Option<&'a AccountCandidate> {
-    let normalization = SmartNormalization::from_candidates(candidates);
+    let normalization = SmartNormalization::from_candidates(candidates, default_concurrency);
     let mut ranked = candidates
         .iter()
-        .map(|candidate| (*candidate, smart_score(candidate, &normalization)))
+        .map(|candidate| {
+            (
+                *candidate,
+                smart_score(candidate, default_concurrency, &normalization),
+            )
+        })
         .collect::<Vec<_>>();
     ranked.sort_by(|(left, left_score), (right, right_score)| {
         right_score
@@ -1742,11 +1828,14 @@ fn select_smart_candidate<'a>(
     Some(ranked[index].0)
 }
 
-fn smart_score(candidate: &AccountCandidate, normalization: &SmartNormalization) -> f64 {
-    let load = lower_is_better(
-        u64::from(candidate.signals.in_flight),
-        0,
-        u64::from(normalization.max_in_flight),
+fn smart_score(
+    candidate: &AccountCandidate,
+    default_concurrency: NonZeroU32,
+    normalization: &SmartNormalization,
+) -> f64 {
+    let load = lower_ratio_is_better(
+        capacity_utilization(candidate, default_concurrency),
+        normalization.max_capacity_utilization,
     );
     let quota = candidate.signals.quota_remaining_rank.map_or(0.5, |quota| {
         higher_is_better(
@@ -1781,6 +1870,13 @@ fn smart_score(candidate: &AccountCandidate, normalization: &SmartNormalization)
         + SMART_LATENCY_WEIGHT * latency
 }
 
+fn lower_ratio_is_better(value: f64, maximum: f64) -> f64 {
+    if maximum <= 0.0 {
+        return 1.0;
+    }
+    1.0 - (value / maximum).clamp(0.0, 1.0)
+}
+
 fn lower_is_better(value: u64, minimum: u64, maximum: u64) -> f64 {
     if maximum <= minimum {
         return 1.0;

backend/crates/gateway-core/src/engine/execution.rs

@@ -118,6 +118,35 @@ pub struct StartExecution {
     pub metadata: ExecutionRequestMetadata,
 }
 
+/// 启动一个由协议 adapter 明确绑定到 Provider 自有端点的请求。
+pub struct StartProviderExecution {
+    pub client: AuthenticatedClient,
+    pub provider: ProviderKind,
+    pub operation: Operation,
+    pub metadata: ExecutionRequestMetadata,
+}
+
+enum ExecutionTarget {
+    Model(PublicModelId),
+    ProviderEndpoint(ProviderKind),
+}
+
+impl ExecutionTarget {
+    fn into_public_model(self) -> Option<PublicModelId> {
+        match self {
+            Self::Model(model) => Some(model),
+            Self::ProviderEndpoint(_) => None,
+        }
+    }
+}
+
+struct PendingStartExecution {
+    client: AuthenticatedClient,
+    target: ExecutionTarget,
+    operation: Operation,
+    metadata: ExecutionRequestMetadata,
+}
+
 pub struct StartedExecution {
     pub request_id: ModelRequestId,
     pub created_at: SystemTime,
@@ -129,6 +158,9 @@ pub trait ExecutionSession: Send {
     fn next_event(&mut self) -> BoxFuture<'_, Result<Option<CoordinatedEvent>, EngineError>>;
     fn collect_uncommitted(&mut self) -> BoxFuture<'_, Result<Vec<ProviderEvent>, EngineError>>;
     fn response_headers(&self) -> &[ProviderResponseHeader];
+    fn response_status_code(&self) -> Option<u16> {
+        None
+    }
     fn commit_downstream(
         &mut self,
         client_status_code: Option<u16>,
@@ -156,6 +188,10 @@ pub trait ExecutionService: Send + Sync {
         &self,
         request: StartExecution,
     ) -> BoxFuture<'_, Result<StartedExecution, GatewayError>>;
+    fn start_provider_endpoint(
+        &self,
+        request: StartProviderExecution,
+    ) -> BoxFuture<'_, Result<StartedExecution, GatewayError>>;
 }
 
 /// 成功认证后的 API Key 使用事实接收器。
@@ -247,9 +283,44 @@ impl DefaultExecutionService {
         }
     }
 
-    async fn start_inner(
+    async fn start_inner(&self, request: StartExecution) -> Result<StartedExecution, GatewayError> {
+        let StartExecution {
+            client,
+            public_model,
+            operation,
+            metadata,
+        } = request;
+        self.start_inner_with_target(PendingStartExecution {
+            client,
+            target: ExecutionTarget::Model(public_model),
+            operation,
+            metadata,
+        })
+        .await
+    }
+
+    async fn start_provider_endpoint_inner(
         &self,
-        mut request: StartExecution,
+        request: StartProviderExecution,
+    ) -> Result<StartedExecution, GatewayError> {
+        let StartProviderExecution {
+            client,
+            provider,
+            operation,
+            metadata,
+        } = request;
+        self.start_inner_with_target(PendingStartExecution {
+            client,
+            target: ExecutionTarget::ProviderEndpoint(provider),
+            operation,
+            metadata,
+        })
+        .await
+    }
+
+    async fn start_inner_with_target(
+        &self,
+        mut request: PendingStartExecution,
     ) -> Result<StartedExecution, GatewayError> {
         request.client.policy.authorize().map_err(|_| {
             GatewayError::new(GatewayErrorKind::PolicyDenied, "client API key is disabled")
@@ -264,16 +335,24 @@ impl DefaultExecutionService {
         let routing_context = self
             .route_context(request.client.policy.account_scope().provider_kinds())
             .await?;
-        let plan = request
-            .client
-            .snapshot
-            .plan(
-                &request.public_model,
+        let account_scope = Arc::clone(request.client.policy.account_scope());
+        let plan = match &request.target {
+            ExecutionTarget::ProviderEndpoint(provider) => {
+                request.client.snapshot.plan_provider_endpoint(
+                    provider,
+                    &request.operation,
+                    account_scope,
+                    &routing_context,
+                )
+            }
+            ExecutionTarget::Model(public_model) => request.client.snapshot.plan(
+                public_model,
                 &request.operation,
-                Arc::clone(request.client.policy.account_scope()),
+                account_scope,
                 &routing_context,
-            )
-            .map_err(map_routing_error)?;
+            ),
+        }
+        .map_err(map_routing_error)?;
         let continuation = match request.metadata.previous_response_id.as_ref() {
             Some(previous) => {
                 let resolve = self
@@ -375,18 +454,24 @@ impl DefaultExecutionService {
 
     async fn start_without_continuation(
         &self,
-        request: StartExecution,
+        request: PendingStartExecution,
         request_id: ModelRequestId,
         started_at: SystemTime,
         deadline_at: SystemTime,
         plan: crate::routing::RoutingPlan,
         continuation: Option<ContinuationBinding>,
     ) -> Result<StartedExecution, GatewayError> {
+        let PendingStartExecution {
+            client,
+            target,
+            operation,
+            metadata,
+        } = request;
         let admission_request = ClientAdmissionRequest {
             model_request_id: request_id.clone(),
-            client_api_key_id: request.client.policy.key_id().clone(),
+            client_api_key_id: client.policy.key_id().clone(),
             lease_ttl: MODEL_REQUEST_DEADLINE,
-            limits: request.client.policy.limits(),
+            limits: client.policy.limits(),
         };
         match self
             .admissions
@@ -411,7 +496,7 @@ impl DefaultExecutionService {
         }
         let admission = AdmissionLease {
             port: Arc::clone(&self.admissions),
-            client_api_key_id: request.client.policy.key_id().clone(),
+            client_api_key_id: client.policy.key_id().clone(),
             model_request_id: request_id.clone(),
         };
         let observation = plan
@@ -419,27 +504,27 @@ impl DefaultExecutionService {
             .first()
             .map_or_else(Default::default, |candidate| {
                 self.providers
-                    .request_observation(candidate.provider(), &request.operation)
+                    .request_observation(candidate.provider(), &operation)
             });
         let new_request = NewModelRequest {
             id: request_id.clone(),
-            client_api_key_id: Some(request.client.policy.key_id().clone()),
-            client_api_key_ref: request.client.policy.key_id().clone(),
+            client_api_key_id: Some(client.policy.key_id().clone()),
+            client_api_key_ref: client.policy.key_id().clone(),
             config_revision: plan.config_revision(),
-            routing: request.client.policy.account_scope().routing_snapshot(),
-            protocol: request.metadata.protocol,
-            operation: request.operation.kind(),
-            endpoint: request.metadata.endpoint,
-            client_transport: request.metadata.transport.as_str().to_owned(),
-            requested_model: request.public_model,
-            client_ip: request.metadata.client_ip,
-            user_agent: request.metadata.user_agent,
+            routing: client.policy.account_scope().routing_snapshot(),
+            protocol: metadata.protocol,
+            operation: operation.kind(),
+            endpoint: metadata.endpoint,
+            client_transport: metadata.transport.as_str().to_owned(),
+            requested_model: target.into_public_model(),
+            client_ip: metadata.client_ip,
+            user_agent: metadata.user_agent,
             reasoning_effort: observation.reasoning_effort,
             reasoning_preset: observation.reasoning_preset,
             request_kind: observation.request_kind,
             subagent_kind: observation.subagent_kind,
             compact: observation.compact,
-            image_generation_requested: request.operation.image_generation_requested(),
+            image_generation_requested: operation.image_generation_requested(),
             started_at,
             deadline_at,
         };
@@ -447,7 +532,7 @@ impl DefaultExecutionService {
             .coordinator
             .start(
                 new_request,
-                request.operation,
+                operation,
                 plan,
                 None,
                 continuation,
@@ -464,7 +549,7 @@ impl DefaultExecutionService {
         Ok(StartedExecution {
             request_id,
             created_at: started_at,
-            stream: request.metadata.stream,
+            stream: metadata.stream,
             session: Box::new(DefaultExecutionSession::new(
                 core,
                 admission,
@@ -572,7 +657,7 @@ impl DefaultExecutionService {
             operation: operation.kind(),
             endpoint: "/api/admin/accounts/connection-test".to_owned(),
             client_transport: ClientTransport::InternalProbe.as_str().to_owned(),
-            requested_model: public_model,
+            requested_model: Some(public_model),
             client_ip: None,
             user_agent: None,
             reasoning_effort: None,
@@ -783,6 +868,13 @@ impl ExecutionService for DefaultExecutionService {
     ) -> BoxFuture<'_, Result<StartedExecution, GatewayError>> {
         Box::pin(async move { self.start_inner(request).await })
     }
+
+    fn start_provider_endpoint(
+        &self,
+        request: StartProviderExecution,
+    ) -> BoxFuture<'_, Result<StartedExecution, GatewayError>> {
+        Box::pin(async move { self.start_provider_endpoint_inner(request).await })
+    }
 }
 
 impl AccountProbe for DefaultExecutionService {
@@ -948,6 +1040,12 @@ impl ExecutionSession for DefaultExecutionSession {
             .unwrap_or_default()
     }
 
+    fn response_status_code(&self) -> Option<u16> {
+        self.core
+            .as_ref()
+            .and_then(ResponseExecutionSession::response_status_code)
+    }
+
     fn commit_downstream(
         &mut self,
         client_status_code: Option<u16>,
@@ -1076,6 +1174,7 @@ fn new_request_id() -> Result<ModelRequestId, GatewayError> {
 fn map_routing_error(error: crate::error::RoutingError) -> GatewayError {
     match error {
         crate::error::RoutingError::NoCapableProvider { .. }
+        | crate::error::RoutingError::NoCapableProviderEndpoint { .. }
         | crate::error::RoutingError::EmptyAccountScope => GatewayError::new(
             GatewayErrorKind::NoAvailableProvider,
             "no provider can execute this request",

backend/crates/gateway-core/src/engine/mod.rs

@@ -362,9 +362,14 @@ pub enum ContinuationAttempt {
     None,
     /// 使用 Store 解析出的原生 handle 与账号绑定。
     Native,
-    /// 在原账号上用完整连接内 transcript 重放。
+    /// 在原账号上执行 Provider 定义的恢复。
+    ///
+    /// 只有持有可携带 transcript 的 Provider 才能清除 native handle 后重放；
+    /// 只持有 opaque state 的 Provider 必须保留 continuation 依赖或返回客户端错误。
     ReplayOwner,
-    /// transcript 已可携带，允许选择其他账号。
+    /// 允许选择其他账号并执行 Provider 定义的恢复。
+    ///
+    /// 该枚举本身不证明客户端 input 完整，也不授权 Provider 清除 previous-response。
     ReplayAny,
 }
 
@@ -555,7 +560,7 @@ pub struct NewModelRequest {
     pub operation: OperationKind,
     pub endpoint: String,
     pub client_transport: String,
-    pub requested_model: PublicModelId,
+    pub requested_model: Option<PublicModelId>,
     pub client_ip: Option<IpAddr>,
     pub user_agent: Option<String>,
     pub reasoning_effort: Option<String>,
@@ -577,7 +582,7 @@ pub struct AttemptRecord {
     pub provider_kind: ProviderKind,
     pub provider_account_id: Option<ProviderAccountId>,
     pub provider_account_ref: Option<ProviderAccountId>,
-    pub upstream_model_id: UpstreamModelId,
+    pub upstream_model_id: Option<UpstreamModelId>,
     pub upstream_transport: String,
     pub http_version: Option<String>,
 }
@@ -590,7 +595,7 @@ pub struct IntermediateFailure {
     pub trigger: AttemptTrigger,
     pub provider_kind: ProviderKind,
     pub account_id: Option<ProviderAccountId>,
-    pub upstream_model_id: UpstreamModelId,
+    pub upstream_model_id: Option<UpstreamModelId>,
     pub upstream_status_code: Option<u16>,
     pub upstream_request_id: Option<String>,
     pub error: ProviderError,

backend/crates/gateway-core/src/engine/provider.rs

@@ -123,7 +123,7 @@ impl UpstreamTransport {
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct ProviderCallMetadata {
     provider: ProviderKind,
-    upstream_model: UpstreamModelId,
+    upstream_model: Option<UpstreamModelId>,
     resource: ProviderResource,
     upstream_request_id: Option<OpaqueUpstreamValue>,
     transport: UpstreamTransport,
@@ -140,7 +140,23 @@ impl ProviderCallMetadata {
     ) -> Self {
         Self {
             provider,
-            upstream_model,
+            upstream_model: Some(upstream_model),
+            resource,
+            upstream_request_id: None,
+            transport,
+        }
+    }
+
+    /// 创建一次不声明模型的 Provider 原生端点调用事实。
+    #[must_use]
+    pub const fn for_provider_endpoint(
+        provider: ProviderKind,
+        resource: ProviderResource,
+        transport: UpstreamTransport,
+    ) -> Self {
+        Self {
+            provider,
+            upstream_model: None,
             resource,
             upstream_request_id: None,
             transport,
@@ -160,10 +176,10 @@ impl ProviderCallMetadata {
         &self.provider
     }
 
-    /// 返回实际模型；必须与冻结 target 一致。
+    /// 返回实际模型；Provider 原生端点没有模型事实。
     #[must_use]
-    pub const fn upstream_model(&self) -> &UpstreamModelId {
-        &self.upstream_model
+    pub const fn upstream_model(&self) -> Option<&UpstreamModelId> {
+        self.upstream_model.as_ref()
     }
 
     /// 返回匿名资源；账号调用返回 `None`。
@@ -199,7 +215,8 @@ impl ProviderCallMetadata {
     /// 确认 metadata 没有替换请求计划中冻结的 Provider 候选。
     #[must_use]
     pub fn confirms(&self, candidate: &ProviderCandidate) -> bool {
-        candidate.provider() == &self.provider && candidate.upstream_model() == &self.upstream_model
+        candidate.provider() == &self.provider
+            && candidate.upstream_model() == self.upstream_model.as_ref()
     }
 }
 
@@ -517,7 +534,7 @@ impl fmt::Debug for ProviderRequest {
             .debug_struct("ProviderRequest")
             .field("operation", &self.operation)
             .field("provider", self.candidate.provider())
-            .field("upstream_model", self.candidate.upstream_model())
+            .field("upstream_model", &self.candidate.upstream_model())
             .finish()
     }
 }

backend/crates/gateway-core/src/error.rs

@@ -98,6 +98,12 @@ pub enum RoutingError {
         /// 客户端提交的模型名称。
         model: String,
     },
+    /// 固定 Provider 的原生端点当前不可执行。
+    #[error("provider endpoint `{provider}` is unavailable")]
+    NoCapableProviderEndpoint {
+        /// adapter 已绑定的 Provider。
+        provider: String,
+    },
 }
 
 /// 调用方策略不满足约束或拒绝请求。

backend/crates/gateway-core/src/event.rs

@@ -16,7 +16,7 @@ use crate::operation::ProviderSessionState;
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct ResponseMeta {
     response_id: String,
-    model: String,
+    model: Option<String>,
     finish_reason: Option<FinishReason>,
 }
 
@@ -26,7 +26,17 @@ impl ResponseMeta {
     pub fn new(response_id: impl Into<String>, model: impl Into<String>) -> Self {
         Self {
             response_id: response_id.into(),
-            model: model.into(),
+            model: Some(model.into()),
+            finish_reason: None,
+        }
+    }
+
+    /// 创建不声明模型的 Provider 原生端点响应元数据。
+    #[must_use]
+    pub fn for_provider_endpoint(response_id: impl Into<String>) -> Self {
+        Self {
+            response_id: response_id.into(),
+            model: None,
             finish_reason: None,
         }
     }
@@ -46,8 +56,8 @@ impl ResponseMeta {
 
     /// 返回对客户端公开的模型名。
     #[must_use]
-    pub fn model(&self) -> &str {
-        &self.model
+    pub fn model(&self) -> Option<&str> {
+        self.model.as_deref()
     }
 
     /// 返回规范化终止原因。
@@ -190,6 +200,7 @@ pub struct ProtocolWireEvent {
     data: Value,
     has_json_data: bool,
     raw_sse_frame: Option<Bytes>,
+    raw_json_body: Option<Bytes>,
     sse_id: Option<String>,
     sse_retry: Option<u64>,
 }
@@ -228,6 +239,7 @@ impl ProtocolWireEvent {
             data,
             has_json_data: true,
             raw_sse_frame: None,
+            raw_json_body: None,
             sse_id,
             sse_retry,
         })
@@ -274,6 +286,32 @@ impl ProtocolWireEvent {
             data: Value::Null,
             has_json_data: false,
             raw_sse_frame: Some(raw_sse_frame),
+            raw_json_body: None,
+            sse_id: None,
+            sse_retry: None,
+        })
+    }
+
+    /// 创建未经改写的完整 JSON 响应正文。
+    ///
+    /// 该载荷用于非流式协议端点；Core 不解析或重编码其中的值。
+    ///
+    /// # Errors
+    ///
+    /// 协议名不满足内部路由标识约束时返回错误。
+    pub fn raw_json(
+        protocol: impl Into<String>,
+        raw_json_body: Bytes,
+    ) -> Result<Self, IdentifierError> {
+        let protocol = protocol.into();
+        validate_text(&protocol, 64, true, None)?;
+        Ok(Self {
+            protocol,
+            event_type: None,
+            data: Value::Null,
+            has_json_data: false,
+            raw_sse_frame: None,
+            raw_json_body: Some(raw_json_body),
             sse_id: None,
             sse_retry: None,
         })
@@ -321,6 +359,18 @@ impl ProtocolWireEvent {
         self.raw_sse_frame.as_ref()
     }
 
+    /// 返回可直接写给 JSON 客户端的未经改写响应正文。
+    #[must_use]
+    pub const fn raw_json_body(&self) -> Option<&Bytes> {
+        self.raw_json_body.as_ref()
+    }
+
+    /// 拆出未经改写的完整 JSON 响应正文。
+    #[must_use]
+    pub fn into_raw_json_body(self) -> Option<Bytes> {
+        self.raw_json_body
+    }
+
     /// 拆出协议原生 JSON 数据。
     #[must_use]
     pub fn into_data(self) -> Value {
@@ -336,6 +386,7 @@ impl fmt::Debug for ProtocolWireEvent {
             .field("event_type", &self.event_type)
             .field("has_json_data", &self.has_json_data)
             .field("has_raw_sse_frame", &self.raw_sse_frame.is_some())
+            .field("has_raw_json_body", &self.raw_json_body.is_some())
             .field("has_sse_id", &self.sse_id.is_some())
             .field("sse_retry", &self.sse_retry)
             .field("data", &"<not included in Debug>")

backend/crates/gateway-core/src/operation/mod.rs

@@ -1,13 +1,14 @@
 //! 协议无关的业务 operation。
 //!
 //! 这里只保留网关需要解释、路由或结算的稳定语义。协议 adapter 无法写入
-//! wire body 的连接级事实随 [`ProtocolPayload`] 不透明传递，由对应 Provider
-//! 自己解释。
+//! wire body 与连接级事实随 [`ProtocolPayload`] 或 [`RawJsonPayload`] 不透明传递，
+//! 由对应 Provider 自己解释。
 
 use std::collections::BTreeSet;
 use std::fmt;
 use std::sync::Arc;
 
+use bytes::Bytes;
 use serde::{Deserialize, Serialize};
 use serde_json::{Map, Value};
 
@@ -239,6 +240,72 @@ impl fmt::Debug for ProtocolPayload {
     }
 }
 
+/// 客户端协议交给 Provider 的未经重编码 JSON 正文。
+///
+/// 协议 adapter 只确定路由端点；Core 保留原始字节与非 wire 上下文，
+/// 不验证、解析或改写正文。
+#[derive(Clone, PartialEq, Eq)]
+pub struct RawJsonPayload {
+    protocol: String,
+    body: Bytes,
+    context: Map<String, Value>,
+}
+
+impl RawJsonPayload {
+    /// 创建未经重编码的协议 JSON 正文。
+    ///
+    /// # Errors
+    ///
+    /// 协议名称为空、过长或含控制字符时返回错误。
+    pub fn new(protocol: impl Into<String>, body: Bytes) -> Result<Self, OperationError> {
+        let protocol = protocol.into();
+        validate_text(&protocol, 64, true, None).map_err(|_| OperationError::EmptyField {
+            field: "raw_json_payload protocol",
+        })?;
+        Ok(Self {
+            protocol,
+            body,
+            context: Map::new(),
+        })
+    }
+
+    /// 返回协议名称。
+    #[must_use]
+    pub fn protocol(&self) -> &str {
+        &self.protocol
+    }
+
+    /// 返回 adapter 收到的原始 JSON 字节。
+    #[must_use]
+    pub const fn body(&self) -> &Bytes {
+        &self.body
+    }
+
+    /// 附着不写入 wire body 的协议连接上下文。
+    #[must_use]
+    pub fn with_context(mut self, context: Map<String, Value>) -> Self {
+        self.context = context;
+        self
+    }
+
+    /// 返回仅供对应 Provider 解释的非 wire 上下文。
+    #[must_use]
+    pub const fn context(&self) -> &Map<String, Value> {
+        &self.context
+    }
+}
+
+impl fmt::Debug for RawJsonPayload {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("RawJsonPayload")
+            .field("protocol", &self.protocol)
+            .field("body", &"<not included in Debug>")
+            .field("context", &"<not included in Debug>")
+            .finish()
+    }
+}
+
 /// 通用生成请求。
 #[derive(Clone, PartialEq)]
 pub struct GenerateRequest {
@@ -501,32 +568,39 @@ impl fmt::Debug for RerankRequest {
     }
 }
 
-/// 图像生成请求。
-#[derive(Clone, PartialEq, Eq)]
+/// 图像 API 的稳定端点语义。
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub enum ImageRequestKind {
+    /// 从文本生成图像。
+    Generation,
+    /// 使用输入图像执行编辑。
+    Edit,
+}
+
+/// 图像生成或编辑请求。
+#[derive(Clone, PartialEq)]
 pub struct ImageRequest {
-    prompt: String,
-    count: u32,
+    kind: ImageRequestKind,
+    payload: RawJsonPayload,
 }
 
 impl ImageRequest {
-    /// 创建图像生成请求。
-    ///
-    /// # Errors
-    ///
-    /// Prompt 为空时返回错误。
-    pub fn new(prompt: impl Into<String>) -> Result<Self, OperationError> {
-        let prompt = prompt.into();
-        if prompt.is_empty() {
-            return Err(OperationError::EmptyField { field: "prompt" });
-        }
-        Ok(Self { prompt, count: 1 })
+    /// 创建携带原始协议 JSON 正文的图像请求。
+    #[must_use]
+    pub const fn from_raw_json(kind: ImageRequestKind, payload: RawJsonPayload) -> Self {
+        Self { kind, payload }
     }
 
-    /// 设置图像数量。
+    /// 返回图像 API 端点语义。
     #[must_use]
-    pub const fn with_count(mut self, count: u32) -> Self {
-        self.count = count;
-        self
+    pub const fn kind(&self) -> ImageRequestKind {
+        self.kind
+    }
+
+    /// 返回未经重编码的协议 JSON 正文。
+    #[must_use]
+    pub const fn payload(&self) -> &RawJsonPayload {
+        &self.payload
     }
 }
 
@@ -534,8 +608,8 @@ impl fmt::Debug for ImageRequest {
     fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
         formatter
             .debug_struct("ImageRequest")
-            .field("prompt", &"<not included in Debug>")
-            .field("count", &self.count)
+            .field("kind", &self.kind)
+            .field("payload", &"<not included in Debug>")
             .finish()
     }
 }
@@ -649,7 +723,8 @@ impl Operation {
     pub fn image_generation_requested(&self) -> bool {
         match self {
             Self::Generate(request) => request.image_generation_requested(),
-            Self::Embed(_) | Self::Rerank(_) | Self::GenerateImage(_) | Self::Speech(_) => false,
+            Self::GenerateImage(_) => true,
+            Self::Embed(_) | Self::Rerank(_) | Self::Speech(_) => false,
         }
     }
 

backend/crates/gateway-core/src/provider_ports/mod.rs

@@ -231,6 +231,32 @@ pub trait ProviderSessionAffinityPort: Send + Sync {
         ttl: Duration,
     ) -> BoxFuture<'a, Result<(), ProviderStoreError>>;
 
+    /// 仅在亲和键尚未绑定时写入候选账号，并返回原子操作后的实际绑定。
+    ///
+    /// 已存在的绑定绝不会被候选账号覆盖；同一根会话的并发首次请求据此收敛到
+    /// 单一账号。TTL 只在首次写入时设置，已有绑定由成功反馈负责刷新。
+    fn claim_or_load<'a>(
+        &'a self,
+        provider_kind: &'a ProviderKind,
+        key: &'a ProviderSessionAffinityKey,
+        candidate_account_id: &'a ProviderAccountId,
+        ttl: Duration,
+    ) -> BoxFuture<'a, Result<ProviderAccountId, ProviderStoreError>>;
+
+    /// 仅当当前绑定等于 `expected_account_id`（或键已过期）时写入新账号，
+    /// 并返回原子操作后的实际绑定。
+    ///
+    /// Provider 用它迁移不可用账号，以及在成功后以 `expected == replacement`
+    /// 刷新 TTL；迟到的旧账号成功不能覆盖较新的会话 winner。
+    fn compare_and_bind<'a>(
+        &'a self,
+        provider_kind: &'a ProviderKind,
+        key: &'a ProviderSessionAffinityKey,
+        expected_account_id: &'a ProviderAccountId,
+        replacement_account_id: &'a ProviderAccountId,
+        ttl: Duration,
+    ) -> BoxFuture<'a, Result<ProviderAccountId, ProviderStoreError>>;
+
     fn clear<'a>(
         &'a self,
         provider_kind: &'a ProviderKind,
@@ -407,6 +433,84 @@ pub trait ProviderCatalogCachePort: Send + Sync {
     ) -> BoxFuture<'a, Result<Option<OpaqueProviderData>, ProviderStoreError>>;
 }
 
+/// Provider 从官方制品核验出的可重建请求画像。
+///
+/// Core 只用单调制品序号约束覆盖顺序；具体版本字段由对应 Provider 放在
+/// `profile` 中解释。每个 Provider 在 Store 中只保留一份最新画像。
+#[derive(Clone, PartialEq)]
+pub struct ProviderArtifactProfile {
+    provider_kind: ProviderKind,
+    artifact_sequence: u64,
+    verified_at: SystemTime,
+    profile: OpaqueProviderData,
+}
+
+impl ProviderArtifactProfile {
+    #[must_use]
+    pub const fn new(
+        provider_kind: ProviderKind,
+        artifact_sequence: u64,
+        verified_at: SystemTime,
+        profile: OpaqueProviderData,
+    ) -> Self {
+        Self {
+            provider_kind,
+            artifact_sequence,
+            verified_at,
+            profile,
+        }
+    }
+
+    #[must_use]
+    pub const fn provider_kind(&self) -> &ProviderKind {
+        &self.provider_kind
+    }
+
+    #[must_use]
+    pub const fn artifact_sequence(&self) -> u64 {
+        self.artifact_sequence
+    }
+
+    #[must_use]
+    pub const fn verified_at(&self) -> SystemTime {
+        self.verified_at
+    }
+
+    #[must_use]
+    pub const fn profile(&self) -> &OpaqueProviderData {
+        &self.profile
+    }
+}
+
+impl fmt::Debug for ProviderArtifactProfile {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("ProviderArtifactProfile")
+            .field("provider_kind", &self.provider_kind)
+            .field("artifact_sequence", &self.artifact_sequence)
+            .field("verified_at", &self.verified_at)
+            .field("profile", &"[PROVIDER-OWNED]")
+            .finish()
+    }
+}
+
+pub trait ProviderArtifactProfileCachePort: Send + Sync {
+    /// 覆盖同一 Provider 的固定 cache key。
+    ///
+    /// 返回 `false` 表示 Store 已持有更高的制品序号；相同序号但内容不同必须返回
+    /// [`ProviderStoreErrorKind::Conflict`]，不能静默改写已核验画像。
+    fn replace_if_newer(
+        &self,
+        profile: ProviderArtifactProfile,
+        ttl: Duration,
+    ) -> BoxFuture<'_, Result<bool, ProviderStoreError>>;
+
+    fn read<'a>(
+        &'a self,
+        provider_kind: &'a ProviderKind,
+    ) -> BoxFuture<'a, Result<Option<ProviderArtifactProfile>, ProviderStoreError>>;
+}
+
 /// Redis 中可重建的账号状态投影。
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct ProviderCredentialState {
@@ -946,6 +1050,7 @@ pub struct ProviderStorePorts {
     session_exclusions: Arc<dyn ProviderSessionExclusionPort>,
     account_feedback: Arc<AccountFeedbackStats>,
     catalog_cache: Arc<dyn ProviderCatalogCachePort>,
+    artifact_profiles: Arc<dyn ProviderArtifactProfileCachePort>,
     credential_state: Arc<dyn ProviderCredentialStatePort>,
     cooldowns: Arc<dyn ProviderCooldownPort>,
     runtime_policy: Arc<dyn ProviderRuntimePolicyPort>,
@@ -962,6 +1067,7 @@ impl ProviderStorePorts {
         session_affinity: Arc<dyn ProviderSessionAffinityPort>,
         session_exclusions: Arc<dyn ProviderSessionExclusionPort>,
         catalog_cache: Arc<dyn ProviderCatalogCachePort>,
+        artifact_profiles: Arc<dyn ProviderArtifactProfileCachePort>,
         credential_state: Arc<dyn ProviderCredentialStatePort>,
         cooldowns: Arc<dyn ProviderCooldownPort>,
         runtime_policy: Arc<dyn ProviderRuntimePolicyPort>,
@@ -974,6 +1080,7 @@ impl ProviderStorePorts {
             session_exclusions,
             account_feedback: Arc::new(AccountFeedbackStats::default()),
             catalog_cache,
+            artifact_profiles,
             credential_state,
             cooldowns,
             runtime_policy,
@@ -1011,6 +1118,11 @@ impl ProviderStorePorts {
         Arc::clone(&self.catalog_cache)
     }
 
+    #[must_use]
+    pub fn artifact_profiles(&self) -> Arc<dyn ProviderArtifactProfileCachePort> {
+        Arc::clone(&self.artifact_profiles)
+    }
+
     #[must_use]
     pub fn credential_state(&self) -> Arc<dyn ProviderCredentialStatePort> {
         Arc::clone(&self.credential_state)

backend/crates/gateway-core/src/routing/mod.rs

@@ -780,11 +780,11 @@ pub struct RoutingContext {
     pub blocked_providers: BTreeSet<ProviderKind>,
 }
 
-/// 已绑定 Provider 与真实上游模型的请求候选。
+/// 已绑定 Provider 的请求候选；模型端点携带真实上游模型，原生端点不虚构模型。
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct ProviderCandidate {
     provider: ProviderKind,
-    upstream_model: UpstreamModelId,
+    upstream_model: Option<UpstreamModelId>,
     emulated_features: BTreeSet<Feature>,
     account_scope: Arc<FrozenAccountScope>,
 }
@@ -796,8 +796,8 @@ impl ProviderCandidate {
     }
 
     #[must_use]
-    pub const fn upstream_model(&self) -> &UpstreamModelId {
-        &self.upstream_model
+    pub const fn upstream_model(&self) -> Option<&UpstreamModelId> {
+        self.upstream_model.as_ref()
     }
 
     #[must_use]
@@ -816,7 +816,6 @@ impl ProviderCandidate {
 pub struct RoutingPlan {
     config_revision: ConfigRevision,
     account_selection_policy: AccountSelectionPolicy,
-    public_model: PublicModelId,
     operation: OperationKind,
     max_attempts: NonZeroU32,
     account_scope: Arc<FrozenAccountScope>,
@@ -834,11 +833,6 @@ impl RoutingPlan {
         self.account_selection_policy
     }
 
-    #[must_use]
-    pub const fn public_model(&self) -> &PublicModelId {
-        &self.public_model
-    }
-
     #[must_use]
     pub const fn operation(&self) -> OperationKind {
         self.operation

backend/crates/gateway-core/src/routing/snapshot.rs

@@ -765,7 +765,7 @@ impl RuntimeSnapshot {
             };
             candidates.push(ProviderCandidate {
                 provider: provider.clone(),
-                upstream_model,
+                upstream_model: Some(upstream_model),
                 emulated_features,
                 account_scope: Arc::clone(&account_scope),
             });
@@ -780,7 +780,6 @@ impl RuntimeSnapshot {
         Ok(RoutingPlan {
             config_revision: self.revision,
             account_selection_policy: self.account_selection_policy,
-            public_model: public_model.clone(),
             operation: operation.kind(),
             max_attempts: NonZeroU32::new(super::MAX_REQUEST_ATTEMPTS)
                 .expect("constant request attempt limit is non-zero"),
@@ -788,6 +787,47 @@ impl RuntimeSnapshot {
             candidates: Arc::from(candidates),
         })
     }
+
+    /// 为 Provider 自有、且不属于文本模型目录的端点冻结请求计划。
+    ///
+    /// 端点 adapter 已经确定 Provider，因此这里只执行账号范围、circuit 和注册
+    /// 状态检查；不会读取业务正文、构造模型或查询 Provider 文本模型目录。
+    pub fn plan_provider_endpoint(
+        &self,
+        provider: &ProviderKind,
+        operation: &Operation,
+        account_scope: Arc<FrozenAccountScope>,
+        context: &RoutingContext,
+    ) -> Result<RoutingPlan, RoutingError> {
+        let allowed = !account_scope.provider_kinds().is_empty()
+            && account_scope.provider_kinds().contains(provider)
+            && self.providers.contains(provider)
+            && context
+                .required_provider
+                .as_ref()
+                .is_none_or(|required| required == provider)
+            && !context.blocked_providers.contains(provider);
+        if !allowed {
+            return Err(RoutingError::NoCapableProviderEndpoint {
+                provider: provider.as_str().to_owned(),
+            });
+        }
+        let candidate = ProviderCandidate {
+            provider: provider.clone(),
+            upstream_model: None,
+            emulated_features: BTreeSet::new(),
+            account_scope: Arc::clone(&account_scope),
+        };
+        Ok(RoutingPlan {
+            config_revision: self.revision,
+            account_selection_policy: self.account_selection_policy,
+            operation: operation.kind(),
+            max_attempts: NonZeroU32::new(super::MAX_REQUEST_ATTEMPTS)
+                .expect("constant request attempt limit is non-zero"),
+            account_scope,
+            candidates: Arc::from([candidate]),
+        })
+    }
 }
 
 /// 请求级冻结失败；此状态必须 fail closed。

backend/crates/gateway-core/tests/engine/coordinator.rs

@@ -317,7 +317,10 @@ impl Provider for ScriptedProvider {
                 let candidate = request.candidate();
                 let metadata = ProviderCallMetadata::new(
                     candidate.provider().clone(),
-                    candidate.upstream_model().clone(),
+                    candidate
+                        .upstream_model()
+                        .cloned()
+                        .expect("model route candidate"),
                     ProviderResource::Account {
                         id: ProviderAccountId::new(account_id).expect("account id"),
                         revision: CredentialRevision::new(1).expect("revision"),
@@ -337,7 +340,10 @@ impl Provider for ScriptedProvider {
                 let candidate = request.candidate();
                 let metadata = ProviderCallMetadata::new(
                     candidate.provider().clone(),
-                    candidate.upstream_model().clone(),
+                    candidate
+                        .upstream_model()
+                        .cloned()
+                        .expect("model route candidate"),
                     ProviderResource::Account {
                         id: ProviderAccountId::new(account_id).expect("account id"),
                         revision: CredentialRevision::new(1).expect("revision"),
@@ -357,7 +363,10 @@ impl Provider for ScriptedProvider {
                 let candidate = request.candidate();
                 let metadata = ProviderCallMetadata::new(
                     candidate.provider().clone(),
-                    candidate.upstream_model().clone(),
+                    candidate
+                        .upstream_model()
+                        .cloned()
+                        .expect("model route candidate"),
                     ProviderResource::Account {
                         id: ProviderAccountId::new(account_id).expect("account id"),
                         revision: CredentialRevision::new(1).expect("revision"),
@@ -493,6 +502,31 @@ fn bare_atomic_response_failed(response_id: &str) -> ProviderError {
         .with_atomic_client_events(vec![failed])
 }
 
+fn atomic_history_unavailable(response_id: &str) -> ProviderError {
+    let failed = ProviderEvent::wire(
+        ProtocolWireEvent::json(
+            "openai",
+            Some("response.failed".to_owned()),
+            json!({
+                "type": "response.failed",
+                "response": {
+                    "id": response_id,
+                    "status": "failed",
+                    "error": {
+                        "code": "previous_response_not_found",
+                        "message": "Previous response was not found. Retrying the full request."
+                    }
+                }
+            }),
+        )
+        .expect("history unavailable wire"),
+    );
+    ProviderError::new(ProviderErrorKind::InvalidRequest, UpstreamSendState::Sent)
+        .with_status(400)
+        .with_continuation_failure(ContinuationFailure::HistoryUnavailable)
+        .with_atomic_client_events(vec![failed])
+}
+
 fn image_stream(image_output_tokens: Option<u64>) -> Vec<Result<GatewayEvent, ProviderError>> {
     let mut usage = Usage::new();
     usage.input_tokens = Some(12);
@@ -598,7 +632,7 @@ fn model_request(operation: &Operation, deadline: SystemTime) -> NewModelRequest
         operation: operation.kind(),
         endpoint: "responses".to_owned(),
         client_transport: "http_sse".to_owned(),
-        requested_model: PublicModelId::new("gpt-5").expect("model"),
+        requested_model: Some(PublicModelId::new("gpt-5").expect("model")),
         client_ip: Some("127.0.0.1".parse().expect("client IP")),
         user_agent: Some("gateway-core-test".to_owned()),
         reasoning_effort: Some("medium".to_owned()),
@@ -1481,7 +1515,7 @@ fn streaming_native_continuation_delivers_started_event_before_later_output() {
 }
 
 #[test]
-fn native_continuation_replays_owner_before_safely_switching_account() {
+fn native_continuation_uses_provider_defined_owner_then_cross_account_recovery() {
     let Operation::Generate(generate) = generate_operation() else {
         panic!("generate operation");
     };
@@ -1536,7 +1570,7 @@ fn native_continuation_replays_owner_before_safely_switching_account() {
         CancellationToken::new(),
     ))
     .expect("start execution");
-    block_on(session.collect_uncommitted()).expect("portable replay succeeds");
+    block_on(session.collect_uncommitted()).expect("provider-defined recovery succeeds");
     block_on(session.commit_downstream(Some(200))).expect("commit response");
 
     let contexts = provider.contexts.lock().expect("contexts lock");
@@ -1561,7 +1595,7 @@ fn native_continuation_replays_owner_before_safely_switching_account() {
 }
 
 #[test]
-fn unavailable_native_continuation_replays_with_the_configured_account_policy() {
+fn unavailable_native_continuation_uses_provider_recovery_with_the_configured_account_policy() {
     let Operation::Generate(generate) = generate_operation() else {
         panic!("generate operation");
     };
@@ -1602,7 +1636,7 @@ fn unavailable_native_continuation_replays_with_the_configured_account_policy()
         CancellationToken::new(),
     ))
     .expect("start execution");
-    block_on(session.collect_uncommitted()).expect("portable replay succeeds");
+    block_on(session.collect_uncommitted()).expect("provider-defined recovery succeeds");
     block_on(session.commit_downstream(Some(200))).expect("commit response");
 
     let contexts = provider.contexts.lock().expect("contexts lock");
@@ -1625,6 +1659,76 @@ fn unavailable_native_continuation_replays_with_the_configured_account_policy()
     assert_eq!(state.finalizations[0].outcome, ExecutionOutcome::Succeeded);
 }
 
+#[test]
+fn continuation_history_failure_without_replay_proof_is_delivered_without_hidden_retry() {
+    let Operation::Generate(generate) = generate_operation() else {
+        panic!("generate operation");
+    };
+    let operation = Operation::Generate(generate.with_provider_session_state(
+        ProviderSessionState::new("openai", Map::new()).expect("provider session state"),
+    ));
+    let route_plan = plan(&operation);
+    let (coordinator, _, provider) = coordinator(vec![
+        Script::ObservedStream {
+            account_id: "acct_one",
+            items: vec![Err(atomic_history_unavailable("response-history-missing"))],
+        },
+        Script::Stream {
+            account_id: "acct_two",
+            items: complete_stream(None),
+        },
+    ]);
+    let continuation = NativeContinuationPin::new(
+        PreviousResponseId::new("previous-response"),
+        PreviousResponseId::new("upstream-response"),
+        ClientApiKeyId::new("key_client_1").expect("client key"),
+        ProviderKind::new("openai").expect("provider"),
+        ProviderAccountId::new("acct_one").expect("account"),
+    );
+    let mut session = block_on(coordinator.start(
+        model_request(&operation, SystemTime::now() + Duration::from_secs(30)),
+        operation,
+        route_plan,
+        None,
+        Some(ContinuationBinding::Pinned(continuation)),
+        CancellationToken::new(),
+    ))
+    .expect("start execution");
+
+    let terminal = block_on(session.next_event())
+        .expect("history failure remains deliverable")
+        .expect("terminal history failure batch");
+    assert_eq!(
+        terminal.commit_requirement(),
+        CommitRequirement::CommitBeforeDelivery
+    );
+    let events = terminal.into_provider_events();
+    let failure = events
+        .iter()
+        .filter_map(ProviderEvent::wire_event)
+        .find(|wire| wire.event_type() == Some("response.failed"))
+        .expect("raw response.failed event");
+    assert_eq!(
+        failure
+            .data()
+            .pointer("/response/error/code")
+            .and_then(Value::as_str),
+        Some("previous_response_not_found")
+    );
+    block_on(session.commit_downstream(Some(200))).expect("commit terminal history failure");
+    assert!(matches!(
+        block_on(session.next_event()),
+        Err(EngineError::Provider(_))
+    ));
+
+    let contexts = provider.contexts.lock().expect("contexts lock");
+    assert_eq!(contexts.len(), 1);
+    assert_eq!(
+        contexts[0].continuation_attempt(),
+        ContinuationAttempt::Native
+    );
+}
+
 #[test]
 fn diagnostic_account_reaches_provider_and_matching_metadata_succeeds() {
     let operation = operation(RetrySafety::Idempotent);

backend/crates/gateway-core/tests/engine/credential.rs

@@ -51,6 +51,15 @@ fn candidate(id: &str, in_flight: u32, remaining: Option<u64>) -> AccountCandida
     }
 }
 
+fn candidate_with_concurrency(id: &str, in_flight: u32, concurrency: u32) -> AccountCandidate {
+    let mut candidate = candidate(id, in_flight, Some(100));
+    candidate.account = candidate.account.with_scheduling(
+        Some(AccountConcurrencyLimit::new(concurrency).expect("concurrency override")),
+        AccountWeight::DEFAULT,
+    );
+    candidate
+}
+
 fn weighted_candidate(id: &str, weight: u16, in_flight: u32) -> AccountCandidate {
     let mut candidate = candidate(id, in_flight, None);
     candidate.account = candidate.account.with_scheduling(
@@ -348,6 +357,20 @@ fn smart_selector_should_prefer_lower_inflight_count() {
     assert_eq!(selected.candidate().account.id().as_str(), "acct_idle");
 }
 
+#[test]
+fn smart_selector_should_prefer_lower_capacity_utilization_over_lower_inflight_count() {
+    let candidates = [
+        candidate_with_concurrency("acct_smaller", 1, 2),
+        candidate_with_concurrency("acct_larger", 2, 10),
+    ];
+
+    let selected = AccountSelector
+        .select(&candidates, &context(RotationStrategy::Smart))
+        .expect("candidate available");
+
+    assert_eq!(selected.candidate().account.id().as_str(), "acct_larger");
+}
+
 #[test]
 fn selector_should_prioritize_the_highest_weight_for_every_rotation_strategy() {
     let candidates = vec![
@@ -622,6 +645,22 @@ fn quota_reset_selector_should_prefer_known_earliest_window() {
     assert_eq!(selected.candidate().account.id().as_str(), "acct_earlier");
 }
 
+#[test]
+fn quota_reset_selector_should_use_capacity_utilization_as_load_tiebreaker() {
+    let reset_at = SystemTime::now() + Duration::from_secs(60);
+    let mut smaller = candidate_with_concurrency("acct_smaller", 1, 2);
+    smaller.signals.quota_reset_at = Some(reset_at);
+    let mut larger = candidate_with_concurrency("acct_larger", 2, 10);
+    larger.signals.quota_reset_at = Some(reset_at);
+    let candidates = [smaller, larger];
+
+    let selected = AccountSelector
+        .select(&candidates, &context(RotationStrategy::QuotaResetPriority))
+        .expect("candidate available");
+
+    assert_eq!(selected.candidate().account.id().as_str(), "acct_larger");
+}
+
 #[test]
 fn smart_selector_should_prefer_known_quota_over_unknown_after_load_is_equal() {
     let candidates = vec![

backend/crates/gateway-core/tests/engine/execution.rs

@@ -18,17 +18,17 @@ use gateway_core::engine::continuation::{
     NativeContinuationPin, NativeContinuationPort, NativeContinuationStoreError, PreviousResponseId,
 };
 use gateway_core::engine::credential::{
-    AccountSelectionPolicy, ProviderAccountId, RotationStrategy,
+    AccountSelectionPolicy, CredentialRevision, ProviderAccountId, RotationStrategy,
 };
 use gateway_core::engine::execution::{
     ClientApiKeyUsageSink, ClientTransport, DefaultExecutionService, ExecutionRequestMetadata,
     ExecutionService, ProviderCircuitDecision, ProviderCircuitError, ProviderCircuitPort,
-    StartExecution, provider_failure_affects_circuit,
+    StartExecution, StartProviderExecution, provider_failure_affects_circuit,
 };
 use gateway_core::engine::probe::{AccountProbe, AccountProbeRequest};
 use gateway_core::engine::provider::{
-    Provider, ProviderCatalogGeneration, ProviderModelCapabilities, ProviderRegistry,
-    ProviderRequest, ProviderStream,
+    Provider, ProviderCallMetadata, ProviderCatalogGeneration, ProviderModelCapabilities,
+    ProviderRegistry, ProviderRequest, ProviderResource, ProviderStream, UpstreamTransport,
 };
 use gateway_core::engine::{
     AttemptContext, AttemptRecord, ExecutionStore, IntermediateFailure, ModelRequestFinalization,
@@ -38,7 +38,10 @@ use gateway_core::error::{
     ClientVisibleUpstreamResponse, GatewayErrorKind, ProviderError, ProviderErrorKind, StoreError,
     StoreErrorKind,
 };
-use gateway_core::operation::{GenerateRequest, Operation, OperationKind, ProtocolPayload};
+use gateway_core::operation::{
+    GenerateRequest, ImageRequest, ImageRequestKind, Operation, OperationKind, ProtocolPayload,
+    RawJsonPayload,
+};
 use gateway_core::policy::{ClientApiKeyId, ClientPolicy, PlaintextClientApiKey, RateLimits};
 use gateway_core::routing::snapshot::RuntimeSnapshotHandle;
 use gateway_core::routing::{
@@ -193,6 +196,50 @@ impl Provider for FailingProvider {
     }
 }
 
+struct ColdFailingProvider;
+
+#[async_trait]
+impl Provider for ColdFailingProvider {
+    fn name(&self) -> &'static str {
+        "openai"
+    }
+
+    fn catalog_generation(&self) -> ProviderCatalogGeneration {
+        ProviderCatalogGeneration::default()
+    }
+
+    async fn query_model_capabilities(
+        &self,
+    ) -> Result<Vec<ProviderModelCapabilities>, ProviderError> {
+        Ok(Vec::new())
+    }
+
+    async fn execute(
+        &self,
+        request: ProviderRequest,
+        _: AttemptContext,
+    ) -> Result<ProviderStream, ProviderError> {
+        let metadata = ProviderCallMetadata::for_provider_endpoint(
+            request.candidate().provider().clone(),
+            ProviderResource::Account {
+                id: ProviderAccountId::new("acct_usage").expect("account"),
+                revision: CredentialRevision::new(1).expect("revision"),
+            },
+            UpstreamTransport::new("http_json").expect("transport"),
+        );
+        Ok(ProviderStream::new(
+            metadata,
+            futures::stream::once(async {
+                Err(ProviderError::new(
+                    ProviderErrorKind::Transport,
+                    UpstreamSendState::NotSent,
+                ))
+            }),
+            (),
+        ))
+    }
+}
+
 #[test]
 fn successful_authentication_should_record_client_key_usage() {
     let usage = Arc::new(RecordingClientApiKeyUsage::default());
@@ -213,6 +260,60 @@ fn successful_authentication_should_record_client_key_usage() {
     assert_eq!(usage.recorded(), vec!["key_usage_test".to_owned()]);
 }
 
+#[test]
+fn provider_endpoint_should_persist_its_real_v1_endpoint() {
+    let store = Arc::new(TrackingExecutionStore::default());
+    let service = DefaultExecutionService::new(
+        RuntimeSnapshotHandle::new(client_snapshot()),
+        store.clone(),
+        ProviderRegistry::new([Arc::new(ColdFailingProvider) as Arc<dyn Provider>])
+            .expect("provider registry"),
+        Arc::new(UnusedAdmissions),
+        Arc::new(UnusedCircuits),
+        Arc::new(UnusedContinuation),
+        Arc::new(RecordingClientApiKeyUsage::default()),
+    );
+    let client = service
+        .authenticate("sk_usage_test")
+        .expect("authenticated client");
+    let operation = Operation::GenerateImage(ImageRequest::from_raw_json(
+        ImageRequestKind::Generation,
+        RawJsonPayload::new(
+            "openai",
+            Bytes::from_static(br#"{"model":"gpt-image-2","prompt":"hello"}"#),
+        )
+        .expect("image payload"),
+    ));
+
+    let mut started = block_on(service.start_provider_endpoint(StartProviderExecution {
+        client,
+        provider: ProviderKind::new("openai").expect("provider"),
+        operation,
+        metadata: ExecutionRequestMetadata {
+            protocol: "openai".to_owned(),
+            endpoint: "/v1/images/generations".to_owned(),
+            transport: ClientTransport::HttpJson,
+            stream: false,
+            client_ip: None,
+            user_agent: None,
+            previous_response_id: None,
+        },
+    }))
+    .expect("provider endpoint request should start without a text catalog entry");
+
+    let error = block_on(started.session.collect_uncommitted())
+        .expect_err("the cold provider stops execution after persistence");
+    assert_eq!(
+        store.model_request_endpoints(),
+        vec!["/v1/images/generations".to_owned()],
+        "execution error: {error:?}"
+    );
+    assert_eq!(store.requested_models(), vec![None]);
+    let upstream_models = store.upstream_models();
+    assert!(!upstream_models.is_empty());
+    assert!(upstream_models.iter().all(Option::is_none));
+}
+
 #[test]
 fn circuit_store_failure_should_fail_open_during_request_start() {
     let service = DefaultExecutionService::new(
@@ -412,6 +513,9 @@ impl ClientApiKeyUsageSink for RecordingClientApiKeyUsage {
 struct TrackingExecutionStore {
     touched: AtomicBool,
     probe_failures: Mutex<Vec<String>>,
+    model_request_endpoints: Mutex<Vec<String>>,
+    requested_models: Mutex<Vec<Option<String>>>,
+    upstream_models: Mutex<Vec<Option<String>>>,
     fail_probe_observation: AtomicBool,
 }
 
@@ -426,17 +530,60 @@ impl TrackingExecutionStore {
             .expect("probe failures lock")
             .clone()
     }
+
+    fn model_request_endpoints(&self) -> Vec<String> {
+        self.model_request_endpoints
+            .lock()
+            .expect("model request endpoints lock")
+            .clone()
+    }
+
+    fn requested_models(&self) -> Vec<Option<String>> {
+        self.requested_models
+            .lock()
+            .expect("requested models lock")
+            .clone()
+    }
+
+    fn upstream_models(&self) -> Vec<Option<String>> {
+        self.upstream_models
+            .lock()
+            .expect("upstream models lock")
+            .clone()
+    }
 }
 
 #[async_trait]
 impl ExecutionStore for TrackingExecutionStore {
-    async fn create_model_request(&self, _: NewModelRequest) -> Result<(), StoreError> {
+    async fn create_model_request(&self, request: NewModelRequest) -> Result<(), StoreError> {
         self.touch();
+        self.requested_models
+            .lock()
+            .expect("requested models lock")
+            .push(
+                request
+                    .requested_model
+                    .as_ref()
+                    .map(|model| model.as_str().to_owned()),
+            );
+        self.model_request_endpoints
+            .lock()
+            .expect("model request endpoints lock")
+            .push(request.endpoint);
         Ok(())
     }
 
-    async fn record_attempt(&self, _: AttemptRecord) -> Result<(), StoreError> {
+    async fn record_attempt(&self, attempt: AttemptRecord) -> Result<(), StoreError> {
         self.touch();
+        self.upstream_models
+            .lock()
+            .expect("upstream models lock")
+            .push(
+                attempt
+                    .upstream_model_id
+                    .as_ref()
+                    .map(|model| model.as_str().to_owned()),
+            );
         Ok(())
     }
 

backend/crates/gateway-core/tests/event.rs

@@ -77,6 +77,17 @@ fn protocol_wire_event_should_preserve_opaque_sse_metadata() {
     assert_eq!(wire.sse_id(), Some(sse_id.as_str()));
 }
 
+#[test]
+fn protocol_wire_event_should_preserve_raw_json_body_without_parsing_it() {
+    let raw = Bytes::from_static(
+        br#"{ "created": 1, "data": [{"b64_json":"AAAA"}], "future": 9007199254740993 }"#,
+    );
+    let wire = ProtocolWireEvent::raw_json("openai", raw.clone()).expect("raw JSON event");
+
+    assert_eq!(wire.raw_json_body(), Some(&raw));
+    assert_eq!(wire.into_raw_json_body(), Some(raw));
+}
+
 #[test]
 fn validator_should_accept_started_content_delta_completed_sequence() {
     let mut validator = EventSequenceValidator::new();

backend/crates/gateway-core/tests/operation/mod.rs

@@ -1,7 +1,9 @@
+use bytes::Bytes;
 use gateway_core::error::OperationError;
 use gateway_core::operation::{
-    EmbedRequest, Feature, GenerateRequest, ImageRequest, Operation, OperationKind,
-    ProtocolPayload, ProviderSessionState, RerankRequest, RetrySafety, SpeechRequest,
+    EmbedRequest, Feature, GenerateRequest, ImageRequest, ImageRequestKind, Operation,
+    OperationKind, ProtocolPayload, ProviderSessionState, RawJsonPayload, RerankRequest,
+    RetrySafety, SpeechRequest,
 };
 use serde_json::{Map, Value, json};
 
@@ -12,6 +14,17 @@ fn generate(body: Value) -> GenerateRequest {
     )
 }
 
+fn image(kind: ImageRequestKind, body: Value) -> ImageRequest {
+    ImageRequest::from_raw_json(
+        kind,
+        RawJsonPayload::new(
+            "openai",
+            Bytes::from(serde_json::to_vec(&body).expect("image JSON")),
+        )
+        .expect("OpenAI payload"),
+    )
+}
+
 #[test]
 fn generate_request_should_keep_client_body_opaque_and_redacted() {
     let secret = "private prompt body";
@@ -113,10 +126,6 @@ fn non_generate_requests_should_reject_missing_required_fields() {
         RerankRequest::new("", vec!["document".to_owned()]).expect_err("query is required"),
         OperationError::EmptyField { field: "query" }
     );
-    assert_eq!(
-        ImageRequest::new("").expect_err("prompt is required"),
-        OperationError::EmptyField { field: "prompt" }
-    );
     assert_eq!(
         SpeechRequest::new("hello", "").expect_err("voice is required"),
         OperationError::EmptyField { field: "voice" }
@@ -132,7 +141,10 @@ fn operation_kind_and_retry_safety_should_remain_stable() {
     let rerank = Operation::Rerank(
         RerankRequest::new("query", vec!["document".to_owned()]).expect("rerank request is valid"),
     );
-    let image = Operation::GenerateImage(ImageRequest::new("draw").expect("image request"));
+    let image = Operation::GenerateImage(image(
+        ImageRequestKind::Generation,
+        json!({"model": "gpt-image-2", "prompt": "draw"}),
+    ));
     let speech = Operation::Speech(SpeechRequest::new("hello", "alloy").expect("speech request"));
 
     assert_eq!(generate.kind(), OperationKind::Generate);
@@ -140,5 +152,35 @@ fn operation_kind_and_retry_safety_should_remain_stable() {
     assert_eq!(embed.retry_safety(), RetrySafety::Idempotent);
     assert_eq!(rerank.retry_safety(), RetrySafety::Idempotent);
     assert_eq!(image.kind(), OperationKind::GenerateImage);
+    assert!(image.image_generation_requested());
     assert_eq!(speech.kind(), OperationKind::Speech);
 }
+
+#[test]
+fn image_request_should_preserve_generation_and_edit_payloads_opaque() {
+    let generation_body = json!({
+        "model": "gpt-image-2",
+        "prompt": "draw",
+        "future_official_field": {"keep": true},
+    });
+    let edit_body = json!({
+        "model": "gpt-image-2",
+        "images": [{"image_url": "data:image/png;base64,AAAA"}],
+        "prompt": "edit",
+        "future_official_field": [1, 2, 3],
+    });
+    let generation = image(ImageRequestKind::Generation, generation_body.clone());
+    let edit = image(ImageRequestKind::Edit, edit_body.clone());
+
+    assert_eq!(generation.kind(), ImageRequestKind::Generation);
+    assert_eq!(edit.kind(), ImageRequestKind::Edit);
+    assert_eq!(
+        serde_json::from_slice::<Value>(generation.payload().body()).expect("generation JSON"),
+        generation_body
+    );
+    assert_eq!(
+        serde_json::from_slice::<Value>(edit.payload().body()).expect("edit JSON"),
+        edit_body
+    );
+    assert!(!format!("{edit:?}").contains("data:image/png"));
+}

backend/crates/gateway-core/tests/routing/mod.rs

@@ -3,11 +3,13 @@ use std::num::NonZeroU32;
 use std::sync::Arc;
 use std::time::Duration;
 
+use bytes::Bytes;
 use gateway_core::engine::credential::{
     AccountSelectionPolicy, ProviderAccountId, RotationStrategy,
 };
 use gateway_core::operation::{
-    CapabilityRequirements, Feature, GenerateRequest, Operation, OperationKind, ProtocolPayload,
+    CapabilityRequirements, Feature, GenerateRequest, ImageRequest, ImageRequestKind, Operation,
+    OperationKind, ProtocolPayload, RawJsonPayload,
 };
 use gateway_core::policy::{ClientApiKeyId, ClientPolicy, PlaintextClientApiKey, RateLimits};
 use gateway_core::routing::{
@@ -50,6 +52,21 @@ fn operation() -> Operation {
     ))
 }
 
+fn image_operation() -> Operation {
+    let body = serde_json::json!({
+        "model": "gpt-image-2",
+        "prompt": "draw",
+    });
+    Operation::GenerateImage(ImageRequest::from_raw_json(
+        ImageRequestKind::Generation,
+        RawJsonPayload::new(
+            "openai",
+            Bytes::from(serde_json::to_vec(&body).expect("image JSON")),
+        )
+        .expect("OpenAI payload"),
+    ))
+}
+
 fn account_directory() -> Arc<RuntimeAccountDirectory> {
     Arc::new(RuntimeAccountDirectory::new(BTreeMap::from([
         (
@@ -267,7 +284,13 @@ fn selected_provider_should_use_global_model_mapping() {
 
     assert_eq!(plan.candidates().len(), 1);
     assert_eq!(plan.candidates()[0].provider().as_str(), "openai");
-    assert_eq!(plan.candidates()[0].upstream_model().as_str(), "gpt-5.5");
+    assert_eq!(
+        plan.candidates()[0]
+            .upstream_model()
+            .expect("model route candidate")
+            .as_str(),
+        "gpt-5.5"
+    );
 }
 
 #[test]
@@ -311,6 +334,51 @@ fn known_provider_catalog_missing_mapped_model_should_be_filtered() {
     ));
 }
 
+#[test]
+fn provider_endpoint_plan_should_not_consult_or_publish_the_text_model_catalog() {
+    let snapshot = snapshot();
+    let provider = ProviderKind::new("openai").expect("provider");
+    let public_model = PublicModelId::new("gpt-image-2").expect("model");
+
+    assert!(!snapshot.contains_public_model_for_provider(&public_model, &provider));
+    let plan = snapshot
+        .plan_provider_endpoint(
+            &provider,
+            &image_operation(),
+            snapshot.all_account_scope(),
+            &RoutingContext::default(),
+        )
+        .expect("provider-owned endpoint remains routable");
+
+    assert_eq!(plan.operation(), OperationKind::GenerateImage);
+    assert_eq!(plan.candidates().len(), 1);
+    assert_eq!(plan.candidates()[0].provider(), &provider);
+    assert_eq!(plan.candidates()[0].upstream_model(), None);
+    assert!(!snapshot.contains_public_model_for_provider(&public_model, &provider));
+}
+
+#[test]
+fn provider_endpoint_plan_should_still_respect_circuit_filtering() {
+    let snapshot = snapshot();
+    let provider = ProviderKind::new("openai").expect("provider");
+    let error = snapshot
+        .plan_provider_endpoint(
+            &provider,
+            &image_operation(),
+            snapshot.all_account_scope(),
+            &RoutingContext {
+                blocked_providers: BTreeSet::from([provider.clone()]),
+                ..RoutingContext::default()
+            },
+        )
+        .expect_err("blocked provider has no endpoint candidate");
+
+    assert!(matches!(
+        error,
+        gateway_core::error::RoutingError::NoCapableProviderEndpoint { .. }
+    ));
+}
+
 #[test]
 fn unmapped_model_should_pass_through_unchanged() {
     let snapshot = RuntimeSnapshot::new(
@@ -340,7 +408,13 @@ fn unmapped_model_should_pass_through_unchanged() {
             )
             .expect("unknown model remains transparent");
 
-        assert_eq!(plan.candidates()[0].upstream_model().as_str(), requested);
+        assert_eq!(
+            plan.candidates()[0]
+                .upstream_model()
+                .expect("model route candidate")
+                .as_str(),
+            requested
+        );
     }
 }
 

backend/crates/gateway-host/src/config.rs

@@ -41,6 +41,7 @@ pub fn load_config<T: LoadableConfig>() -> Result<T, ConfigError> {
 #[serde(deny_unknown_fields)]
 pub struct HostConfig {
     pub listen: ListenConfig,
+    pub runtime_data_dir: PathBuf,
     pub logging: LoggingConfig,
     #[serde(default)]
     pub system_update: SystemUpdateConfig,
@@ -76,11 +77,21 @@ impl HostConfig {
                 "host.worker_shutdown_timeout_seconds",
             ));
         }
+        if self.runtime_data_dir.as_os_str().is_empty() {
+            return Err(ConfigError::InvalidField("host.runtime_data_dir"));
+        }
+        resolve_relative_path(source_dir, &mut self.runtime_data_dir);
         self.logging.resolve_and_validate(source_dir)?;
-        self.system_update.resolve_and_validate(source_dir)?;
+        self.system_update
+            .resolve_and_validate(source_dir, &self.runtime_data_dir)?;
         Ok(())
     }
 
+    #[must_use]
+    pub fn runtime_data_dir(&self) -> &Path {
+        &self.runtime_data_dir
+    }
+
     #[must_use]
     pub const fn drain_timeout(&self) -> Duration {
         Duration::from_secs(self.drain_timeout_seconds)

backend/crates/gateway-host/src/system_update/mod.rs

@@ -81,10 +81,10 @@ impl Default for SystemUpdateConfig {
             });
         let update_state_file = environment_value("CPR_UPDATE_STATE_FILE")
             .map(PathBuf::from)
-            .unwrap_or_else(|| PathBuf::from("/app/.runtime/data/update-state.json"));
+            .unwrap_or_else(|| PathBuf::from("update-state.json"));
         let update_lock_file = environment_value("CPR_UPDATE_LOCK_FILE")
             .map(PathBuf::from)
-            .unwrap_or_else(|| update_state_file.with_extension("lock"));
+            .unwrap_or_else(|| update_state_file.with_file_name("update.lock"));
         let update_temp_dir = environment_value("CPR_UPDATE_TEMP_DIR")
             .map(PathBuf::from)
             .unwrap_or_else(|| state::default_temp_dir(&update_state_file));
@@ -120,21 +120,28 @@ impl Default for SystemUpdateConfig {
 }
 
 impl SystemUpdateConfig {
-    pub(crate) fn resolve_and_validate(&mut self, source_dir: &Path) -> Result<(), ConfigError> {
-        for path in [
-            self.executable_path.as_mut(),
-            Some(&mut self.web_dist_dir),
-            Some(&mut self.update_state_file),
-            Some(&mut self.update_lock_file),
-            Some(&mut self.update_temp_dir),
-        ]
-        .into_iter()
-        .flatten()
+    pub(crate) fn resolve_and_validate(
+        &mut self,
+        source_dir: &Path,
+        runtime_data_dir: &Path,
+    ) -> Result<(), ConfigError> {
+        for path in [self.executable_path.as_mut(), Some(&mut self.web_dist_dir)]
+            .into_iter()
+            .flatten()
         {
             if path.is_relative() {
                 *path = source_dir.join(&*path);
             }
         }
+        for path in [
+            &mut self.update_state_file,
+            &mut self.update_lock_file,
+            &mut self.update_temp_dir,
+        ] {
+            if path.is_relative() {
+                *path = runtime_data_dir.join(&*path);
+            }
+        }
         if self.version.trim().is_empty() {
             return Err(ConfigError::InvalidField("host.system_update.version"));
         }

backend/crates/gateway-host/tests/config.rs

@@ -34,6 +34,40 @@ fn host_config_resolves_only_host_owned_relative_paths() {
     );
 }
 
+#[test]
+fn host_config_resolves_runtime_data_dir_relative_to_configuration() {
+    let mut config = valid_config();
+    config
+        .resolve_and_validate(std::path::Path::new("/srv/gateway"))
+        .expect("valid host config");
+
+    assert_eq!(
+        config.runtime_data_dir(),
+        PathBuf::from("/srv/gateway/runtime-data")
+    );
+}
+
+#[test]
+fn host_config_derives_update_paths_from_runtime_data_dir() {
+    let mut config = valid_config();
+    config
+        .resolve_and_validate(std::path::Path::new("/srv/gateway"))
+        .expect("valid host config");
+
+    assert_eq!(
+        (
+            config.system_update.update_state_file,
+            config.system_update.update_lock_file,
+            config.system_update.update_temp_dir,
+        ),
+        (
+            PathBuf::from("/srv/gateway/runtime-data/update-state.json"),
+            PathBuf::from("/srv/gateway/runtime-data/update.lock"),
+            PathBuf::from("/srv/gateway/runtime-data/update-tmp"),
+        )
+    );
+}
+
 #[test]
 fn host_config_rejects_zero_drain_window() {
     let mut config = valid_config();
@@ -48,9 +82,9 @@ fn host_config_rejects_zero_drain_window() {
 
 fn valid_config() -> HostConfig {
     let system_update = SystemUpdateConfig {
-        update_state_file: PathBuf::from(".runtime/update-state.json"),
-        update_lock_file: PathBuf::from(".runtime/update-state.lock"),
-        update_temp_dir: PathBuf::from(".runtime/update-tmp"),
+        update_state_file: PathBuf::from("update-state.json"),
+        update_lock_file: PathBuf::from("update.lock"),
+        update_temp_dir: PathBuf::from("update-tmp"),
         ..SystemUpdateConfig::default()
     };
     HostConfig {
@@ -58,6 +92,7 @@ fn valid_config() -> HostConfig {
             host: "127.0.0.1".to_owned(),
             port: 8080,
         },
+        runtime_data_dir: PathBuf::from("runtime-data"),
         logging: LoggingConfig {
             level: "info".to_owned(),
             stdout: true,

backend/crates/gateway-host/tests/logging.rs

@@ -23,6 +23,7 @@ fn logging_requires_at_least_one_sink() {
             host: "127.0.0.1".to_owned(),
             port: 8080,
         },
+        runtime_data_dir: PathBuf::from("/tmp/runtime-data"),
         logging: LoggingConfig {
             level: "info".to_owned(),
             stdout: false,
@@ -98,6 +99,7 @@ fn write_oauth_recovery_log(directory: PathBuf) {
             host: "127.0.0.1".to_owned(),
             port: 8080,
         },
+        runtime_data_dir: PathBuf::from("/tmp/runtime-data"),
         logging: LoggingConfig {
             level: "off".to_owned(),
             stdout: false,

backend/crates/gateway-protocol/src/openai/events.rs

@@ -208,11 +208,24 @@ pub struct RateLimitWindow {
     pub reset_at: Option<i64>,
 }
 
+/// 限流项键的来源。
+///
+/// HTTP headers 和事件里的 `metered_limit_name` 提供稳定 `limit_id`；
+/// WebSocket `additional_rate_limits` 在部分协议版本里只以可读名称为 map key，
+/// 此时必须由持久化层用既有名称元数据解析，不能把名称误当成稳定 ID。
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum RateLimitKeySource {
+    LimitId,
+    LimitName,
+}
+
 /// 单个计量项的限流信息。
 #[derive(Debug, Clone, PartialEq)]
 pub struct RateLimitDetails {
     /// 稳定的计量项 ID。
     pub limit_id: String,
+    /// [`limit_id`](Self::limit_id) 是稳定 ID，还是名称生成的临时解析键。
+    pub key_source: RateLimitKeySource,
     /// 上游提供的可读名称。
     pub limit_name: Option<String>,
     /// 当前请求是否被允许。
@@ -341,20 +354,40 @@ pub fn parse_rate_limits_event(value: &Value) -> Option<ParsedRateLimits> {
         return None;
     }
 
-    let limit_id = rate_limit_name(value)
-        .map(normalize_limit_id)
+    let explicit_limit_id = top_level_rate_limit_id(value).map(normalize_limit_id);
+    let explicit_limit_name = non_empty_string(value, "limit_name");
+    let default_limit_id = explicit_limit_id
+        .clone()
         .unwrap_or_else(|| "codex".to_string());
-    let limit_name = value
-        .get("metered_limit_name")
-        .and_then(Value::as_str)
-        .and_then(|_| value.get("limit_name"))
-        .and_then(Value::as_str)
-        .map(str::trim)
-        .filter(|name| !name.is_empty())
-        .map(ToString::to_string);
-    let details = value
-        .get("rate_limits")
-        .and_then(|details| parse_details_from_object(details, &limit_id, limit_name));
+    let default_details = value.get("rate_limits").and_then(|details| {
+        parse_details_from_object(
+            details,
+            &default_limit_id,
+            explicit_limit_name,
+            RateLimitKeySource::LimitId,
+        )
+    });
+    let mut limits = parse_additional_rate_limits(value);
+    let matching_additional_ids = default_details
+        .as_ref()
+        .map(|default| {
+            limits
+                .iter()
+                .filter(|(_, additional)| same_rate_limit_facts(default, additional))
+                .map(|(limit_id, _)| limit_id.clone())
+                .collect::<Vec<_>>()
+        })
+        .unwrap_or_default();
+
+    // 当前 WebSocket 协议会把活动具名桶同时镜像到顶层 `rate_limits`，但不附
+    // `metered_limit_name`。只要 additional 中存在相同事实，顶层就不是 core 桶。
+    let default_is_additional_alias =
+        explicit_limit_id.is_none() && !matching_additional_ids.is_empty();
+    if let Some(details) = default_details
+        && !default_is_additional_alias
+    {
+        limits.insert(default_limit_id.clone(), details);
+    }
     let credits = value.get("credits").and_then(parse_credits_from_object);
     let plan_type = value
         .get("plan_type")
@@ -363,17 +396,18 @@ pub fn parse_rate_limits_event(value: &Value) -> Option<ParsedRateLimits> {
         .filter(|plan| !plan.is_empty())
         .map(ToString::to_string);
 
-    if details.is_none() && credits.is_none() && plan_type.is_none() {
+    if limits.is_empty() && credits.is_none() && plan_type.is_none() {
         return None;
     }
 
-    let mut limits = BTreeMap::new();
-    if let Some(details) = details {
-        limits.insert(limit_id.clone(), details);
-    }
+    let active_limit = explicit_limit_id.or_else(|| match matching_additional_ids.as_slice() {
+        [limit_id] => Some(limit_id.clone()),
+        [] if !limits.is_empty() => Some(default_limit_id),
+        _ => None,
+    });
     Some(ParsedRateLimits {
         limits,
-        active_limit: Some(limit_id),
+        active_limit,
         credits,
         plan_type,
         promo_message: value
@@ -597,6 +631,7 @@ fn parse_details_from_lookup(
     }
     Some(RateLimitDetails {
         limit_id: limit_id.to_string(),
+        key_source: RateLimitKeySource::LimitId,
         limit_name,
         allowed,
         limit_reached,
@@ -687,6 +722,7 @@ fn parse_details_from_object(
     value: &Value,
     limit_id: &str,
     limit_name: Option<String>,
+    key_source: RateLimitKeySource,
 ) -> Option<RateLimitDetails> {
     let primary = value.get("primary").and_then(parse_window_from_object);
     let secondary = value.get("secondary").and_then(parse_window_from_object);
@@ -697,6 +733,7 @@ fn parse_details_from_object(
     }
     Some(RateLimitDetails {
         limit_id: limit_id.to_string(),
+        key_source,
         limit_name,
         allowed,
         limit_reached,
@@ -752,11 +789,59 @@ fn value_as_positive_i64(value: &Value) -> Option<i64> {
         .filter(|value| *value > 0)
 }
 
-fn rate_limit_name(value: &Value) -> Option<&str> {
+fn rate_limit_id(value: &Value) -> Option<&str> {
     value
         .get("metered_limit_name")
-        .or_else(|| value.get("limit_name"))
+        .or_else(|| value.get("limit_id"))
         .and_then(Value::as_str)
+        .map(str::trim)
+        .filter(|value| !value.is_empty())
+}
+
+fn top_level_rate_limit_id(value: &Value) -> Option<&str> {
+    rate_limit_id(value).or_else(|| {
+        value
+            .get("limit_name")
+            .and_then(Value::as_str)
+            .map(str::trim)
+            .filter(|value| !value.is_empty())
+    })
+}
+
+fn non_empty_string(value: &Value, field: &str) -> Option<String> {
+    value
+        .get(field)
+        .and_then(Value::as_str)
+        .map(str::trim)
+        .filter(|value| !value.is_empty())
+        .map(ToString::to_string)
+}
+
+fn parse_additional_rate_limits(value: &Value) -> BTreeMap<String, RateLimitDetails> {
+    value
+        .get("additional_rate_limits")
+        .and_then(Value::as_object)
+        .into_iter()
+        .flatten()
+        .filter_map(|(map_key, value)| {
+            let explicit_limit_id = rate_limit_id(value).map(normalize_limit_id);
+            let (limit_id, key_source) = explicit_limit_id.map_or_else(
+                || (normalize_limit_id(map_key), RateLimitKeySource::LimitName),
+                |limit_id| (limit_id, RateLimitKeySource::LimitId),
+            );
+            let limit_name = non_empty_string(value, "limit_name")
+                .or_else(|| Some(map_key.trim().to_owned()).filter(|name| !name.is_empty()));
+            parse_details_from_object(value, &limit_id, limit_name, key_source)
+                .map(|details| (limit_id, details))
+        })
+        .collect()
+}
+
+fn same_rate_limit_facts(left: &RateLimitDetails, right: &RateLimitDetails) -> bool {
+    left.allowed == right.allowed
+        && left.limit_reached == right.limit_reached
+        && left.primary == right.primary
+        && left.secondary == right.secondary
 }
 
 fn normalize_limit_id(value: impl AsRef<str>) -> String {

backend/crates/gateway-protocol/src/openai/sse.rs

@@ -70,7 +70,7 @@ pub const MAX_SSE_EVENT_BUFFER_BYTES: usize = 64 * 1024 * 1024;
 pub const DONE_SSE_FRAME: &str = "data: [DONE]\n\n";
 
 /// 用于处理任意分块边界的增量 SSE 解码器。
-#[derive(Debug, Default)]
+#[derive(Debug)]
 pub struct SseEventDecoder {
     pending: Vec<u8>,
     /// `pending` 中已确认不含帧分隔符的前缀长度。新数据到达时从该边界
@@ -79,6 +79,19 @@ pub struct SseEventDecoder {
     /// 超大未完成帧已开始直接交付；在遇到帧分隔符前只保留跨 chunk 扫描尾部，
     /// 不再尝试解析该帧。
     opaque_frame: bool,
+    /// 只有整个 SSE 流的第一条物理行允许携带 UTF-8 BOM。
+    stream_start: bool,
+}
+
+impl Default for SseEventDecoder {
+    fn default() -> Self {
+        Self {
+            pending: Vec::new(),
+            scanned: 0,
+            opaque_frame: false,
+            stream_start: true,
+        }
+    }
 }
 
 impl SseEventDecoder {
@@ -115,7 +128,8 @@ impl SseEventDecoder {
         while let Some(end) = self.next_frame_end(consumed) {
             let frame = std::str::from_utf8(&self.pending[consumed..end])
                 .map_err(|error| SseError::ParseError(error.to_string()))?;
-            events.extend(parse_sse_events(frame)?);
+            events.extend(parse_sse_events_inner(frame, self.stream_start)?);
+            self.stream_start = false;
             consumed = end;
         }
 
@@ -149,9 +163,10 @@ impl SseEventDecoder {
             } else {
                 std::str::from_utf8(&raw)
                     .ok()
-                    .and_then(|frame| parse_sse_events(frame).ok())
+                    .and_then(|frame| parse_sse_events_inner(frame, self.stream_start).ok())
                     .unwrap_or_default()
             };
+            self.stream_start = false;
             frames.push(SseFrame::new(raw, events));
             consumed = end;
         }
@@ -173,7 +188,9 @@ impl SseEventDecoder {
         let pending = std::mem::take(&mut self.pending);
         let frame = std::str::from_utf8(&pending)
             .map_err(|error| SseError::ParseError(error.to_string()))?;
-        parse_sse_events(frame)
+        let events = parse_sse_events_inner(frame, self.stream_start)?;
+        self.stream_start = false;
+        Ok(events)
     }
 
     /// 在流结束时返回未带空行分隔符的最后一帧及其旁路解析结果。
@@ -191,9 +208,10 @@ impl SseEventDecoder {
         } else {
             std::str::from_utf8(&raw)
                 .ok()
-                .and_then(|frame| parse_sse_events(frame).ok())
+                .and_then(|frame| parse_sse_events_inner(frame, self.stream_start).ok())
                 .unwrap_or_default()
         };
+        self.stream_start = false;
         self.opaque_frame = false;
         vec![SseFrame::new(raw, events)]
     }
@@ -207,6 +225,7 @@ impl SseEventDecoder {
         let remaining = self.pending.split_off(end);
         let raw = std::mem::replace(&mut self.pending, remaining);
         frames.push(SseFrame::new(raw, Vec::new()));
+        self.stream_start = false;
         self.opaque_frame = false;
         self.scanned = 0;
         true
@@ -226,6 +245,7 @@ impl SseEventDecoder {
         let raw = std::mem::replace(&mut self.pending, tail);
         self.scanned = 0;
         frames.push(SseFrame::new(raw, Vec::new()));
+        self.stream_start = false;
     }
 }
 
@@ -351,12 +371,21 @@ impl EventBuilder {
 
 /// 解析 SSE 事件流。
 pub fn parse_sse_events(input: &str) -> Result<Vec<SseEvent>, SseError> {
+    parse_sse_events_inner(input, true)
+}
+
+fn parse_sse_events_inner(input: &str, strip_leading_bom: bool) -> Result<Vec<SseEvent>, SseError> {
     let mut events = Vec::new();
     let mut builder = EventBuilder::default();
     let mut saw_sse_syntax = false;
     let mut event_buffer_bytes = 0usize;
 
-    for raw_line in input.lines() {
+    for (index, raw_line) in input.lines().enumerate() {
+        let raw_line = if strip_leading_bom && index == 0 {
+            raw_line.strip_prefix('\u{feff}').unwrap_or(raw_line)
+        } else {
+            raw_line
+        };
         let line = raw_line.strip_suffix('\r').unwrap_or(raw_line);
         if line.is_empty() {
             event_buffer_bytes = 0;

backend/crates/gateway-protocol/tests/openai/events.rs

@@ -1,7 +1,7 @@
 use gateway_protocol::openai::events::{
-    RateLimitWindow, TokenUsage, extract_sse_usage, extract_usage, is_codex_quota_header_name,
-    is_rate_limit_header_name, parse_rate_limit_headers, parse_rate_limits_event,
-    rate_limits_to_header_pairs, retry_after_seconds_from_body,
+    RateLimitKeySource, RateLimitWindow, TokenUsage, extract_sse_usage, extract_usage,
+    is_codex_quota_header_name, is_rate_limit_header_name, parse_rate_limit_headers,
+    parse_rate_limits_event, rate_limits_to_header_pairs, retry_after_seconds_from_body,
 };
 use serde_json::json;
 
@@ -483,6 +483,58 @@ fn parse_rate_limits_event_should_extract_websocket_metered_limit() {
     );
 }
 
+#[test]
+fn parse_rate_limits_event_should_preserve_name_keyed_additional_limit() {
+    let event = json!({
+        "type": "codex.rate_limits",
+        "plan_type": "pro",
+        "rate_limits": {
+            "allowed": true,
+            "limit_reached": false,
+            "primary": {
+                "used_percent": 0,
+                "window_minutes": 10080,
+                "reset_after_seconds": 354916,
+                "reset_at": 1787396838
+            },
+            "secondary": null
+        },
+        "additional_rate_limits": {
+            "GPT-5.3-Codex-Spark": {
+                "allowed": true,
+                "limit_reached": false,
+                "primary": {
+                    "used_percent": 0,
+                    "window_minutes": 10080,
+                    "reset_after_seconds": 354916,
+                    "reset_at": 1787396838
+                },
+                "secondary": null
+            }
+        },
+        "credits": null
+    });
+
+    let parsed = parse_rate_limits_event(&event).expect("rate-limit event");
+    let details = parsed
+        .limits
+        .get("gpt_5.3_codex_spark")
+        .expect("name-keyed additional limit");
+
+    assert_eq!(parsed.active_limit.as_deref(), Some("gpt_5.3_codex_spark"));
+    assert_eq!(details.key_source, RateLimitKeySource::LimitName);
+    assert_eq!(details.limit_name.as_deref(), Some("GPT-5.3-Codex-Spark"));
+    assert_eq!(
+        details.primary,
+        Some(RateLimitWindow {
+            used_percent: 0.0,
+            window_minutes: Some(10080),
+            reset_at: Some(1787396838),
+        })
+    );
+    assert!(!parsed.limits.contains_key("codex"));
+}
+
 #[test]
 fn parse_rate_limits_event_should_reject_unrelated_event_type() {
     for event in [

backend/crates/gateway-protocol/tests/openai/sse.rs

@@ -31,6 +31,50 @@ fn parser_should_preserve_multiline_data_id_and_retry() {
     );
 }
 
+#[test]
+fn parser_should_ignore_a_leading_utf8_bom() {
+    let input = concat!(
+        "\u{feff}event: response.created\n",
+        "data: {\"type\":\"response.created\"}\n\n",
+    );
+
+    assert_eq!(
+        parse_sse_events(input).expect("SSE with BOM"),
+        vec![SseEvent {
+            event: Some("response.created".to_owned()),
+            data: "{\"type\":\"response.created\"}".to_owned(),
+            id: None,
+            retry: None,
+        }]
+    );
+}
+
+#[test]
+fn incremental_decoder_should_ignore_bom_only_at_the_stream_start() {
+    let mut decoder = SseEventDecoder::default();
+    let first = decoder
+        .push(
+            concat!(
+                "\u{feff}event: response.created\n",
+                "data: {\"type\":\"response.created\"}\n\n",
+            )
+            .as_bytes(),
+        )
+        .expect("first SSE frame");
+    let second = decoder
+        .push(
+            concat!(
+                "\u{feff}event: response.completed\n",
+                "data: {\"type\":\"response.completed\"}\n\n",
+            )
+            .as_bytes(),
+        )
+        .expect("second SSE frame");
+
+    assert_eq!(first[0].event.as_deref(), Some("response.created"));
+    assert_eq!(second[0].event, None);
+}
+
 #[test]
 fn parser_should_ignore_done_control_frame() {
     assert!(

backend/crates/gateway-store/src/bundle.rs

@@ -50,7 +50,7 @@ impl StoreBundle {
 pub async fn initialize(mut config: StoreConfig) -> StoreResult<StoreBundle> {
     const REDIS_NAMESPACE: &str = "codex-proxy-rs";
 
-    config.resolve_and_validate(std::path::Path::new("."))?;
+    config.validate_resolved()?;
     let pool = postgres::connect_and_migrate(&config.database_url()?, config.pool).await?;
     let redis_client = ::redis::Client::open(config.redis_url()?)
         .map_err(|_| redis_unavailable("create Redis client"))?;
@@ -79,6 +79,10 @@ pub async fn initialize(mut config: StoreConfig) -> StoreResult<StoreBundle> {
         redis_connection.clone(),
         REDIS_NAMESPACE,
     )?);
+    let artifact_profiles = Arc::new(redis::RedisProviderArtifactProfileRepository::new(
+        redis_connection.clone(),
+        REDIS_NAMESPACE,
+    )?);
     let runtime_policy = Arc::new(postgres::PgRuntimeSettingsRepository::new(pool.clone()));
     let oauth_pending = Arc::new(redis::RedisOAuthPendingFlowRepository::new(
         redis_connection.clone(),
@@ -167,6 +171,7 @@ pub async fn initialize(mut config: StoreConfig) -> StoreResult<StoreBundle> {
             REDIS_NAMESPACE,
         )?),
         credential_state.clone(),
+        artifact_profiles,
         credential_state,
         cooldowns,
         runtime_policy,
@@ -204,7 +209,7 @@ pub(crate) fn backup_ports(
     config: &StoreConfig,
 ) -> StoreResult<BackupStorePorts> {
     let staging = Arc::new(backup::staging::StagingArea::open(
-        std::path::PathBuf::from(".runtime/data/backup-staging"),
+        config.backup_staging_dir().to_path_buf(),
         backup::staging::DEFAULT_MAX_ARCHIVE_BYTES,
     )?);
     let repository = Arc::new(postgres::PgBackupRepository::new(pool));

backend/crates/gateway-store/src/config.rs

@@ -1,5 +1,7 @@
 //! Store 启动配置、环境变量解析与校验。
 
+use std::path::{Path, PathBuf};
+
 use super::*;
 
 pub(crate) const DATABASE_URL_ENV: &str = "CPR_DATABASE_URL";
@@ -15,6 +17,8 @@ pub struct StoreConfig {
     pub(crate) redis: StoreConnectionConfig,
     #[serde(default)]
     pub(crate) pool: StorePoolConfig,
+    #[serde(skip)]
+    backup_staging_dir: PathBuf,
 }
 
 /// PostgreSQL 连接池预算；acquire 超时决定池耗尽时快速失败而非排队积压。
@@ -47,7 +51,18 @@ impl StorePoolConfig {
 }
 
 impl StoreConfig {
-    pub fn resolve_and_validate(&mut self, _source_dir: &std::path::Path) -> StoreResult<()> {
+    pub fn resolve_and_validate(&mut self, runtime_data_dir: &Path) -> StoreResult<()> {
+        if runtime_data_dir.as_os_str().is_empty() {
+            return Err(StoreError::InvalidData {
+                entity: "store config",
+                message: "runtime_data_dir must not be empty".to_owned(),
+            });
+        }
+        self.backup_staging_dir = runtime_data_dir.join("backup-staging");
+        self.validate_resolved()
+    }
+
+    pub(crate) fn validate_resolved(&mut self) -> StoreResult<()> {
         if let Some(url) = optional_environment_value(DATABASE_URL_ENV)? {
             self.database.url = url;
         }
@@ -63,6 +78,12 @@ impl StoreConfig {
         self.database.validate("database")?;
         self.redis.validate("redis")?;
         self.pool.validate()?;
+        if self.backup_staging_dir.as_os_str().is_empty() {
+            return Err(StoreError::InvalidData {
+                entity: "store config",
+                message: "runtime_data_dir was not resolved".to_owned(),
+            });
+        }
         Ok(())
     }
 
@@ -73,6 +94,12 @@ impl StoreConfig {
     pub(crate) fn redis_url(&self) -> StoreResult<String> {
         self.redis.connection_url("redis")
     }
+
+    /// 返回由统一运行数据根目录派生的备份暂存目录。
+    #[must_use]
+    pub fn backup_staging_dir(&self) -> &Path {
+        &self.backup_staging_dir
+    }
 }
 
 pub(crate) fn optional_environment_value(name: &'static str) -> StoreResult<Option<String>> {

backend/crates/gateway-store/src/lib.rs

@@ -1,6 +1,6 @@
 //! 多 Provider 网关的 PostgreSQL 持久化与 Redis 协调 adapter。
 //!
-//! 业务规则与 port 由 `gateway-core` 拥有。本 crate 只负责把终态的七张业务表
+//! 业务规则与 port 由 `gateway-core` / `gateway-admin` 拥有。本 crate 只负责把当前十二张业务表
 //! 和可丢失 Redis 状态映射为明确的基础设施操作。
 
 use std::sync::Arc;

backend/crates/gateway-store/src/postgres/execution.rs

@@ -91,7 +91,7 @@ pub struct NewModelRequest {
     pub operation: String,
     pub endpoint: String,
     pub client_transport: String,
-    pub requested_model_id: String,
+    pub requested_model_id: Option<String>,
     pub client_ip: Option<String>,
     pub user_agent: Option<String>,
     pub reasoning_effort: Option<String>,
@@ -112,7 +112,9 @@ impl NewModelRequest {
         require_nonempty(ENTITY, "operation", &self.operation)?;
         require_nonempty(ENTITY, "endpoint", &self.endpoint)?;
         require_nonempty(ENTITY, "client_transport", &self.client_transport)?;
-        require_nonempty(ENTITY, "requested_model_id", &self.requested_model_id)?;
+        if let Some(requested_model_id) = self.requested_model_id.as_deref() {
+            require_nonempty(ENTITY, "requested_model_id", requested_model_id)?;
+        }
         validate_routing_snapshot(
             &self.routing_scope,
             &self.routing_group_refs,
@@ -141,7 +143,7 @@ pub struct ModelRequestAttemptStart {
     pub provider_kind: String,
     pub provider_account_id: Option<String>,
     pub provider_account_ref: Option<String>,
-    pub upstream_model_id: String,
+    pub upstream_model_id: Option<String>,
     pub upstream_transport: String,
     pub http_version: Option<String>,
 }
@@ -151,11 +153,13 @@ impl ModelRequestAttemptStart {
         for (field, value) in [
             ("model_request_id", self.model_request_id.as_str()),
             ("provider_kind", self.provider_kind.as_str()),
-            ("upstream_model_id", self.upstream_model_id.as_str()),
             ("upstream_transport", self.upstream_transport.as_str()),
         ] {
             require_nonempty(ENTITY, field, value)?;
         }
+        if let Some(upstream_model_id) = self.upstream_model_id.as_deref() {
+            require_nonempty(ENTITY, "upstream_model_id", upstream_model_id)?;
+        }
         if self.attempt_count == 0 {
             return Err(invalid("attempt_count must be positive"));
         }
@@ -841,7 +845,10 @@ impl ExecutionStore for PgExecutionStore {
                 provider_kind: Some(failure.provider_kind.as_str().to_owned()),
                 provider_account_id: failure.account_id.as_ref().map(|id| id.as_str().to_owned()),
                 provider_account_ref: failure.account_id.as_ref().map(|id| id.as_str().to_owned()),
-                upstream_model_id: Some(failure.upstream_model_id.as_str().to_owned()),
+                upstream_model_id: failure
+                    .upstream_model_id
+                    .as_ref()
+                    .map(|model| model.as_str().to_owned()),
                 failure_kind: error.kind().as_str().to_owned(),
                 status_code: error.upstream_status().or(failure.upstream_status_code),
                 provider_error_code: error.upstream_code().map(|code| code.as_str().to_owned()),
@@ -1081,7 +1088,9 @@ fn new_model_request_row(request: CoreNewModelRequest) -> NewModelRequest {
         operation: request.operation.as_str().to_owned(),
         endpoint: request.endpoint,
         client_transport: request.client_transport,
-        requested_model_id: request.requested_model.as_str().to_owned(),
+        requested_model_id: request
+            .requested_model
+            .map(|model| model.as_str().to_owned()),
         client_ip: request.client_ip.map(|address| address.to_string()),
         user_agent: request.user_agent,
         reasoning_effort: request.reasoning_effort,
@@ -1150,7 +1159,9 @@ fn attempt_start_row(attempt: CoreAttemptRecord) -> ModelRequestAttemptStart {
             .provider_account_ref
             .as_ref()
             .map(|id| id.as_str().to_owned()),
-        upstream_model_id: attempt.upstream_model_id.as_str().to_owned(),
+        upstream_model_id: attempt
+            .upstream_model_id
+            .map(|model| model.as_str().to_owned()),
         upstream_transport: attempt.upstream_transport,
         http_version: attempt.http_version,
     }

backend/crates/gateway-store/src/postgres/execution_buffer.rs

@@ -551,7 +551,10 @@ impl ExecutionObservationWrite {
                 Some(failure.request_id.as_str()),
                 Some(failure.provider_kind.as_str()),
                 failure.account_id.as_ref().map(|value| value.as_str()),
-                Some(failure.upstream_model_id.as_str()),
+                failure
+                    .upstream_model_id
+                    .as_ref()
+                    .map(|model| model.as_str()),
                 failure.upstream_request_id.as_deref(),
             ])
             .saturating_add(provider_error_bytes(&failure.error)),
@@ -638,7 +641,7 @@ fn new_request_bytes(request: &NewModelRequest) -> usize {
         Some(request.protocol.as_str()),
         Some(request.endpoint.as_str()),
         Some(request.client_transport.as_str()),
-        Some(request.requested_model.as_str()),
+        request.requested_model.as_ref().map(|model| model.as_str()),
         request.user_agent.as_deref(),
         request.reasoning_effort.as_deref(),
         request.reasoning_preset.as_deref(),
@@ -659,7 +662,10 @@ fn attempt_bytes(attempt: &AttemptRecord) -> usize {
             .provider_account_ref
             .as_ref()
             .map(|value| value.as_str()),
-        Some(attempt.upstream_model_id.as_str()),
+        attempt
+            .upstream_model_id
+            .as_ref()
+            .map(|model| model.as_str()),
         Some(attempt.upstream_transport.as_str()),
         attempt.http_version.as_deref(),
     ]))

backend/crates/gateway-store/src/postgres/mod.rs

@@ -1,4 +1,4 @@
-//! 九张终态业务表的 PostgreSQL adapters。
+//! 当前十二张业务表的 PostgreSQL adapters。
 
 use async_trait::async_trait;
 use sqlx::{PgPool, postgres::PgPoolOptions};

backend/crates/gateway-store/src/postgres/observability/model.rs

@@ -504,7 +504,7 @@ pub struct UsageRecord {
     pub operation: String,
     pub endpoint: String,
     pub client_transport: String,
-    pub requested_model_id: String,
+    pub requested_model_id: Option<String>,
     pub provider_kind: Option<String>,
     pub provider_account_ref: Option<String>,
     pub provider_account_name: Option<String>,

backend/crates/gateway-store/src/postgres/observability/queries/accounts.rs

@@ -259,6 +259,7 @@ pub(crate) async fn account_model_rows(
            and mr.outcome = 'succeeded'
            and mr.downstream_committed_at is not null
            and mr.client_status_code between 200 and 399
+           and coalesce(mr.upstream_model_id, mr.requested_model_id) is not null
          group by mr.provider_account_ref, coalesce(mr.upstream_model_id, mr.requested_model_id)
          order by mr.provider_account_ref, request_count desc, model",
     )
@@ -286,6 +287,7 @@ pub(crate) async fn account_model_costs(
            and mr.downstream_committed_at is not null
            and mr.client_status_code between 200 and 399
            and mr.cost_amount is not null and mr.cost_currency is not null
+           and coalesce(mr.upstream_model_id, mr.requested_model_id) is not null
          group by mr.provider_account_ref, coalesce(mr.upstream_model_id, mr.requested_model_id),
                   mr.cost_currency
          order by mr.provider_account_ref, model, mr.cost_currency",

backend/crates/gateway-store/src/postgres/provider_accounts/admin_adapter.rs

@@ -97,13 +97,19 @@ impl PgAdminAccountStore {
             .iter()
             .map(|window| window.account_id.clone())
             .collect::<Vec<_>>();
-        let (usage_rows, model_rows, model_cost_rows) = futures::try_join!(
+        let (usage_rows, cost_rows, model_rows, model_cost_rows) = futures::try_join!(
             sqlx::query(ACCOUNT_USAGE_BY_WINDOWS_SQL)
                 .bind(account_ids.clone())
                 .bind(keys.clone())
                 .bind(starts.clone())
                 .bind(ends.clone())
                 .fetch_all(&self.pool),
+            sqlx::query(ACCOUNT_USAGE_COSTS_BY_WINDOWS_SQL)
+                .bind(account_ids.clone())
+                .bind(keys.clone())
+                .bind(starts.clone())
+                .bind(ends.clone())
+                .fetch_all(&self.pool),
             sqlx::query(ACCOUNT_USAGE_MODELS_BY_WINDOWS_SQL)
                 .bind(account_ids.clone())
                 .bind(keys.clone())
@@ -123,6 +129,11 @@ impl PgAdminAccountStore {
                 postgres_unavailable("load provider account quota window usage"),
             )
         })?;
+        let mut costs_by_window = BTreeMap::<(String, String), Vec<AccountCost>>::new();
+        for row in &cost_rows {
+            let (key, cost) = admin_account_usage_window_cost(row)?;
+            costs_by_window.entry(key).or_default().push(cost);
+        }
         let mut model_costs = BTreeMap::<(String, String, String), Vec<AccountCost>>::new();
         for row in &model_cost_rows {
             let (key, cost) = admin_account_usage_window_model_cost(row)?;
@@ -145,6 +156,9 @@ impl PgAdminAccountStore {
             .map(admin_account_usage_window)
             .collect::<AdminStoreResult<Vec<_>>>()?;
         for result in &mut results {
+            result.usage.costs = costs_by_window
+                .remove(&(result.account_id.clone(), result.key.clone()))
+                .unwrap_or_default();
             result.usage.models = models_by_window
                 .remove(&(result.account_id.clone(), result.key.clone()))
                 .unwrap_or_default();
@@ -682,8 +696,10 @@ impl AccountStore for PgAdminAccountStore {
     ) -> AdminStoreResult<CredentialMutationResult> {
         match command.credential {
             AuthorizationCredentialCommit::Create(credential) => {
-                let account_id = credential.account_id.clone();
-                let result = self
+                let CredentialImportResult {
+                    config_revision,
+                    credential_ids,
+                } = self
                     .commit_prepared_import(
                         PreparedCredentialImport {
                             provider_kind: credential.provider_kind.clone(),
@@ -693,6 +709,14 @@ impl AccountStore for PgAdminAccountStore {
                         "authorize",
                     )
                     .await?;
+                let [account_id]: [CoreProviderAccountId; 1] =
+                    credential_ids.try_into().map_err(|_| {
+                        AdminStoreError::new(
+                            AdminStoreErrorKind::Unavailable,
+                            ENTITY,
+                            "authorization import returned an unexpected account count",
+                        )
+                    })?;
                 let details = self
                     .accounts
                     .load_provider_account(account_id.as_str())
@@ -706,7 +730,7 @@ impl AccountStore for PgAdminAccountStore {
                         )
                     })?;
                 Ok(CredentialMutationResult {
-                    config_revision: result.config_revision,
+                    config_revision,
                     account_id,
                     credential_revision: Some(admin_revision(details.summary.credential_revision)?),
                 })

backend/crates/gateway-store/src/postgres/provider_accounts/core_adapter.rs

@@ -103,7 +103,7 @@ impl ProviderAccountStore for PgProviderAccountRepository {
         &self,
         update: CredentialCasUpdate,
     ) -> Result<CredentialCasOutcome, CoreStoreError> {
-        let (
+        let CredentialCasUpdateParts {
             account_id,
             expected_revision,
             profile,
@@ -111,7 +111,8 @@ impl ProviderAccountStore for PgProviderAccountRepository {
             has_refresh_token,
             access_token_expires_at,
             next_refresh_at,
-        ) = update.into_parts();
+            account_state,
+        } = update.into_parts();
         if profile.account_id != account_id {
             return Err(CoreStoreError::new(CoreStoreErrorKind::InvalidData));
         }
@@ -122,13 +123,38 @@ impl ProviderAccountStore for PgProviderAccountRepository {
             CREDENTIALS_MAX_BYTES,
         )
         .map_err(core_store_error)?;
+        let credential_state = account_state
+            .as_ref()
+            .map(|state| state.credential_state.as_str());
+        let credential_observed_at = account_state
+            .as_ref()
+            .map(|state| DateTime::<Utc>::from(state.observed_at));
+        let error_reason = account_state
+            .as_ref()
+            .and_then(|state| state.error_reason.map(AccountErrorReason::as_str));
+        let message = account_state
+            .as_ref()
+            .and_then(|state| state.message.as_deref());
         let next = sqlx::query_scalar::<_, i64>(
             "update provider_accounts
              set name = $3, email = $4, plan_type = $5,
                  provider_credentials_json = $6,
                  credential_revision = credential_revision + 1,
                  has_refresh_token = $7, access_token_expires_at = $8,
-                 next_refresh_at = $9, updated_at = now()
+                 next_refresh_at = $9,
+                 credential_state = case
+                   when $10::text is not null and enabled and upstream_user_id is not null
+                   then $10 else credential_state end,
+                 credential_observed_at = case
+                   when $10::text is not null and enabled and upstream_user_id is not null
+                   then $11 else credential_observed_at end,
+                 last_error_reason = case
+                   when $10::text is not null and enabled and upstream_user_id is not null
+                   then $12 else last_error_reason end,
+                 last_error_message = case
+                   when $10::text is not null and enabled and upstream_user_id is not null
+                   then $13 else last_error_message end,
+                 updated_at = greatest(now(), coalesce($11, now()))
              where id = $1 and credential_revision = $2
              returning credential_revision",
         )
@@ -141,6 +167,10 @@ impl ProviderAccountStore for PgProviderAccountRepository {
         .bind(has_refresh_token)
         .bind(access_token_expires_at.map(DateTime::<Utc>::from))
         .bind(next_refresh_at.map(DateTime::<Utc>::from))
+        .bind(credential_state)
+        .bind(credential_observed_at)
+        .bind(error_reason)
+        .bind(message)
         .fetch_optional(&self.pool)
         .await
         .map_err(|_| CoreStoreError::new(CoreStoreErrorKind::Unavailable))?;
@@ -280,6 +310,25 @@ impl ProviderAccountStore for PgProviderAccountRepository {
         })
     }
 
+    async fn touch_quota_observation(
+        &self,
+        touch: QuotaObservationTouch,
+    ) -> Result<QuotaWriteOutcome, CoreStoreError> {
+        let updated = self
+            .touch_provider_quota_observation(
+                touch.account_id.as_str(),
+                Revision::new(touch.expected_revision.get()).map_err(core_store_error)?,
+                DateTime::<Utc>::from(touch.observed_at),
+            )
+            .await
+            .map_err(core_store_error)?;
+        Ok(if updated {
+            QuotaWriteOutcome::Updated
+        } else {
+            QuotaWriteOutcome::Conflict
+        })
+    }
+
     async fn apply_state_change(&self, change: AccountStateChange) -> Result<(), CoreStoreError> {
         let updated = self
             .apply_provider_account_state(ProviderAccountStateUpdate {

backend/crates/gateway-store/src/postgres/provider_accounts/mapping.rs

@@ -339,6 +339,30 @@ pub(crate) fn admin_account_usage_window_model_cost(
     ))
 }
 
+pub(crate) fn admin_account_usage_window_cost(
+    row: &sqlx::postgres::PgRow,
+) -> AdminStoreResult<((String, String), AccountCost)> {
+    let key = (
+        window_usage_value(row, "account_id")?,
+        window_usage_value(row, "window_key")?,
+    );
+    let amount = window_usage_value::<String>(row, "amount")?;
+    let amount = AdminDecimalAmount::from_str(&amount).map_err(|_| {
+        AdminStoreError::new(
+            AdminStoreErrorKind::Invalid,
+            ENTITY,
+            "persisted account cost is invalid",
+        )
+    })?;
+    Ok((
+        key,
+        AccountCost {
+            currency: window_usage_value(row, "cost_currency")?,
+            amount,
+        },
+    ))
+}
+
 pub(crate) fn window_usage_count(
     row: &sqlx::postgres::PgRow,
     column: &'static str,

backend/crates/gateway-store/src/postgres/provider_accounts/mod.rs

@@ -38,12 +38,13 @@ use sqlx::{PgPool, Postgres, Row, Transaction};
 
 use gateway_core::engine::credential::{
     AccountConcurrencyLimit, AccountErrorReason, AccountStateChange, AccountWeight,
-    CredentialCasOutcome, CredentialCasUpdate, CredentialRevision as CoreCredentialRevision,
-    CredentialState, LoadedCredential, NewProviderAccount as CoreNewProviderAccount,
-    OpaqueProviderData, PlaintextCredential, ProviderAccount as CoreProviderAccount,
-    ProviderAccountId as CoreProviderAccountId, ProviderAccountIdentity, ProviderAccountStore,
+    CredentialCasOutcome, CredentialCasUpdate, CredentialCasUpdateParts,
+    CredentialRevision as CoreCredentialRevision, CredentialState, LoadedCredential,
+    NewProviderAccount as CoreNewProviderAccount, OpaqueProviderData, PlaintextCredential,
+    ProviderAccount as CoreProviderAccount, ProviderAccountId as CoreProviderAccountId,
+    ProviderAccountIdentity, ProviderAccountStore,
     ProviderAccountUpdate as CoreProviderAccountUpdate, QuotaAccessChange, QuotaAccessState,
-    QuotaEvidence, QuotaObservation, QuotaState, QuotaWriteOutcome,
+    QuotaEvidence, QuotaObservation, QuotaObservationTouch, QuotaState, QuotaWriteOutcome,
 };
 use gateway_core::error::{StoreError as CoreStoreError, StoreErrorKind as CoreStoreErrorKind};
 use gateway_core::routing::{AccountGroupId, ProviderKind};

backend/crates/gateway-store/src/postgres/provider_accounts/repository.rs

@@ -29,6 +29,12 @@ pub trait ProviderAccountRepository: Send + Sync {
         observed_at: DateTime<Utc>,
         state: QuotaState,
     ) -> StoreResult<bool>;
+    async fn touch_provider_quota_observation(
+        &self,
+        account_id: &str,
+        expected_revision: Revision,
+        observed_at: DateTime<Utc>,
+    ) -> StoreResult<bool>;
     async fn apply_provider_quota_access(
         &self,
         account_id: &str,
@@ -237,13 +243,11 @@ impl ProviderAccountRepository for PgProviderAccountRepository {
                      else credential_observed_at
                  end,
                  last_error_reason = case
-                     when enabled and upstream_user_id is not null then
-                         case when $3 = 'ready' then null else $5 end
+                     when enabled and upstream_user_id is not null then $5
                      else last_error_reason
                  end,
                  last_error_message = case
-                     when enabled and upstream_user_id is not null then
-                         case when $3 = 'ready' then null else $6 end
+                     when enabled and upstream_user_id is not null then $6
                      else last_error_message
                  end,
                  updated_at = case when enabled then greatest(now(), $4) else updated_at end
@@ -354,6 +358,29 @@ impl ProviderAccountRepository for PgProviderAccountRepository {
         Ok(result.rows_affected() == 1)
     }
 
+    async fn touch_provider_quota_observation(
+        &self,
+        account_id: &str,
+        expected_revision: Revision,
+        observed_at: DateTime<Utc>,
+    ) -> StoreResult<bool> {
+        require_nonempty(ENTITY, "account_id", account_id)?;
+        let result = sqlx::query(
+            "update provider_accounts
+             set quota_observed_at = $3, updated_at = greatest(now(), $3)
+             where id = $1 and credential_revision = $2
+               and provider_quota_json is not null
+               and (quota_observed_at is null or quota_observed_at <= $3)",
+        )
+        .bind(account_id)
+        .bind(to_i64(expected_revision.get())?)
+        .bind(observed_at)
+        .execute(&self.pool)
+        .await
+        .map_err(|_| postgres_unavailable("touch provider quota observation"))?;
+        Ok(result.rows_affected() == 1)
+    }
+
     async fn delete_provider_account(&self, id: &str) -> StoreResult<bool> {
         require_nonempty(ENTITY, "id", id)?;
         let result = sqlx::query("delete from provider_accounts where id = $1 and not enabled")

backend/crates/gateway-store/src/postgres/provider_accounts/rows.rs

@@ -51,6 +51,28 @@ pub(crate) const ACCOUNT_USAGE_BY_WINDOWS_SQL: &str = "with requested_windows as
       group by requested.account_id, requested.window_key
       order by requested.account_id, requested.window_key";
 
+pub(crate) const ACCOUNT_USAGE_COSTS_BY_WINDOWS_SQL: &str = "with requested_windows as (
+         select *
+         from unnest($1::text[], $2::text[], $3::timestamptz[], $4::timestamptz[])
+           as requested(account_id, window_key, window_start, window_end)
+     )
+     select requested.account_id,
+            requested.window_key,
+            mr.cost_currency,
+            sum(mr.cost_amount)::text as amount
+       from requested_windows requested
+       join model_requests mr
+         on mr.provider_account_ref = requested.account_id
+        and mr.started_at >= requested.window_start
+        and mr.started_at < requested.window_end
+        and mr.outcome = 'succeeded'
+        and mr.downstream_committed_at is not null
+        and mr.client_status_code between 200 and 399
+        and mr.cost_amount is not null
+        and mr.cost_currency is not null
+      group by requested.account_id, requested.window_key, mr.cost_currency
+      order by requested.account_id, requested.window_key, mr.cost_currency";
+
 pub(crate) const ACCOUNT_USAGE_MODELS_BY_WINDOWS_SQL: &str = "with requested_windows as (
          select *
          from unnest($1::text[], $2::text[], $3::timestamptz[], $4::timestamptz[])
@@ -91,6 +113,7 @@ pub(crate) const ACCOUNT_USAGE_MODELS_BY_WINDOWS_SQL: &str = "with requested_win
         and mr.outcome = 'succeeded'
         and mr.downstream_committed_at is not null
         and mr.client_status_code between 200 and 399
+        and coalesce(mr.upstream_model_id, mr.requested_model_id) is not null
       group by requested.account_id, requested.window_key,
                coalesce(mr.upstream_model_id, mr.requested_model_id)
       order by requested.account_id, requested.window_key, request_count desc, model";
@@ -115,6 +138,7 @@ pub(crate) const ACCOUNT_USAGE_MODEL_COSTS_BY_WINDOWS_SQL: &str = "with requeste
         and mr.client_status_code between 200 and 399
         and mr.cost_amount is not null
         and mr.cost_currency is not null
+        and coalesce(mr.upstream_model_id, mr.requested_model_id) is not null
       group by requested.account_id, requested.window_key,
                coalesce(mr.upstream_model_id, mr.requested_model_id), mr.cost_currency
       order by requested.account_id, requested.window_key, model, mr.cost_currency";

backend/crates/gateway-store/src/redis/artifact_profile.rs

@@ -0,0 +1,175 @@
+//! Provider 官方制品画像的单键 Redis cache。
+
+use std::time::{Duration, SystemTime};
+
+use gateway_core::engine::credential::OpaqueProviderData;
+use gateway_core::provider_ports::{
+    ProviderArtifactProfile, ProviderArtifactProfileCachePort, ProviderStoreError,
+    ProviderStoreErrorKind,
+};
+use gateway_core::routing::ProviderKind;
+use redis::{Script, aio::ConnectionManager};
+
+use crate::StoreResult;
+
+use super::{MAX_REDIS_EXACT_INTEGER, namespace};
+
+const MAX_PROFILE_BYTES: usize = 16 * 1024;
+
+const REPLACE_SCRIPT: &str = r#"
+local current_sequence = redis.call('HGET', KEYS[1], 'artifact_sequence')
+if current_sequence then
+  local current_number = tonumber(current_sequence)
+  local candidate_number = tonumber(ARGV[1])
+  if current_number > candidate_number then return 0 end
+  if current_number == candidate_number then
+    local current_profile = redis.call('HGET', KEYS[1], 'profile')
+    if current_profile ~= ARGV[3] then return -1 end
+  end
+end
+redis.call('HSET', KEYS[1],
+  'artifact_sequence', ARGV[1],
+  'verified_at_ms', ARGV[2],
+  'profile', ARGV[3])
+redis.call('PEXPIRE', KEYS[1], ARGV[4])
+return 1
+"#;
+
+/// 每个 Provider 只占一个覆盖写 key；TTL 负责进程长期停机后的最终清理。
+#[derive(Clone)]
+pub struct RedisProviderArtifactProfileRepository {
+    connection: ConnectionManager,
+    namespace: String,
+}
+
+impl RedisProviderArtifactProfileRepository {
+    pub fn new(connection: ConnectionManager, key_namespace: &str) -> StoreResult<Self> {
+        Ok(Self {
+            connection,
+            namespace: namespace(key_namespace)?,
+        })
+    }
+
+    fn key(&self, provider_kind: &ProviderKind) -> String {
+        format!(
+            "{}:provider:{}:artifact-profile:v1",
+            self.namespace,
+            provider_kind.as_str()
+        )
+    }
+}
+
+impl ProviderArtifactProfileCachePort for RedisProviderArtifactProfileRepository {
+    fn replace_if_newer(
+        &self,
+        profile: ProviderArtifactProfile,
+        ttl: Duration,
+    ) -> futures::future::BoxFuture<'_, Result<bool, ProviderStoreError>> {
+        Box::pin(async move {
+            let artifact_sequence = profile.artifact_sequence();
+            if artifact_sequence == 0 || artifact_sequence > MAX_REDIS_EXACT_INTEGER {
+                return Err(provider_invalid("validate artifact profile sequence"));
+            }
+            let ttl_ms = exact_positive_millis(ttl, "validate artifact profile TTL")?;
+            let verified_at_ms = profile
+                .verified_at()
+                .duration_since(SystemTime::UNIX_EPOCH)
+                .ok()
+                .and_then(|duration| u64::try_from(duration.as_millis()).ok())
+                .filter(|millis| *millis <= MAX_REDIS_EXACT_INTEGER)
+                .ok_or_else(|| provider_invalid("validate artifact profile timestamp"))?;
+            let payload = serde_json::to_vec(&serde_json::Value::Object(
+                profile.profile().expose_to_provider().clone(),
+            ))
+            .map_err(|_| provider_invalid("encode artifact profile"))?;
+            if payload.len() > MAX_PROFILE_BYTES {
+                return Err(provider_invalid("validate artifact profile size"));
+            }
+
+            let mut connection = self.connection.clone();
+            let outcome = Script::new(REPLACE_SCRIPT)
+                .key(self.key(profile.provider_kind()))
+                .arg(artifact_sequence)
+                .arg(verified_at_ms)
+                .arg(payload)
+                .arg(ttl_ms)
+                .invoke_async::<i64>(&mut connection)
+                .await
+                .map_err(|_| provider_unavailable("replace artifact profile"))?;
+            match outcome {
+                1 => Ok(true),
+                0 => Ok(false),
+                -1 => Err(ProviderStoreError::new(
+                    ProviderStoreErrorKind::Conflict,
+                    "replace artifact profile",
+                )),
+                _ => Err(provider_invalid("decode artifact profile write outcome")),
+            }
+        })
+    }
+
+    fn read<'a>(
+        &'a self,
+        provider_kind: &'a ProviderKind,
+    ) -> futures::future::BoxFuture<'a, Result<Option<ProviderArtifactProfile>, ProviderStoreError>>
+    {
+        Box::pin(async move {
+            let mut connection = self.connection.clone();
+            let values: (Option<u64>, Option<u64>, Option<Vec<u8>>) = redis::cmd("HMGET")
+                .arg(self.key(provider_kind))
+                .arg("artifact_sequence")
+                .arg("verified_at_ms")
+                .arg("profile")
+                .query_async(&mut connection)
+                .await
+                .map_err(|_| provider_unavailable("read artifact profile"))?;
+            let (artifact_sequence, verified_at_ms, payload) = values;
+            if artifact_sequence.is_none() && verified_at_ms.is_none() && payload.is_none() {
+                return Ok(None);
+            }
+            let (Some(artifact_sequence), Some(verified_at_ms), Some(payload)) =
+                (artifact_sequence, verified_at_ms, payload)
+            else {
+                return Err(provider_invalid("decode artifact profile"));
+            };
+            if artifact_sequence == 0 || artifact_sequence > MAX_REDIS_EXACT_INTEGER {
+                return Err(provider_invalid("decode artifact profile sequence"));
+            }
+            if payload.len() > MAX_PROFILE_BYTES {
+                return Err(provider_invalid("decode artifact profile size"));
+            }
+            let serde_json::Value::Object(fields) = serde_json::from_slice(&payload)
+                .map_err(|_| provider_invalid("decode artifact profile"))?
+            else {
+                return Err(provider_invalid("decode artifact profile"));
+            };
+            let verified_at = SystemTime::UNIX_EPOCH
+                .checked_add(Duration::from_millis(verified_at_ms))
+                .ok_or_else(|| provider_invalid("decode artifact profile timestamp"))?;
+            Ok(Some(ProviderArtifactProfile::new(
+                provider_kind.clone(),
+                artifact_sequence,
+                verified_at,
+                OpaqueProviderData::new(fields),
+            )))
+        })
+    }
+}
+
+fn exact_positive_millis(
+    duration: Duration,
+    operation: &'static str,
+) -> Result<u64, ProviderStoreError> {
+    u64::try_from(duration.as_millis())
+        .ok()
+        .filter(|millis| *millis > 0 && *millis <= MAX_REDIS_EXACT_INTEGER)
+        .ok_or_else(|| provider_invalid(operation))
+}
+
+fn provider_unavailable(operation: &'static str) -> ProviderStoreError {
+    ProviderStoreError::new(ProviderStoreErrorKind::Unavailable, operation)
+}
+
+fn provider_invalid(operation: &'static str) -> ProviderStoreError {
+    ProviderStoreError::new(ProviderStoreErrorKind::InvalidData, operation)
+}

backend/crates/gateway-store/src/redis/mod.rs

@@ -7,6 +7,7 @@ use sha2::{Digest, Sha256};
 
 use async_trait::async_trait;
 
+mod artifact_profile;
 mod client_admission;
 mod coordination_buffer;
 mod credential_cooldown;
@@ -20,6 +21,7 @@ mod provider_session_exclusion;
 mod runtime_change;
 pub(crate) mod worker_lease;
 
+pub use artifact_profile::*;
 pub use client_admission::*;
 pub use coordination_buffer::*;
 pub use credential_cooldown::*;

backend/crates/gateway-store/src/redis/provider_session_affinity.rs

@@ -16,6 +16,24 @@ use super::{namespace, resource_fingerprint};
 
 const MAX_SESSION_AFFINITY_TTL: Duration = Duration::from_secs(24 * 60 * 60);
 
+const CLAIM_OR_LOAD_SCRIPT: &str = r#"
+local current = redis.call('GET', KEYS[1])
+if current then
+  return current
+end
+redis.call('PSETEX', KEYS[1], tonumber(ARGV[2]), ARGV[1])
+return ARGV[1]
+"#;
+
+const COMPARE_AND_BIND_SCRIPT: &str = r#"
+local current = redis.call('GET', KEYS[1])
+if not current or current == ARGV[1] then
+  redis.call('PSETEX', KEYS[1], tonumber(ARGV[3]), ARGV[2])
+  return ARGV[2]
+end
+return current
+"#;
+
 #[derive(Clone)]
 pub struct RedisProviderSessionAffinityRepository {
     connection: ConnectionManager,
@@ -79,11 +97,7 @@ impl ProviderSessionAffinityPort for RedisProviderSessionAffinityRepository {
         ttl: Duration,
     ) -> futures::future::BoxFuture<'a, Result<(), ProviderStoreError>> {
         Box::pin(async move {
-            if ttl.is_zero() || ttl > MAX_SESSION_AFFINITY_TTL {
-                return Err(provider_invalid("validate provider session affinity TTL"));
-            }
-            let ttl_millis = u64::try_from(ttl.as_millis())
-                .map_err(|_| provider_invalid("validate provider session affinity TTL"))?;
+            let ttl_millis = session_affinity_ttl_millis(ttl)?;
             let mut connection = self.connection.clone();
             redis::cmd("PSETEX")
                 .arg(self.key(provider_kind, key)?)
@@ -95,6 +109,50 @@ impl ProviderSessionAffinityPort for RedisProviderSessionAffinityRepository {
         })
     }
 
+    fn claim_or_load<'a>(
+        &'a self,
+        provider_kind: &'a ProviderKind,
+        key: &'a ProviderSessionAffinityKey,
+        candidate_account_id: &'a ProviderAccountId,
+        ttl: Duration,
+    ) -> futures::future::BoxFuture<'a, Result<ProviderAccountId, ProviderStoreError>> {
+        Box::pin(async move {
+            let ttl_millis = session_affinity_ttl_millis(ttl)?;
+            let mut connection = self.connection.clone();
+            let effective_account_id = redis::Script::new(CLAIM_OR_LOAD_SCRIPT)
+                .key(self.key(provider_kind, key)?)
+                .arg(candidate_account_id.as_str())
+                .arg(ttl_millis)
+                .invoke_async::<String>(&mut connection)
+                .await
+                .map_err(|_| provider_unavailable("claim provider session affinity"))?;
+            decode_account_id(effective_account_id)
+        })
+    }
+
+    fn compare_and_bind<'a>(
+        &'a self,
+        provider_kind: &'a ProviderKind,
+        key: &'a ProviderSessionAffinityKey,
+        expected_account_id: &'a ProviderAccountId,
+        replacement_account_id: &'a ProviderAccountId,
+        ttl: Duration,
+    ) -> futures::future::BoxFuture<'a, Result<ProviderAccountId, ProviderStoreError>> {
+        Box::pin(async move {
+            let ttl_millis = session_affinity_ttl_millis(ttl)?;
+            let mut connection = self.connection.clone();
+            let effective_account_id = redis::Script::new(COMPARE_AND_BIND_SCRIPT)
+                .key(self.key(provider_kind, key)?)
+                .arg(expected_account_id.as_str())
+                .arg(replacement_account_id.as_str())
+                .arg(ttl_millis)
+                .invoke_async::<String>(&mut connection)
+                .await
+                .map_err(|_| provider_unavailable("compare provider session affinity"))?;
+            decode_account_id(effective_account_id)
+        })
+    }
+
     fn clear<'a>(
         &'a self,
         provider_kind: &'a ProviderKind,
@@ -112,6 +170,19 @@ impl ProviderSessionAffinityPort for RedisProviderSessionAffinityRepository {
     }
 }
 
+fn session_affinity_ttl_millis(ttl: Duration) -> Result<u64, ProviderStoreError> {
+    if ttl.is_zero() || ttl > MAX_SESSION_AFFINITY_TTL {
+        return Err(provider_invalid("validate provider session affinity TTL"));
+    }
+    u64::try_from(ttl.as_millis())
+        .map_err(|_| provider_invalid("validate provider session affinity TTL"))
+}
+
+fn decode_account_id(account_id: String) -> Result<ProviderAccountId, ProviderStoreError> {
+    ProviderAccountId::new(account_id)
+        .map_err(|_| provider_invalid("decode provider session affinity"))
+}
+
 fn provider_unavailable(operation: &'static str) -> ProviderStoreError {
     ProviderStoreError::new(ProviderStoreErrorKind::Unavailable, operation)
 }

backend/crates/gateway-store/tests/config.rs

@@ -0,0 +1,32 @@
+use gateway_store::StoreConfig;
+
+const PASSWORD: &str = "111111111111111111111111111111111111111111111111";
+
+#[test]
+fn store_config_should_derive_backup_staging_from_runtime_data_dir() {
+    let root = tempfile::tempdir().expect("runtime data root");
+    let mut config = valid_config();
+
+    config
+        .resolve_and_validate(root.path())
+        .expect("valid Store configuration");
+
+    assert_eq!(
+        config.backup_staging_dir(),
+        root.path().join("backup-staging")
+    );
+}
+
+fn valid_config() -> StoreConfig {
+    serde_json::from_value(serde_json::json!({
+        "database": {
+            "url": "postgres://codex_proxy@127.0.0.1:5432/codex_proxy",
+            "password": PASSWORD,
+        },
+        "redis": {
+            "url": "redis://127.0.0.1:6379/",
+            "password": PASSWORD,
+        },
+    }))
+    .expect("test Store configuration")
+}

backend/crates/gateway-store/tests/main.rs

@@ -1,3 +1,4 @@
+mod config;
 mod postgres;
 mod redis;
 mod s3;

backend/crates/gateway-store/tests/postgres/execution.rs

@@ -28,7 +28,7 @@ fn model_request_rejects_mismatched_client_key_live_id() {
         operation: "responses".to_owned(),
         endpoint: "/v1/responses".to_owned(),
         client_transport: "http_sse".to_owned(),
-        requested_model_id: "coding".to_owned(),
+        requested_model_id: Some("coding".to_owned()),
         routing_scope: "all".to_owned(),
         routing_group_refs: Vec::new(),
         routing_group_names_snapshot: serde_json::json!([]),
@@ -47,7 +47,7 @@ fn model_request_rejects_mismatched_client_key_live_id() {
 }
 
 #[tokio::test]
-async fn merged_first_attempt_insert_should_match_sequential_semantics() {
+async fn merged_model_less_first_attempt_should_match_sequential_semantics() {
     let Some(database) = TestDatabase::create("execution_merged_insert").await else {
         return;
     };
@@ -75,10 +75,10 @@ async fn merged_first_attempt_insert_should_match_sequential_semantics() {
         client_api_key_ref: "key_merged".to_owned(),
         config_revision: 1,
         protocol: "openai".to_owned(),
-        operation: "responses".to_owned(),
-        endpoint: "/v1/responses".to_owned(),
-        client_transport: "http_sse".to_owned(),
-        requested_model_id: "coding".to_owned(),
+        operation: "generate_image".to_owned(),
+        endpoint: "/v1/images/generations".to_owned(),
+        client_transport: "http_json".to_owned(),
+        requested_model_id: None,
         routing_scope: "all".to_owned(),
         routing_group_refs: Vec::new(),
         routing_group_names_snapshot: serde_json::json!([]),
@@ -99,8 +99,8 @@ async fn merged_first_attempt_insert_should_match_sequential_semantics() {
         provider_kind: "openai".to_owned(),
         provider_account_id: Some("acct_merged".to_owned()),
         provider_account_ref: Some("acct_merged".to_owned()),
-        upstream_model_id: "gpt-test".to_owned(),
-        upstream_transport: "http_sse".to_owned(),
+        upstream_model_id: None,
+        upstream_transport: "http_json".to_owned(),
         http_version: None,
     };
 
@@ -109,22 +109,31 @@ async fn merged_first_attempt_insert_should_match_sequential_semantics() {
         .await
         .expect("merged insert");
 
-    let (attempt_count, send_state, provider_kind, outcome): (i32, String, String, String) =
-        sqlx::query_as(
-            "select attempt_count, upstream_send_state, provider_kind, outcome
+    let (attempt_count, send_state, provider_kind, outcome, requested_model, upstream_model): (
+        i32,
+        String,
+        String,
+        String,
+        Option<String>,
+        Option<String>,
+    ) = sqlx::query_as(
+        "select attempt_count, upstream_send_state, provider_kind, outcome,
+                    requested_model_id, upstream_model_id
              from model_requests where id = 'req_merged'",
-        )
-        .fetch_one(&database.pool)
-        .await
-        .expect("load merged request");
+    )
+    .fetch_one(&database.pool)
+    .await
+    .expect("load merged request");
     assert_eq!(
         (
             attempt_count,
             send_state.as_str(),
             provider_kind.as_str(),
-            outcome.as_str()
+            outcome.as_str(),
+            requested_model,
+            upstream_model,
         ),
-        (1, "not_sent", "openai", "running")
+        (1, "not_sent", "openai", "running", None, None)
     );
 
     // 后续 attempt 沿用常规 CAS 递增路径；已持久化的 sent 水位不被重试重置。
@@ -142,8 +151,8 @@ async fn merged_first_attempt_insert_should_match_sequential_semantics() {
             provider_kind: "openai".to_owned(),
             provider_account_id: Some("acct_merged".to_owned()),
             provider_account_ref: Some("acct_merged".to_owned()),
-            upstream_model_id: "gpt-test".to_owned(),
-            upstream_transport: "http_sse".to_owned(),
+            upstream_model_id: None,
+            upstream_transport: "http_json".to_owned(),
             http_version: None,
         })
         .await
@@ -182,7 +191,7 @@ async fn model_request_persists_group_routing_snapshot_without_live_group_foreig
             operation: "responses".to_owned(),
             endpoint: "/v1/responses".to_owned(),
             client_transport: "http_sse".to_owned(),
-            requested_model_id: "coding".to_owned(),
+            requested_model_id: Some("coding".to_owned()),
             client_ip: None,
             user_agent: None,
             reasoning_effort: None,

backend/crates/gateway-store/tests/postgres/provider_accounts.rs

@@ -10,7 +10,12 @@ use gateway_admin::{
             UpdateAccount,
         },
         observability::TimeRange,
-        provider_credentials::{CredentialListQuery, CredentialListWindow, CredentialStateFilter},
+        provider_credentials::{
+            AuthorizationCommit, AuthorizationCredentialCommit, AuthorizationMutationTarget,
+            AuthorizationOwnerBinding, CredentialListQuery, CredentialListWindow,
+            CredentialStateFilter, PendingAuthorizationMutation, PreparedCredentialCreate,
+            ProviderDocument,
+        },
     },
     ports::store::AccountStore,
 };
@@ -18,8 +23,8 @@ use gateway_core::engine::credential::{
     AccountErrorReason, AccountStateChange, CredentialCasOutcome, CredentialCasUpdate,
     CredentialRevision, CredentialState, OpaqueProviderData, PlaintextCredential,
     ProviderAccountId, ProviderAccountIdentity, ProviderAccountStore, ProviderAccountUpdate,
-    QuotaAccessChange, QuotaAccessState, QuotaEvidence, QuotaObservation, QuotaState,
-    QuotaWriteOutcome,
+    QuotaAccessChange, QuotaAccessState, QuotaEvidence, QuotaObservation, QuotaObservationTouch,
+    QuotaState, QuotaWriteOutcome,
 };
 use gateway_core::routing::{AccountGroupId, ProviderKind};
 use gateway_store::{
@@ -51,6 +56,22 @@ struct RecoveredAccountRow {
     access_token_expires_at: Option<chrono::DateTime<Utc>>,
 }
 
+#[derive(sqlx::FromRow)]
+struct CoreRefreshRow {
+    name: String,
+    email: Option<String>,
+    plan_type: Option<String>,
+    provider_credentials_json: serde_json::Value,
+    credential_revision: i64,
+    credential_state: String,
+    last_error_reason: Option<String>,
+    last_error_message: Option<String>,
+    quota_access_state: String,
+    quota_evidence: Option<String>,
+    quota_access_observed_at: Option<chrono::DateTime<Utc>>,
+    quota_reset_at: Option<chrono::DateTime<Utc>>,
+}
+
 #[test]
 fn postgres_provider_account_adapter_implements_core_port() {
     fn assert_port<T: ProviderAccountStore>() {}
@@ -156,6 +177,115 @@ async fn core_quota_batch_reads_only_observed_accounts_in_one_contract_call() {
     database.close().await;
 }
 
+#[tokio::test]
+async fn quota_observation_touch_preserves_quota_state_and_advances_account_update_time() {
+    let Some(database) = TestDatabase::create("provider_account_quota_touch").await else {
+        return;
+    };
+    let repository = PgProviderAccountRepository::new(database.pool.clone());
+    let account_id = ProviderAccountId::new("acct_quota_touch").expect("account id");
+    repository
+        .insert_provider_account(account(account_id.as_str(), "user-quota-touch"))
+        .await
+        .expect("insert quota fixture");
+    let revision = CredentialRevision::new(1).expect("revision");
+    let observed_at = SystemTime::now()
+        .checked_sub(Duration::from_secs(60))
+        .expect("old observation time");
+    let touched_at = observed_at
+        .checked_add(Duration::from_secs(90))
+        .expect("new observation time");
+    let reset_at = observed_at
+        .checked_add(Duration::from_secs(3_600))
+        .expect("quota reset time");
+    let quota_json = json!({
+        "rate_limit": {
+            "allowed": false,
+            "limit_reached": true,
+            "primary_window": {"used_percent": 100, "reset_at": 1_900_000_000}
+        }
+    });
+    assert_eq!(
+        repository
+            .compare_and_swap_quota(QuotaObservation {
+                account_id: account_id.clone(),
+                expected_revision: revision,
+                quota: OpaqueProviderData::new(
+                    quota_json.as_object().expect("quota object").clone(),
+                ),
+                observed_at,
+                state: QuotaState::exhausted(
+                    QuotaEvidence::UsageLimitReached,
+                    observed_at,
+                    Some(reset_at),
+                ),
+            })
+            .await
+            .expect("persist exhausted quota"),
+        QuotaWriteOutcome::Updated
+    );
+    let account_updated_at: chrono::DateTime<Utc> = sqlx::query_scalar(
+        "select updated_at from provider_accounts where id = 'acct_quota_touch'",
+    )
+    .fetch_one(&database.pool)
+    .await
+    .expect("load account update time before quota touch");
+
+    assert_eq!(
+        repository
+            .touch_quota_observation(QuotaObservationTouch {
+                account_id,
+                expected_revision: revision,
+                observed_at: touched_at,
+            })
+            .await
+            .expect("touch quota refresh time"),
+        QuotaWriteOutcome::Updated
+    );
+
+    let stored = sqlx::query_as::<
+        _,
+        (
+            serde_json::Value,
+            chrono::DateTime<Utc>,
+            String,
+            Option<String>,
+            chrono::DateTime<Utc>,
+            Option<chrono::DateTime<Utc>>,
+            chrono::DateTime<Utc>,
+        ),
+    >(
+        "select provider_quota_json, quota_observed_at, quota_access_state,
+                quota_evidence, quota_access_observed_at, quota_reset_at, updated_at
+         from provider_accounts where id = 'acct_quota_touch'",
+    )
+    .fetch_one(&database.pool)
+    .await
+    .expect("load touched quota row");
+    assert_eq!(stored.0, quota_json);
+    assert_eq!(
+        stored.1.timestamp_micros(),
+        chrono::DateTime::<Utc>::from(touched_at).timestamp_micros()
+    );
+    assert_eq!(stored.2, "exhausted");
+    assert_eq!(stored.3.as_deref(), Some("usage_limit_reached"));
+    assert_eq!(
+        stored.4.timestamp_micros(),
+        chrono::DateTime::<Utc>::from(observed_at).timestamp_micros()
+    );
+    assert_eq!(
+        stored.5.map(|value| value.timestamp_micros()),
+        Some(chrono::DateTime::<Utc>::from(reset_at).timestamp_micros())
+    );
+    assert_eq!(
+        stored.6.timestamp_micros(),
+        chrono::DateTime::<Utc>::from(touched_at).timestamp_micros()
+    );
+    assert!(stored.6 > account_updated_at);
+
+    database.close().await;
+}
+
 #[tokio::test]
 async fn delayed_provider_observations_cannot_overwrite_newer_state_or_quota() {
     let Some(database) = TestDatabase::create("provider_account_observation_fence").await else {
@@ -280,6 +410,27 @@ async fn credential_error_message_is_persisted_and_cleared_on_recovery() {
         Some("upstream returned 402 payment required")
     );
 
+    repository
+        .apply_state_change(AccountStateChange {
+            message: Some("Invalid refresh token.".to_owned()),
+            account_id: account_id.clone(),
+            expected_revision: revision,
+            credential_state: CredentialState::Ready,
+            observed_at: SystemTime::now(),
+            error_reason: Some(AccountErrorReason::AccessTokenExpired),
+        })
+        .await
+        .expect("persist recoverable refresh failure");
+    let recoverable: (Option<String>, Option<String>) = sqlx::query_as(
+        "select last_error_reason, last_error_message from provider_accounts where id = $1",
+    )
+    .bind(account_id.as_str())
+    .fetch_one(&database.pool)
+    .await
+    .expect("read recoverable refresh failure");
+    assert_eq!(recoverable.0.as_deref(), Some("access_token_expired"));
+    assert_eq!(recoverable.1.as_deref(), Some("Invalid refresh token."));
+
     repository
         .apply_state_change(AccountStateChange {
             message: None,
@@ -736,10 +887,16 @@ async fn terminal_admin_quota_window_usage_prefers_provider_total_and_falls_back
             ("gpt-window-recent", Some(700)),
         ],
     );
+    assert_eq!(usage[0].usage.costs.len(), 1);
+    assert_eq!(usage[0].usage.costs[0].currency, "USD");
+    assert_eq!(usage[0].usage.costs[0].amount.as_str(), "3.75");
     assert_eq!(usage[0].usage.models[0].costs[0].amount.as_str(), "2.5");
     assert_eq!(usage[0].usage.models[1].costs[0].amount.as_str(), "1.25");
     assert_eq!(usage[1].key, "short");
     assert_eq!(usage[1].usage.total_tokens, Some(700));
+    assert_eq!(usage[1].usage.costs.len(), 1);
+    assert_eq!(usage[1].usage.costs[0].currency, "USD");
+    assert_eq!(usage[1].usage.costs[0].amount.as_str(), "1.25");
     assert_eq!(usage[1].usage.models.len(), 1);
     assert_eq!(usage[1].usage.models[0].model, "gpt-window-recent");
     assert_eq!(usage[1].usage.models[0].total_tokens, Some(700));
@@ -1180,6 +1337,75 @@ async fn admin_import_updates_the_same_verified_identity_without_rebinding_it()
     database.close().await;
 }
 
+#[tokio::test]
+async fn authorization_create_returns_existing_account_id_when_identity_is_upserted() {
+    let Some(database) = TestDatabase::create("provider_account_authorization_upsert").await else {
+        return;
+    };
+    PgProviderAccountRepository::new(database.pool.clone())
+        .insert_provider_account(account(
+            "acct_authorization_existing",
+            "user-authorization-upsert",
+        ))
+        .await
+        .expect("seed existing authorized identity");
+    let context = MutationContext {
+        actor: MutationActor::System,
+        request_id: "request_authorization_upsert".to_owned(),
+    };
+    let provider_kind = ProviderKind::new("openai").expect("OpenAI Provider kind");
+    let serde_json::Value::Object(provider_material) =
+        json!({ "access_token": "authorized-secret" })
+    else {
+        unreachable!("credential fixture must be an object");
+    };
+
+    let result = PgAdminAccountStore::new(database.pool.clone(), None)
+        .commit_authorization(
+            AuthorizationCommit {
+                pending: PendingAuthorizationMutation::new(
+                    provider_kind.clone(),
+                    AuthorizationMutationTarget::Create {
+                        name: "authorized account".to_owned(),
+                    },
+                    AuthorizationOwnerBinding::from_context(&context),
+                ),
+                credential: AuthorizationCredentialCommit::Create(PreparedCredentialCreate {
+                    account_id: ProviderAccountId::new("acct_authorization_candidate")
+                        .expect("candidate account ID"),
+                    provider_kind,
+                    name: "authorized account".to_owned(),
+                    email: Some("authorized@example.invalid".to_owned()),
+                    upstream_user_id: Some("user-authorization-upsert".to_owned()),
+                    upstream_account_id: None,
+                    plan_type: Some("free".to_owned()),
+                    authentication_kind: "oauth".to_owned(),
+                    provider_material: ProviderDocument::new(OpaqueProviderData::new(
+                        provider_material,
+                    )),
+                    has_refresh_token: true,
+                    access_token_expires_at: Some(Utc::now() + TimeDelta::hours(1)),
+                    next_refresh_at: None,
+                    enabled: true,
+                    credential_state: CredentialState::Ready,
+                    credential_observed_at: Utc::now(),
+                }),
+            },
+            &context,
+        )
+        .await
+        .expect("authorize existing identity");
+
+    assert_eq!(
+        (
+            result.account_id.as_str(),
+            result.credential_revision.map(|revision| revision.get()),
+        ),
+        ("acct_authorization_existing", Some(2)),
+    );
+    database.close().await;
+}
+
 #[tokio::test]
 async fn core_refresh_cas_updates_profile_and_credential_under_one_revision() {
     let Some(database) = TestDatabase::create("provider_account_core_refresh").await else {
@@ -1208,8 +1434,37 @@ async fn core_refresh_cas_updates_profile_and_credential_under_one_revision() {
         })
         .await
         .expect("seed provider account");
+    sqlx::query(
+        "update provider_accounts
+         set last_error_reason = 'access_token_expired',
+             last_error_message = 'stale refresh failure'
+         where id = 'acct_core_refresh'",
+    )
+    .execute(&database.pool)
+    .await
+    .expect("seed refresh failure details");
 
     let account_id = ProviderAccountId::new("acct_core_refresh").expect("account ID");
+    let quota_observed_at = SystemTime::now();
+    let quota_reset_at = quota_observed_at
+        .checked_add(Duration::from_secs(3_600))
+        .expect("quota reset time");
+    assert_eq!(
+        repository
+            .apply_quota_access(QuotaAccessChange {
+                account_id: account_id.clone(),
+                expected_revision: CredentialRevision::new(1).expect("credential revision"),
+                state: QuotaState::exhausted(
+                    QuotaEvidence::UsageLimitReached,
+                    quota_observed_at,
+                    Some(quota_reset_at),
+                ),
+            })
+            .await
+            .expect("seed quota exhaustion"),
+        QuotaWriteOutcome::Updated
+    );
+    let state_observed_at = SystemTime::now();
     let refreshed = CredentialCasUpdate::new(
         account_id.clone(),
         CredentialRevision::new(1).expect("credential revision"),
@@ -1224,7 +1479,8 @@ async fn core_refresh_cas_updates_profile_and_credential_under_one_revision() {
         Some(SystemTime::now() + Duration::from_secs(3_600)),
         Some(SystemTime::now() + Duration::from_secs(1_800)),
     )
-    .expect("valid refresh update");
+    .expect("valid refresh update")
+    .with_account_state(CredentialState::Ready, state_observed_at, None, None);
     assert_eq!(
         repository
             .compare_and_swap_credential(refreshed)
@@ -1235,24 +1491,37 @@ async fn core_refresh_cas_updates_profile_and_credential_under_one_revision() {
         )
     );
 
-    let row: (
-        String,
-        Option<String>,
-        Option<String>,
-        serde_json::Value,
-        i64,
-    ) = sqlx::query_as(
-        "select name, email, plan_type, provider_credentials_json, credential_revision
+    let row = sqlx::query_as::<_, CoreRefreshRow>(
+        "select name, email, plan_type, provider_credentials_json, credential_revision,
+                credential_state, last_error_reason, last_error_message,
+                quota_access_state, quota_evidence, quota_access_observed_at, quota_reset_at
          from provider_accounts where id = 'acct_core_refresh'",
     )
     .fetch_one(&database.pool)
     .await
     .expect("load refreshed account");
-    assert_eq!(row.0, "after refresh");
-    assert_eq!(row.1.as_deref(), Some("after@example.invalid"));
-    assert_eq!(row.2.as_deref(), Some("premium"));
-    assert_eq!(row.3["access_token"], "after-secret");
-    assert_eq!(row.4, 2);
+    assert_eq!(row.name, "after refresh");
+    assert_eq!(row.email.as_deref(), Some("after@example.invalid"));
+    assert_eq!(row.plan_type.as_deref(), Some("premium"));
+    assert_eq!(
+        row.provider_credentials_json["access_token"],
+        "after-secret"
+    );
+    assert_eq!(row.credential_revision, 2);
+    assert_eq!(row.credential_state, "ready");
+    assert_eq!(row.last_error_reason, None);
+    assert_eq!(row.last_error_message, None);
+    assert_eq!(row.quota_access_state, "exhausted");
+    assert_eq!(row.quota_evidence.as_deref(), Some("usage_limit_reached"));
+    assert_eq!(
+        row.quota_access_observed_at
+            .map(|value| value.timestamp_micros()),
+        Some(chrono::DateTime::<Utc>::from(quota_observed_at).timestamp_micros())
+    );
+    assert_eq!(
+        row.quota_reset_at.map(|value| value.timestamp_micros()),
+        Some(chrono::DateTime::<Utc>::from(quota_reset_at).timestamp_micros())
+    );
 
     assert!(
         repository

backend/crates/gateway-store/tests/postgres/snapshots.rs

@@ -436,7 +436,7 @@ async fn diagnostics_should_fallback_to_name_then_ref_for_missing_snapshots() {
                 provider_kind: "openai".to_owned(),
                 provider_account_id: None,
                 provider_account_ref: Some("acct_legacy_deleted".to_owned()),
-                upstream_model_id: "legacy-model".to_owned(),
+                upstream_model_id: Some("legacy-model".to_owned()),
                 upstream_transport: "http_sse".to_owned(),
                 http_version: None,
             },
@@ -547,7 +547,7 @@ async fn api_key_diagnostics_should_display_key_name_and_fallback_to_ref() {
             provider_kind: "openai".to_owned(),
             provider_account_id: None,
             provider_account_ref: Some("acct_key".to_owned()),
-            upstream_model_id: "upstream-model".to_owned(),
+            upstream_model_id: Some("upstream-model".to_owned()),
             upstream_transport: "http_sse".to_owned(),
             http_version: None,
         };
@@ -664,7 +664,7 @@ fn new_request(id: &str, started_at: DateTime<Utc>) -> NewModelRequest {
         operation: "responses".to_owned(),
         endpoint: "/v1/responses".to_owned(),
         client_transport: "http_sse".to_owned(),
-        requested_model_id: "coding".to_owned(),
+        requested_model_id: Some("coding".to_owned()),
         routing_scope: "all".to_owned(),
         routing_group_refs: Vec::new(),
         routing_group_names_snapshot: serde_json::json!([]),
@@ -688,7 +688,7 @@ fn attempt(id: &str, count: u32, account_id: &str) -> ModelRequestAttemptStart {
         provider_kind: "openai".to_owned(),
         provider_account_id: Some(account_id.to_owned()),
         provider_account_ref: Some(account_id.to_owned()),
-        upstream_model_id: "upstream-model".to_owned(),
+        upstream_model_id: Some("upstream-model".to_owned()),
         upstream_transport: "http_sse".to_owned(),
         http_version: None,
     }

backend/crates/gateway-store/tests/redis/artifact_profile.rs

@@ -0,0 +1,114 @@
+use std::time::{Duration, SystemTime};
+
+use gateway_core::engine::credential::OpaqueProviderData;
+use gateway_core::provider_ports::{
+    ProviderArtifactProfile, ProviderArtifactProfileCachePort, ProviderStoreErrorKind,
+};
+use gateway_core::routing::ProviderKind;
+use gateway_store::redis::RedisProviderArtifactProfileRepository;
+use redis::aio::ConnectionManager;
+use serde_json::{Map, Value};
+use uuid::Uuid;
+
+#[test]
+fn artifact_profile_adapter_implements_provider_port() {
+    fn assert_port<T: ProviderArtifactProfileCachePort>() {}
+    assert_port::<RedisProviderArtifactProfileRepository>();
+}
+
+#[tokio::test]
+async fn artifact_profile_uses_one_expiring_key_and_rejects_rollback_or_conflict() {
+    let Some((repository, mut connection, namespace)) = repository().await else {
+        return;
+    };
+    let provider = ProviderKind::new("openai").expect("provider kind");
+    let current = profile(provider.clone(), 6_570, "0.148.0-alpha.9");
+    assert!(
+        repository
+            .replace_if_newer(current.clone(), Duration::from_secs(60))
+            .await
+            .expect("store current profile")
+    );
+    assert_eq!(
+        repository.read(&provider).await.expect("read profile"),
+        Some(current.clone())
+    );
+
+    assert!(
+        !repository
+            .replace_if_newer(
+                profile(provider.clone(), 6_415, "0.147.0-alpha.6.6"),
+                Duration::from_secs(60),
+            )
+            .await
+            .expect("reject older profile")
+    );
+    let conflict = repository
+        .replace_if_newer(
+            profile(provider.clone(), 6_570, "0.148.0-alpha.10"),
+            Duration::from_secs(60),
+        )
+        .await
+        .expect_err("same build with different Core must conflict");
+    assert_eq!(conflict.kind(), ProviderStoreErrorKind::Conflict);
+    assert_eq!(
+        repository
+            .read(&provider)
+            .await
+            .expect("read retained profile"),
+        Some(current)
+    );
+
+    let keys = redis::cmd("KEYS")
+        .arg(format!("{namespace}:*"))
+        .query_async::<Vec<String>>(&mut connection)
+        .await
+        .expect("list isolated keys");
+    assert_eq!(keys.len(), 1);
+    assert_eq!(
+        keys[0],
+        format!("{namespace}:provider:openai:artifact-profile:v1")
+    );
+    let ttl = redis::cmd("PTTL")
+        .arg(&keys[0])
+        .query_async::<i64>(&mut connection)
+        .await
+        .expect("read profile TTL");
+    assert!((1..=60_000).contains(&ttl));
+}
+
+fn profile(
+    provider: ProviderKind,
+    artifact_sequence: u64,
+    codex_version: &str,
+) -> ProviderArtifactProfile {
+    let mut fields = Map::new();
+    fields.insert("schema_version".to_owned(), Value::from(1));
+    fields.insert(
+        "codex_version".to_owned(),
+        Value::String(codex_version.to_owned()),
+    );
+    ProviderArtifactProfile::new(
+        provider,
+        artifact_sequence,
+        SystemTime::UNIX_EPOCH + Duration::from_secs(1_800_000_000),
+        OpaqueProviderData::new(fields),
+    )
+}
+
+async fn repository() -> Option<(
+    RedisProviderArtifactProfileRepository,
+    ConnectionManager,
+    String,
+)> {
+    let redis_url = crate::support::test_env("CPR_TEST_REDIS_URL")?;
+    let client = redis::Client::open(redis_url).expect("valid CPR_TEST_REDIS_URL");
+    let connection = client
+        .get_connection_manager()
+        .await
+        .expect("connect test Redis");
+    let namespace = format!("gateway-store-test-{}", Uuid::new_v4());
+    let repository = RedisProviderArtifactProfileRepository::new(connection.clone(), &namespace)
+        .expect("valid test namespace");
+    Some((repository, connection, namespace))
+}

backend/crates/gateway-store/tests/redis/mod.rs

@@ -1,3 +1,4 @@
+mod artifact_profile;
 mod client_admission;
 mod coordination_buffer;
 mod credential_cooldown;

backend/crates/gateway-store/tests/redis/provider_session_affinity.rs

@@ -65,6 +65,55 @@ async fn session_affinity_should_overwrite_the_previous_account() {
     );
 }
 
+#[tokio::test]
+async fn session_affinity_claim_should_keep_the_first_account() {
+    let Some((repository, _connection, _namespace)) = affinity_repository().await else {
+        return;
+    };
+    let provider = ProviderKind::new("openai").expect("provider");
+    let key = ProviderSessionAffinityKey::try_new("claim-session").expect("affinity key");
+    let first = ProviderAccountId::new("acct_first").expect("first account");
+    let second = ProviderAccountId::new("acct_second").expect("second account");
+
+    let first_winner = repository
+        .claim_or_load(&provider, &key, &first, Duration::from_secs(60))
+        .await
+        .expect("claim first affinity");
+    let second_winner = repository
+        .claim_or_load(&provider, &key, &second, Duration::from_secs(60))
+        .await
+        .expect("load existing affinity");
+
+    assert_eq!((first_winner, second_winner), (first.clone(), first));
+}
+
+#[tokio::test]
+async fn session_affinity_compare_should_not_replace_a_newer_winner() {
+    let Some((repository, _connection, _namespace)) = affinity_repository().await else {
+        return;
+    };
+    let provider = ProviderKind::new("openai").expect("provider");
+    let key = ProviderSessionAffinityKey::try_new("compare-session").expect("affinity key");
+    let first = ProviderAccountId::new("acct_first").expect("first account");
+    let second = ProviderAccountId::new("acct_second").expect("second account");
+    let stale = ProviderAccountId::new("acct_stale").expect("stale account");
+    repository
+        .bind(&provider, &key, &first, Duration::from_secs(60))
+        .await
+        .expect("seed affinity");
+
+    let migrated = repository
+        .compare_and_bind(&provider, &key, &first, &second, Duration::from_secs(60))
+        .await
+        .expect("migrate expected affinity");
+    let stale_result = repository
+        .compare_and_bind(&provider, &key, &first, &stale, Duration::from_secs(60))
+        .await
+        .expect("reject stale affinity migration");
+
+    assert_eq!((migrated, stale_result), (second.clone(), second));
+}
+
 #[tokio::test]
 async fn session_affinity_should_apply_ttl_and_support_explicit_clear() {
     let Some((repository, mut connection, namespace)) = affinity_repository().await else {

backend/crates/gateway-store/tests/redis/worker_lease.rs

@@ -21,12 +21,18 @@ async fn store_bundle_worker_plan_and_leader_lease_are_single_use_and_fenced() {
         return;
     };
     let database = TestDatabase::create(&database_url).await;
-    let config = store_config(&database.url, &redis_url);
+    let runtime_data = tempfile::tempdir().expect("Store runtime data");
+    let mut config = store_config(&database.url, &redis_url);
+    config
+        .resolve_and_validate(runtime_data.path())
+        .expect("resolved Store config");
     let mut first = initialize(config.clone())
         .await
         .expect("first Store bundle");
     let second = initialize(config).await.expect("second Store bundle");
 
+    assert!(runtime_data.path().join("backup-staging").is_dir());
+
     let kinds = first
         .take_worker_contributions()
         .into_iter()

backend/crates/providers/openai/Cargo.toml

@@ -14,9 +14,8 @@ base64 = "0.23.0"
 bytes = "1.11.1"
 chrono = { version = "0.4.45", features = ["clock", "serde"] }
 cookie = "0.18.1"
-crypto_box = { version = "0.9.1", features = ["seal"] }
-ed25519-dalek = { version = "3.0.0", features = ["alloc", "pkcs8"] }
 futures = "0.3.32"
+flate2 = "1.1.9"
 gateway-admin = { path = "../../gateway-admin" }
 gateway-core = { path = "../../gateway-core" }
 gateway-protocol = { path = "../../gateway-protocol" }
@@ -49,6 +48,7 @@ tokio-tungstenite = { git = "https://github.com/openai-oss-forks/tokio-tungsteni
 tracing = "0.1.44"
 tungstenite = { git = "https://github.com/openai-oss-forks/tungstenite-rs", rev = "4fffad30fe373adbdcffab9545e9e9bf4f2fc19f", features = ["deflate", "proxy"] }
 url = "2.5.8"
+urlencoding = "2.1.3"
 uuid = { version = "1.23.3", features = ["v4", "v7"] }
 # 官方 Codex app-server 对 /v1/responses 请求体默认做 zstd 压缩（level 3），
 # 并携带 Content-Encoding: zstd；保持同版本同级别以对齐上游指纹。

backend/crates/providers/openai/src/admin.rs

@@ -13,20 +13,24 @@ use gateway_admin::model::observability::{
 };
 use gateway_admin::model::provider_credentials::{
     AuthorizationMutationTarget, AuthorizationOwner, AuthorizationOwnerBinding,
-    AuthorizationStarted, CompleteAuthorization, CredentialCommitGuard,
+    AuthorizationStarted, CompleteAuthorization, ConsumeProviderResetCredit, CredentialCommitGuard,
     PendingAuthorizationMutation, PrepareCredentialImport, PrepareCredentialRefresh,
     PrepareCredentialRotation, PreparedAuthorizationCommit, PreparedAuthorizationCredential,
     PreparedCredentialCreate, PreparedCredentialImport, PreparedCredentialRotation,
     PreparedCredentialRotationFacts, ProviderDocument, ProviderExport,
-    ProviderExportCredentialInput, ProviderModel, ProviderModels, ProviderQuota,
-    ProviderQuotaRequest, ProviderQuotaWindow, QuotaLocalUsageAttribution,
+    ProviderExportCredentialInput, ProviderModel, ProviderModels, ProviderProfileActivityInsights,
+    ProviderProfileDailyUsage, ProviderProfileInvocation, ProviderProfileStatistics,
+    ProviderProfileStatisticsSummary, ProviderQuota, ProviderQuotaRequest, ProviderQuotaWindow,
+    ProviderQuotaWindowRole, ProviderResetCredit, ProviderResetCreditResult, ProviderResetCredits,
+    QuotaLocalUsageAttribution,
 };
 use gateway_admin::model::{MutationActor, MutationContext, Revision};
 use gateway_admin::ports::provider::{ProviderAdmin, ProviderAdminError, ProviderAdminErrorKind};
 use gateway_core::accounting::Money;
 use gateway_core::engine::credential::{
-    CredentialRevision, LoadedCredential, NewProviderAccount, OpaqueProviderData,
-    PlaintextCredential, ProviderAccount, ProviderAccountId, ProviderAccountStore,
+    CredentialCasUpdateParts, CredentialRevision, LoadedCredential, NewProviderAccount,
+    OpaqueProviderData, PlaintextCredential, ProviderAccount, ProviderAccountId,
+    ProviderAccountStore,
 };
 use gateway_core::error::StoreErrorKind;
 use gateway_core::operation::{GenerateRequest, Operation, ProtocolPayload};
@@ -43,18 +47,21 @@ use serde_json::{Map, Number, Value};
 use crate::credential::{
     CodexAccountQuotaSnapshot, CodexCredentialAdmin, CodexCredentialAdminError,
     CodexCredentialAdminService, CodexCredentialCatalogError, CodexCredentialCatalogService,
-    CodexCredentialQuotaError, CodexCredentialQuotaService, CodexOAuthAdmin, CodexOAuthAdminError,
-    CodexOAuthPendingClaimOutcome, CodexOAuthPendingStore, CodexOAuthPendingStoreError,
-    CodexPendingAuthorization, CodexQuotaWindow, CodexQuotaWindowKind, CodexQuotaWindowRole,
+    CodexCredentialProfileService, CodexCredentialQuotaError, CodexCredentialQuotaService,
+    CodexOAuthAdmin, CodexOAuthAdminError, CodexOAuthPendingClaimOutcome, CodexOAuthPendingStore,
+    CodexOAuthPendingStoreError, CodexPendingAuthorization, CodexProfileStatisticsError,
+    CodexQuotaWindow, CodexQuotaWindowKind, CodexQuotaWindowRole, CodexResetCreditsError,
     CompleteCodexOAuthAuthorization, CompletedCodexOAuthCredential, ExportManagedCodexCredential,
     StartCodexOAuthAuthorization, StoredCodexPendingAuthorization,
 };
-use crate::credential::{CodexCredentialCodec, CodexOAuthSecret, oauth_owner_ref};
+use crate::credential::{
+    CodexCredentialCodec, CodexOAuthSecret, oauth_owner_ref, parse_access_token_expiration,
+};
 use crate::transport::CodexWebSocketPool;
-use crate::transport::openai_billing_breakdown;
 use crate::transport::profile::{
     CodexDesktopReleaseSnapshot, CodexDesktopReleaseStatus, CodexWireProfile, CodexWireProfileState,
 };
+use crate::transport::{CodexProfileStatistics, OpenAiBillingUsage, openai_billing_breakdown};
 
 const PROVIDER_NAME: &str = "openai";
 const PENDING_DOCUMENT_SCHEMA_VERSION: u64 = 3;
@@ -66,6 +73,7 @@ pub(crate) struct OpenAiAdminProvider {
     accounts: Arc<dyn ProviderAccountStore>,
     credentials: Arc<CodexCredentialAdminService>,
     oauth: Arc<dyn CodexOAuthAdmin>,
+    profile_statistics: Arc<CodexCredentialProfileService>,
     quota: Arc<CodexCredentialQuotaService>,
     catalog: Arc<CodexCredentialCatalogService>,
     websocket_pool: Arc<CodexWebSocketPool>,
@@ -75,6 +83,7 @@ pub(crate) struct OpenAiAdminProvider {
 pub(crate) struct OpenAiAdminServices {
     pub(crate) credentials: Arc<CodexCredentialAdminService>,
     pub(crate) oauth: Arc<dyn CodexOAuthAdmin>,
+    pub(crate) profile_statistics: Arc<CodexCredentialProfileService>,
     pub(crate) quota: Arc<CodexCredentialQuotaService>,
     pub(crate) catalog: Arc<CodexCredentialCatalogService>,
 }
@@ -95,6 +104,7 @@ impl OpenAiAdminProvider {
             accounts,
             credentials: services.credentials,
             oauth: services.oauth,
+            profile_statistics: services.profile_statistics,
             quota: services.quota,
             catalog: services.catalog,
             websocket_pool,
@@ -215,10 +225,12 @@ impl ProviderAdmin for OpenAiAdminProvider {
         };
         let Some(breakdown) = openai_billing_breakdown(
             &input.upstream_model_id,
-            input_tokens,
-            output_tokens,
-            input.cached_tokens.unwrap_or_default(),
-            input.cache_write_tokens.unwrap_or_default(),
+            OpenAiBillingUsage::new(
+                input_tokens,
+                output_tokens,
+                input.cached_tokens.unwrap_or_default(),
+                input.cache_write_tokens.unwrap_or_default(),
+            ),
             input.service_tier.as_deref(),
         ) else {
             return Ok(None);
@@ -256,7 +268,7 @@ impl ProviderAdmin for OpenAiAdminProvider {
             ))
             .await
             .inspect_err(|error| {
-                log_import_failure("prepare_document", credential_admin_error_code(*error));
+                log_import_failure("prepare_document", credential_admin_error_code(error));
             })
             .map_err(map_credential_admin_error)?;
         let observed_at = Utc::now();
@@ -378,8 +390,10 @@ impl ProviderAdmin for OpenAiAdminProvider {
                 .oauth()
                 .and_then(|oauth| oauth.id_token.clone());
         }
+        let access_token_expires_at =
+            parse_access_token_expiration(secret.access_token.expose_secret());
         let prepared = CodexCredentialAdmin
-            .prepare_refreshed_oauth_rotation(current, secret, None, None)
+            .prepare_refreshed_oauth_rotation(current, secret, access_token_expires_at, None)
             .map_err(map_credential_admin_error)?;
         prepared_rotation(prepared, command.account.provider_kind)
     }
@@ -435,6 +449,50 @@ impl ProviderAdmin for OpenAiAdminProvider {
         Ok(project_quota(snapshot, &account))
     }
 
+    async fn profile_statistics(
+        &self,
+        account_id: &ProviderAccountId,
+    ) -> Result<ProviderProfileStatistics, ProviderAdminError> {
+        self.account(account_id).await?;
+        let statistics = self
+            .profile_statistics
+            .profile_statistics(account_id)
+            .await
+            .map_err(map_profile_statistics_error)?;
+        Ok(project_profile_statistics(statistics))
+    }
+
+    async fn reset_credits(
+        &self,
+        account_id: &ProviderAccountId,
+    ) -> Result<ProviderResetCredits, ProviderAdminError> {
+        self.account(account_id).await?;
+        self.quota
+            .list_reset_credits(account_id)
+            .await
+            .map(project_reset_credits)
+            .map_err(map_reset_credits_error)
+    }
+
+    async fn consume_reset_credit(
+        &self,
+        command: ConsumeProviderResetCredit,
+    ) -> Result<ProviderResetCreditResult, ProviderAdminError> {
+        self.account(&command.account_id).await?;
+        self.quota
+            .consume_reset_credit(
+                &command.account_id,
+                command.credit_id.as_deref(),
+                command.redeem_request_id,
+            )
+            .await
+            .map(|result| ProviderResetCreditResult {
+                code: result.code,
+                credit: result.credit.map(project_reset_credit),
+            })
+            .map_err(map_reset_credits_error)
+    }
+
     async fn models(
         &self,
         account_id: &ProviderAccountId,
@@ -544,15 +602,16 @@ fn prepared_rotation(
     provider_kind: ProviderKind,
 ) -> Result<PreparedCredentialRotation, ProviderAdminError> {
     let (profile, credential, replacement_identity, guard) = prepared.into_parts();
-    let (
+    let CredentialCasUpdateParts {
         account_id,
         expected_revision,
-        credential_profile,
+        profile: credential_profile,
         credential,
         has_refresh_token,
         access_token_expires_at,
         next_refresh_at,
-    ) = credential.into_parts();
+        account_state: _account_state,
+    } = credential.into_parts();
     if profile != credential_profile || profile.account_id != account_id {
         return Err(provider_admin_error(ProviderAdminErrorKind::Internal));
     }
@@ -726,39 +785,24 @@ fn project_quota_snapshot(snapshot: CodexAccountQuotaSnapshot) -> ProviderQuota
         .windows()
         .iter()
         .filter(|window| should_project_quota_window(window))
-        .map(|window| {
-            let mut data = Map::new();
-            data.insert(
-                "source".to_owned(),
-                Value::String(window.source().to_owned()),
-            );
-            data.insert(
-                "role".to_owned(),
-                Value::String(quota_role(window.role()).to_owned()),
-            );
-            ProviderQuotaWindow {
-                key: window.key().to_owned(),
-                group: quota_group(window.kind()).to_owned(),
-                label: codex_quota_window_label(
-                    window.limit_name(),
-                    window.kind(),
-                    window.role(),
-                    window.source(),
-                    window.window_seconds(),
-                ),
-                source: Some(window.source().to_owned()),
-                local_usage_attribution: if window.is_account_wide() {
-                    QuotaLocalUsageAttribution::AccountWide
-                } else {
-                    QuotaLocalUsageAttribution::Unavailable
-                },
-                window_seconds: window.window_seconds(),
-                used_percent: window.used_percent(),
-                reset_at: window.reset_at(),
-                limit_reached: window.limit_reached(),
-                local_usage: None,
-                provider_data: Some(ProviderDocument::new(OpaqueProviderData::new(data))),
-            }
+        .map(|window| ProviderQuotaWindow {
+            key: window.key().to_owned(),
+            group: quota_group(window.kind()).to_owned(),
+            label: codex_quota_window_label(window.kind(), window.role(), window.window_seconds()),
+            limit_id: Some(window.source().to_owned()),
+            limit_name: window.limit_name().map(str::to_owned),
+            role: Some(quota_role(window.role())),
+            local_usage_attribution: if window.is_account_wide() {
+                QuotaLocalUsageAttribution::AccountWide
+            } else {
+                QuotaLocalUsageAttribution::Unavailable
+            },
+            window_seconds: window.window_seconds(),
+            used_percent: window.used_percent(),
+            reset_at: window.reset_at(),
+            limit_reached: window.limit_reached(),
+            local_usage: None,
+            provider_data: None,
         })
         .collect();
     // 快照级 limit_reached 只看滚动后的窗口触顶：顶层标记是观测事实，不能
@@ -775,6 +819,77 @@ fn project_quota_snapshot(snapshot: CodexAccountQuotaSnapshot) -> ProviderQuota
     }
 }
 
+fn project_profile_statistics(statistics: CodexProfileStatistics) -> ProviderProfileStatistics {
+    ProviderProfileStatistics {
+        display_name: statistics.display_name,
+        username: statistics.username,
+        image_url: statistics.image_url,
+        has_stats_error: statistics.has_stats_error,
+        summary: ProviderProfileStatisticsSummary {
+            total_text_tokens: statistics.summary.total_text_tokens,
+            peak_tokens: statistics.summary.peak_tokens,
+            longest_task_duration_ms: statistics.summary.longest_task_duration_ms,
+            current_streak_days: statistics.summary.current_streak_days,
+            longest_streak_days: statistics.summary.longest_streak_days,
+        },
+        daily_usage: statistics.daily_usage.map(|daily| {
+            daily
+                .into_iter()
+                .map(|entry| ProviderProfileDailyUsage {
+                    date: entry.date,
+                    tokens: entry.tokens,
+                })
+                .collect()
+        }),
+        activity_insights: ProviderProfileActivityInsights {
+            fast_mode_percent: statistics.activity_insights.fast_mode_percent,
+            reasoning_effort: statistics.activity_insights.reasoning_effort,
+            reasoning_effort_percent: statistics.activity_insights.reasoning_effort_percent,
+            skills_explored: statistics.activity_insights.skills_explored,
+            total_skills_used: statistics.activity_insights.total_skills_used,
+            total_threads: statistics.activity_insights.total_threads,
+            invocations: statistics.activity_insights.invocations.map(|invocations| {
+                invocations
+                    .into_iter()
+                    .map(|invocation| ProviderProfileInvocation {
+                        invocation_type: invocation.invocation_type,
+                        plugin_id: invocation.plugin_id,
+                        plugin_name: invocation.plugin_name,
+                        skill_id: invocation.skill_id,
+                        skill_name: invocation.skill_name,
+                        usage_count: invocation.usage_count,
+                    })
+                    .collect()
+            }),
+        },
+    }
+}
+
+fn project_reset_credits(
+    credits: crate::transport::CodexRateLimitResetCredits,
+) -> ProviderResetCredits {
+    ProviderResetCredits {
+        available_count: credits.available_count,
+        credits: credits
+            .credits
+            .into_iter()
+            .map(project_reset_credit)
+            .collect(),
+    }
+}
+
+fn project_reset_credit(
+    credit: crate::transport::CodexRateLimitResetCredit,
+) -> ProviderResetCredit {
+    ProviderResetCredit {
+        id: credit.id,
+        status: credit.status,
+        title: credit.title,
+        expires_at: credit.expires_at,
+        reset_type: credit.reset_type,
+    }
+}
+
 /// `secondary_window` 有时只是上游的空占位：没有时长、重置时间，也没有用量。
 /// 它不能被可靠翻译成 5 小时或周额度，因此不应占用账号面板；带有实际事实的
 /// 次级窗口（时长、重置、非零用量或触顶）仍完整保留。
@@ -798,23 +913,21 @@ const fn quota_group(kind: CodexQuotaWindowKind) -> &'static str {
     }
 }
 
-const fn quota_role(role: CodexQuotaWindowRole) -> &'static str {
+const fn quota_role(role: CodexQuotaWindowRole) -> ProviderQuotaWindowRole {
     match role {
-        CodexQuotaWindowRole::Primary => "primary",
-        CodexQuotaWindowRole::Secondary => "secondary",
-        CodexQuotaWindowRole::Monthly => "monthly",
+        CodexQuotaWindowRole::Primary => ProviderQuotaWindowRole::Primary,
+        CodexQuotaWindowRole::Secondary => ProviderQuotaWindowRole::Secondary,
+        CodexQuotaWindowRole::Monthly => ProviderQuotaWindowRole::Monthly,
     }
 }
 
-/// 按窗口时长显示汉化额度名；非核心桶补上上游桶名称作为前缀。
+/// 按窗口时长显示汉化额度名；额度桶名称通过独立字段投影。
 fn codex_quota_window_label(
-    limit_name: Option<&str>,
     kind: CodexQuotaWindowKind,
     role: CodexQuotaWindowRole,
-    source: &str,
     window_seconds: Option<u64>,
 ) -> String {
-    let base = match kind {
+    match kind {
         CodexQuotaWindowKind::Monthly => "月额度".to_owned(),
         CodexQuotaWindowKind::Weekly => "周额度".to_owned(),
         CodexQuotaWindowKind::ShortTerm => {
@@ -825,29 +938,7 @@ fn codex_quota_window_label(
             }
         }
         CodexQuotaWindowKind::Other => custom_quota_window_label(window_seconds, role),
-    };
-    if let Some(prefix) = codex_quota_window_prefix(limit_name, source) {
-        return format!("{prefix} · {base}");
     }
-    base
-}
-
-fn codex_quota_window_prefix(limit_name: Option<&str>, source: &str) -> Option<String> {
-    let source_identifier = quota_identifier(source);
-    if matches!(source_identifier.as_str(), "core" | "codex") {
-        return None;
-    }
-    let label = limit_name.unwrap_or(source);
-    match quota_identifier(label).as_str() {
-        "premium" => Some("Premium".to_owned()),
-        "code_review" => Some("代码审查".to_owned()),
-        "spend_control" => Some("消费控制".to_owned()),
-        _ => Some(label.replace('_', " ")),
-    }
-}
-
-fn quota_identifier(value: &str) -> String {
-    value.trim().to_ascii_lowercase().replace(['-', ' '], "_")
 }
 
 fn custom_quota_window_label(window_seconds: Option<u64>, role: CodexQuotaWindowRole) -> String {
@@ -1011,6 +1102,7 @@ struct PendingDocument {
     state: String,
     nonce: String,
     code_verifier: String,
+    installation_id: String,
     reauthorization_account_id: Option<String>,
     mutation: PendingMutationDocument,
 }
@@ -1071,6 +1163,10 @@ fn encode_pending(pending: &CodexPendingAuthorization) -> Map<String, Value> {
         "code_verifier".to_owned(),
         Value::String(pending.code_verifier().expose_secret().to_owned()),
     );
+    document.insert(
+        "installation_id".to_owned(),
+        Value::String(pending.installation_id().to_owned()),
+    );
     document.insert(
         "reauthorization_account_id".to_owned(),
         pending
@@ -1161,6 +1257,7 @@ fn decode_pending(
         state: SecretString::from(document.state),
         nonce: SecretString::from(document.nonce),
         code_verifier: SecretString::from(document.code_verifier),
+        installation_id: document.installation_id,
         reauthorization_account_id: document.reauthorization_account_id,
         mutation: decode_mutation(document.mutation)?,
     })
@@ -1267,31 +1364,37 @@ fn map_store_error(error: gateway_core::error::StoreError) -> ProviderAdminError
 
 fn map_credential_admin_error(error: CodexCredentialAdminError) -> ProviderAdminError {
     use CodexCredentialAdminError as Error;
-    provider_admin_error(match error {
+    let upstream_message = error.upstream_message().map(ToOwned::to_owned);
+    let kind = match error {
         Error::InvalidInput
         | Error::InvalidCredential
         | Error::MissingRefreshToken
-        | Error::RefreshRejected
-        | Error::AccountBanned => ProviderAdminErrorKind::Invalid,
+        | Error::RefreshRejected { .. }
+        | Error::AccountBanned { .. } => ProviderAdminErrorKind::Invalid,
         Error::NotFound => ProviderAdminErrorKind::NotFound,
-        Error::RefreshLeaseUnavailable | Error::RefreshAmbiguous => {
+        Error::RefreshLeaseUnavailable | Error::RefreshAmbiguous { .. } => {
             ProviderAdminErrorKind::Conflict
         }
         Error::RefreshUnavailable => ProviderAdminErrorKind::Unavailable,
-    })
+    };
+    let error = provider_admin_error(kind);
+    match upstream_message {
+        Some(message) => error.with_message(message),
+        None => error,
+    }
 }
 
-const fn credential_admin_error_code(error: CodexCredentialAdminError) -> &'static str {
+const fn credential_admin_error_code(error: &CodexCredentialAdminError) -> &'static str {
     match error {
         CodexCredentialAdminError::InvalidInput => "invalid_input",
         CodexCredentialAdminError::InvalidCredential => "invalid_credential",
         CodexCredentialAdminError::NotFound => "not_found",
         CodexCredentialAdminError::MissingRefreshToken => "missing_refresh_token",
         CodexCredentialAdminError::RefreshLeaseUnavailable => "refresh_lease_unavailable",
-        CodexCredentialAdminError::RefreshRejected => "refresh_rejected",
-        CodexCredentialAdminError::AccountBanned => "account_banned",
+        CodexCredentialAdminError::RefreshRejected { .. } => "refresh_rejected",
+        CodexCredentialAdminError::AccountBanned { .. } => "account_banned",
         CodexCredentialAdminError::RefreshUnavailable => "refresh_unavailable",
-        CodexCredentialAdminError::RefreshAmbiguous => "refresh_ambiguous",
+        CodexCredentialAdminError::RefreshAmbiguous { .. } => "refresh_ambiguous",
     }
 }
 
@@ -1302,6 +1405,8 @@ const fn provider_admin_error_code(kind: ProviderAdminErrorKind) -> &'static str
         ProviderAdminErrorKind::NotFound => "not_found",
         ProviderAdminErrorKind::Conflict => "conflict",
         ProviderAdminErrorKind::Unavailable => "unavailable",
+        ProviderAdminErrorKind::CredentialRefreshRequired => "credential_refresh_required",
+        ProviderAdminErrorKind::BadGateway => "bad_gateway",
         ProviderAdminErrorKind::Internal => "internal",
     }
 }
@@ -1357,12 +1462,97 @@ fn map_quota_error(error: CodexCredentialQuotaError) -> ProviderAdminError {
     })
 }
 
+fn map_profile_statistics_error(error: CodexProfileStatisticsError) -> ProviderAdminError {
+    use CodexProfileStatisticsError as Error;
+
+    match error {
+        Error::InvalidCredentialData => provider_admin_error(ProviderAdminErrorKind::Invalid),
+        Error::NotFound => provider_admin_error(ProviderAdminErrorKind::NotFound),
+        Error::Store { .. } | Error::TransportUnavailable => {
+            provider_admin_error(ProviderAdminErrorKind::Unavailable)
+        }
+        Error::CredentialRefreshRequired { upstream_body } => {
+            let mut error = provider_admin_error(ProviderAdminErrorKind::CredentialRefreshRequired);
+            if let Some(body) = upstream_body {
+                error = error.with_message(format!(
+                    "OpenAI profile-statistics upstream returned HTTP 401: {}",
+                    bounded_upstream_body(&body)
+                ));
+            }
+            error
+        }
+        Error::Upstream {
+            status,
+            body,
+            retry_after_seconds,
+        } => {
+            let retry_after = retry_after_seconds
+                .map(|seconds| format!("; retry-after={seconds}s"))
+                .unwrap_or_default();
+            provider_admin_error(ProviderAdminErrorKind::BadGateway).with_message(format!(
+                "OpenAI profile-statistics upstream returned HTTP {status}{retry_after}: {}",
+                bounded_upstream_body(&body)
+            ))
+        }
+    }
+}
+
+fn map_reset_credits_error(error: CodexResetCreditsError) -> ProviderAdminError {
+    use CodexResetCreditsError as Error;
+
+    match error {
+        Error::InvalidCredentialData => provider_admin_error(ProviderAdminErrorKind::Invalid),
+        Error::NotFound => provider_admin_error(ProviderAdminErrorKind::NotFound),
+        Error::Store { .. } | Error::TransportUnavailable => {
+            provider_admin_error(ProviderAdminErrorKind::Unavailable)
+        }
+        Error::CredentialRefreshRequired { upstream_body } => {
+            let mut error =
+                provider_admin_error(ProviderAdminErrorKind::CredentialRefreshRequired);
+            if let Some(body) = upstream_body {
+                error = error.with_message(format!(
+                    "OpenAI reset-credit upstream returned HTTP 401: {}",
+                    bounded_upstream_body(&body)
+                ));
+            }
+            error
+        }
+        Error::Upstream {
+            status,
+            body,
+            retry_after_seconds,
+        } => {
+            let retry_after = retry_after_seconds
+                .map(|seconds| format!("; retry-after={seconds}s"))
+                .unwrap_or_default();
+            provider_admin_error(ProviderAdminErrorKind::BadGateway).with_message(format!(
+                "OpenAI reset-credit upstream returned HTTP {status}{retry_after}: {}",
+                bounded_upstream_body(&body)
+            ))
+        }
+        Error::ConsumeResultUnknown => provider_admin_error(ProviderAdminErrorKind::BadGateway)
+            .with_message(
+                "OpenAI reset-credit consume result is unknown; refresh the credit list before retrying",
+            ),
+    }
+}
+
+fn bounded_upstream_body(body: &str) -> String {
+    const MAX_ADMIN_UPSTREAM_BODY_BYTES: usize = 8 * 1024;
+    if body.len() <= MAX_ADMIN_UPSTREAM_BODY_BYTES {
+        return body.to_owned();
+    }
+    let mut end = MAX_ADMIN_UPSTREAM_BODY_BYTES;
+    while !body.is_char_boundary(end) {
+        end -= 1;
+    }
+    body[..end].to_owned()
+}
+
 fn map_catalog_error(error: CodexCredentialCatalogError) -> ProviderAdminError {
     use CodexCredentialCatalogError as Error;
     provider_admin_error(match error {
-        Error::InvalidCredentialData | Error::ConflictingModelFacts | Error::InvalidEtag => {
-            ProviderAdminErrorKind::Invalid
-        }
+        Error::InvalidCredentialData | Error::InvalidEtag => ProviderAdminErrorKind::Invalid,
         Error::NoEligibleCredential => ProviderAdminErrorKind::NotFound,
         Error::ConcurrentUpdate => ProviderAdminErrorKind::Conflict,
         Error::Upstream { .. } | Error::Cache => ProviderAdminErrorKind::Unavailable,

backend/crates/providers/openai/src/config.rs

@@ -36,15 +36,17 @@ pub struct OpenAiConfig {
 }
 
 impl OpenAiConfig {
-    /// 校验 Provider-owned 字段，并定位旧版会话锚点持续使用的身份密钥。
-    pub fn resolve_and_validate(&mut self, source_dir: &Path) -> Result<(), OpenAiConfigError> {
+    /// 校验 Provider-owned 字段，并从统一运行数据目录定位会话身份密钥。
+    pub fn resolve_and_validate(
+        &mut self,
+        runtime_data_dir: &Path,
+    ) -> Result<(), OpenAiConfigError> {
         self.api.validate()?;
         self.ws_pool.validate()?;
         self.quota.validate()?;
         self.auth.validate()?;
         self.wire_profile.validate()?;
-        let project_root = source_dir.parent().unwrap_or(source_dir);
-        self.identity_secret_path = project_root.join(".runtime/data/identity_hmac_secret");
+        self.identity_secret_path = runtime_data_dir.join("identity_hmac_secret");
         Ok(())
     }
 
@@ -101,7 +103,7 @@ impl Default for OpenAiConfig {
             quota: CodexQuotaSettings::default(),
             auth: CodexAuthSettings::default(),
             wire_profile: CodexWireProfileConfig::default(),
-            identity_secret_path: PathBuf::from(".runtime/data/identity_hmac_secret"),
+            identity_secret_path: PathBuf::new(),
         }
     }
 }
@@ -153,8 +155,6 @@ impl CodexApiConfig {
 pub struct CodexWebSocketPoolSettings {
     pub enabled: bool,
     pub max_age_ms: u64,
-    pub max_per_account: usize,
-    pub max_total: usize,
     pub max_connecting: usize,
     pub initial_event_timeout_ms: u64,
 }
@@ -164,8 +164,6 @@ impl Default for CodexWebSocketPoolSettings {
         Self {
             enabled: true,
             max_age_ms: 55 * 60 * 1000,
-            max_per_account: 8,
-            max_total: 64,
             max_connecting: 8,
             initial_event_timeout_ms: 20_000,
         }
@@ -174,12 +172,7 @@ impl Default for CodexWebSocketPoolSettings {
 
 impl CodexWebSocketPoolSettings {
     fn validate(&self) -> Result<(), OpenAiConfigError> {
-        if self.max_age_ms == 0
-            || self.max_per_account == 0
-            || self.max_total == 0
-            || self.max_connecting == 0
-            || self.max_connecting > self.max_total
-        {
+        if self.max_age_ms == 0 || self.max_connecting == 0 {
             return Err(OpenAiConfigError::InvalidField("openai.ws_pool"));
         }
         Ok(())
@@ -189,8 +182,6 @@ impl CodexWebSocketPoolSettings {
         CodexWebSocketPoolConfig {
             enabled: self.enabled,
             max_age: Duration::from_millis(self.max_age_ms),
-            max_per_account: self.max_per_account,
-            max_total: self.max_total,
             max_connecting: self.max_connecting,
             initial_event_timeout: (self.initial_event_timeout_ms != 0)
                 .then(|| Duration::from_millis(self.initial_event_timeout_ms)),
@@ -269,7 +260,7 @@ impl CodexAuthSettings {
 #[serde(deny_unknown_fields)]
 pub struct CodexWireProfileConfig {
     pub originator: String,
-    /// npm `@openai/codex` 启动版本；运行时发布任务会更新此画像字段。
+    /// 官方 Desktop ZIP 内嵌 Core 的启动基线；运行时按完整制品元组更新。
     pub codex_version: String,
     pub desktop_version: String,
     pub desktop_build: String,
@@ -284,9 +275,9 @@ impl Default for CodexWireProfileConfig {
     fn default() -> Self {
         Self {
             originator: "Codex Desktop".to_owned(),
-            codex_version: "0.146.0".to_owned(),
-            desktop_version: "26.727.51351".to_owned(),
-            desktop_build: "6119".to_owned(),
+            codex_version: "0.147.0-alpha.6.6".to_owned(),
+            desktop_version: "26.803.81509".to_owned(),
+            desktop_build: "6415".to_owned(),
             os_type: "Mac OS".to_owned(),
             os_version: "15.7.1".to_owned(),
             arch: "arm64".to_owned(),

backend/crates/providers/openai/src/credential/admin.rs

@@ -12,7 +12,7 @@ use chrono::{DateTime, FixedOffset, Utc};
 use gateway_core::engine::credential::{
     AccountErrorReason, CredentialCasUpdate, CredentialRevision, CredentialState, LoadedCredential,
     NewProviderAccount, ProviderAccount, ProviderAccountId, ProviderAccountIdentity,
-    ProviderAccountUpdate, QuotaEvidence, QuotaState,
+    ProviderAccountUpdate, QuotaState,
 };
 use gateway_core::provider_ports::{
     ProviderLeaseAcquisition, ProviderLeaseGuard, ProviderLeasePort, ProviderLeaseRequest,
@@ -28,14 +28,12 @@ use super::recovery_log::{CodexOAuthRecoveryOperation, record_oauth_recovery};
 use super::security::CodexCredentialCodec;
 use super::token_client::{RefreshFailure, TokenRefresher};
 use super::types::{
-    CODEX_AUTHENTICATION_KIND_AGENT_IDENTITY, CODEX_AUTHENTICATION_KIND_OAUTH, CodexAccountProfile,
-    CodexAgentIdentityAuthMode, CodexAgentIdentityCredentialData, CodexCredentialData,
+    CODEX_AUTHENTICATION_KIND_OAUTH, CodexAccountProfile, CodexCredentialData,
     CodexCredentialPrincipal, CodexOAuthMetadata, CodexOAuthSecret, parse_access_token_expiration,
     parse_chatgpt_jwt_claims,
 };
 
 const PROVIDER_NAME: &str = "openai";
-const CODEX_CREDENTIAL_SCHEMA_VERSION: u32 = 1;
 const MAX_BATCH: usize = 200;
 const MAX_IMPORT_DOCUMENT_BYTES: usize = 64 * 1024 * 1024;
 
@@ -55,6 +53,7 @@ pub struct ImportCodexOAuthCredential {
 pub(crate) struct UnresolvedCodexOAuthCredential {
     pub(crate) account_id: String,
     pub(crate) name: String,
+    pub(crate) installation_id: String,
     pub(crate) secret: CodexOAuthSecret,
     pub(crate) metadata: CodexOAuthMetadata,
     pub(crate) access_token_expires_at: Option<DateTime<Utc>>,
@@ -68,6 +67,7 @@ impl fmt::Debug for UnresolvedCodexOAuthCredential {
             .debug_struct("UnresolvedCodexOAuthCredential")
             .field("account_id", &self.account_id)
             .field("name", &self.name)
+            .field("installation_id", &"<pseudonymous>")
             .field("secret", &"<redacted>")
             .field("metadata", &self.metadata)
             .field("access_token_expires_at", &self.access_token_expires_at)
@@ -119,56 +119,31 @@ impl fmt::Debug for PreparedCodexAccountImport {
 }
 
 struct ParsedCodexImportAccount {
-    id: Option<String>,
     name: Option<String>,
     email: Option<String>,
-    plan_type: Option<String>,
-    chatgpt_account_id: Option<String>,
-    chatgpt_user_id: Option<String>,
     authentication: ParsedCodexAuthentication,
-    status: Option<String>,
 }
 
-enum ParsedCodexAuthentication {
-    OAuth {
-        access_token: Option<String>,
-        refresh_token: Option<String>,
-        id_token: Option<String>,
-    },
-    AgentIdentity {
-        runtime_id: String,
-        private_key: String,
-        task_id: Option<String>,
-    },
+struct ParsedCodexAuthentication {
+    access_token: Option<String>,
+    refresh_token: Option<String>,
+    id_token: Option<String>,
 }
 
 impl fmt::Debug for ParsedCodexAuthentication {
     fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        match self {
-            Self::OAuth {
-                access_token,
-                refresh_token,
-                id_token,
-            } => formatter
-                .debug_struct("OAuth")
-                .field("access_token", &access_token.as_ref().map(|_| "<redacted>"))
-                .field(
-                    "refresh_token",
-                    &refresh_token.as_ref().map(|_| "<redacted>"),
-                )
-                .field("id_token", &id_token.as_ref().map(|_| "<redacted>"))
-                .finish(),
-            Self::AgentIdentity {
-                runtime_id: _,
-                private_key: _,
-                task_id,
-            } => formatter
-                .debug_struct("AgentIdentity")
-                .field("runtime_id", &"<redacted>")
-                .field("private_key", &"<redacted>")
-                .field("task_id", &task_id.as_ref().map(|_| "<redacted>"))
-                .finish(),
-        }
+        formatter
+            .debug_struct("OAuth")
+            .field(
+                "access_token",
+                &self.access_token.as_ref().map(|_| "<redacted>"),
+            )
+            .field(
+                "refresh_token",
+                &self.refresh_token.as_ref().map(|_| "<redacted>"),
+            )
+            .field("id_token", &self.id_token.as_ref().map(|_| "<redacted>"))
+            .finish()
     }
 }
 
@@ -176,20 +151,9 @@ impl fmt::Debug for ParsedCodexImportAccount {
     fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
         formatter
             .debug_struct("ParsedCodexImportAccount")
-            .field("id", &self.id)
             .field("name", &self.name)
             .field("email", &self.email.as_ref().map(|_| "<redacted>"))
-            .field("plan_type", &self.plan_type)
-            .field(
-                "chatgpt_account_id",
-                &self.chatgpt_account_id.as_ref().map(|_| "<redacted>"),
-            )
-            .field(
-                "chatgpt_user_id",
-                &self.chatgpt_user_id.as_ref().map(|_| "<redacted>"),
-            )
             .field("authentication", &self.authentication)
-            .field("status", &self.status)
             .finish()
     }
 }
@@ -220,7 +184,7 @@ impl fmt::Debug for ExportManagedCodexCredential {
 #[serde(rename_all = "camelCase")]
 pub struct CodexCprExportDocument {
     source_format: &'static str,
-    accounts: Vec<CodexCprExportAccount>,
+    accounts: Vec<CodexCprOAuthExportAccount>,
 }
 
 impl CodexCprExportDocument {
@@ -275,25 +239,6 @@ struct CodexCprOAuthExportAccount {
     access_token_expires_at: Option<String>,
 }
 
-#[derive(Serialize)]
-#[serde(rename_all = "camelCase")]
-struct CodexCprAgentIdentityExportAccount {
-    #[serde(flatten)]
-    common: CodexCprExportCommon,
-    auth_mode: &'static str,
-    agent_runtime_id: String,
-    agent_private_key: String,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    task_id: Option<String>,
-}
-
-#[derive(Serialize)]
-#[serde(untagged)]
-enum CodexCprExportAccount {
-    OAuth(CodexCprOAuthExportAccount),
-    AgentIdentity(CodexCprAgentIdentityExportAccount),
-}
-
 /// App 已从 Store 读取的当前账号、revision 与明文 Provider JSON。
 pub struct RotateManagedCodexCredential {
     pub current: LoadedCredential,
@@ -374,7 +319,7 @@ impl fmt::Debug for PreparedCodexCredentialRotationGuard {
     }
 }
 
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Error)]
+#[derive(Debug, Clone, PartialEq, Eq, Error)]
 pub enum CodexCredentialAdminError {
     #[error("Codex account input is invalid")]
     InvalidInput,
@@ -387,13 +332,30 @@ pub enum CodexCredentialAdminError {
     #[error("Codex refresh lease is unavailable")]
     RefreshLeaseUnavailable,
     #[error("Codex refresh token was rejected")]
-    RefreshRejected,
+    RefreshRejected { message: Option<String> },
     #[error("Codex account is banned")]
-    AccountBanned,
+    AccountBanned { message: Option<String> },
     #[error("Codex refresh service is unavailable")]
     RefreshUnavailable,
     #[error("Codex refresh send state is ambiguous")]
-    RefreshAmbiguous,
+    RefreshAmbiguous { message: Option<String> },
+}
+
+impl CodexCredentialAdminError {
+    #[must_use]
+    pub fn upstream_message(&self) -> Option<&str> {
+        match self {
+            Self::RefreshRejected { message }
+            | Self::AccountBanned { message }
+            | Self::RefreshAmbiguous { message } => message.as_deref(),
+            Self::InvalidInput
+            | Self::InvalidCredential
+            | Self::NotFound
+            | Self::MissingRefreshToken
+            | Self::RefreshLeaseUnavailable
+            | Self::RefreshUnavailable => None,
+        }
+    }
 }
 
 /// 无状态的 Codex Admin command preparer。
@@ -473,8 +435,12 @@ impl CodexCredentialAdmin {
             chatgpt_account_id: upstream_account_id,
         } = input.metadata;
         let has_upstream_user_id = upstream_user_id.is_some();
-        let credential = CodexCredentialCodec::encode_unresolved(&input.secret, Vec::new())
-            .map_err(|_| CodexCredentialAdminError::InvalidCredential)?;
+        let credential = CodexCredentialCodec::encode_unresolved(
+            &input.secret,
+            input.installation_id,
+            Vec::new(),
+        )
+        .map_err(|_| CodexCredentialAdminError::InvalidCredential)?;
         let account = ProviderAccount::new(
             account_id,
             provider,
@@ -544,7 +510,7 @@ impl CodexCredentialAdmin {
                     {
                         return Err(CodexCredentialAdminError::InvalidCredential);
                     }
-                    CodexCprExportAccount::OAuth(CodexCprOAuthExportAccount {
+                    CodexCprOAuthExportAccount {
                         common,
                         access_token: data.access_token,
                         refresh_token: data.refresh_token,
@@ -553,22 +519,7 @@ impl CodexCredentialAdmin {
                             .access_token_expires_at()
                             .map(DateTime::<Utc>::from)
                             .map(|value| value.to_rfc3339()),
-                    })
-                }
-                CodexCredentialData::AgentIdentity(data) => {
-                    if account.authentication_kind() != CODEX_AUTHENTICATION_KIND_AGENT_IDENTITY
-                        || account.has_refresh_token()
-                        || account.access_token_expires_at().is_some()
-                    {
-                        return Err(CodexCredentialAdminError::InvalidCredential);
                     }
-                    CodexCprExportAccount::AgentIdentity(CodexCprAgentIdentityExportAccount {
-                        common,
-                        auth_mode: "agentIdentity",
-                        agent_runtime_id: data.agent_runtime_id,
-                        agent_private_key: data.agent_private_key,
-                        task_id: data.task_id,
-                    })
                 }
             };
             accounts.push(exported);
@@ -794,8 +745,15 @@ impl CodexCredentialAdminService {
             .refresher
             .refresh(refresh_token.expose_secret())
             .await
+            .inspect_err(|error| log_manual_refresh_failure(&account_id, error))
             .map_err(map_refresh_failure)?;
-        let access_token_rotated = tokens.access_token.is_some();
+        let access_token_expires_at = match tokens.access_token.as_deref() {
+            Some(access_token) => parse_access_token_expiration(access_token),
+            None => current
+                .account
+                .access_token_expires_at()
+                .map(DateTime::<Utc>::from),
+        };
         let secret = CodexOAuthSecret {
             access_token: tokens
                 .access_token
@@ -815,17 +773,6 @@ impl CodexCredentialAdminService {
             Some(account_id.as_str()),
             &secret,
         );
-        let access_token_expires_at = if access_token_rotated {
-            tokens
-                .expires_in
-                .and_then(|expires_in| SystemTime::now().checked_add(expires_in))
-                .map(DateTime::<Utc>::from)
-        } else {
-            current
-                .account
-                .access_token_expires_at()
-                .map(DateTime::<Utc>::from)
-        };
         // 正常预刷新由 worker 读取当时的 runtime policy 动态判断；这里仅清除
         // 之前瞬态失败留下的 retry-not-before。
         let next_refresh_at = None;
@@ -842,7 +789,7 @@ impl CodexCredentialAdminService {
         Ok(prepared)
     }
 
-    /// 归一导入 OAuth/agent-identity 凭据到唯一 `NewProviderAccount` 写入路径。
+    /// 归一导入 OAuth 凭据到唯一 `NewProviderAccount` 写入路径。
     ///
     /// OAuth 导入先取得 access token（直接提供或 RT exchange），再按官方
     /// `parse_chatgpt_jwt_claims` 从 ID token/access token 本地投影账号资料。
@@ -861,100 +808,57 @@ impl CodexCredentialAdminService {
         if candidates.is_empty() || candidates.len() > MAX_BATCH {
             return Err(CodexCredentialAdminError::InvalidInput);
         }
-        let mut account_ids = BTreeSet::new();
-        let mut upstream_identities = BTreeSet::new();
         let mut accounts = Vec::with_capacity(candidates.len());
         for candidate in candidates {
-            let prepared = match &candidate.authentication {
-                ParsedCodexAuthentication::OAuth {
-                    access_token,
-                    refresh_token,
-                    id_token,
-                } => {
-                    let account_id = format!("acct_{}", uuid::Uuid::now_v7().simple());
-                    if !account_ids.insert(account_id.clone()) {
-                        return Err(CodexCredentialAdminError::InvalidInput);
-                    }
-                    let typed_account_id = ProviderAccountId::new(account_id.clone())
-                        .map_err(|_| CodexCredentialAdminError::InvalidInput)?;
-                    let (secret, access_token_expires_at) = self
-                        .resolve_import_tokens(
-                            &typed_account_id,
-                            access_token.clone(),
-                            refresh_token.clone(),
-                            id_token.clone(),
-                        )
-                        .await?;
-                    // 与官方 `parse_chatgpt_jwt_claims` 一致：先读 ID token，缺失字段
-                    // 再由 access token 补齐。解析失败不阻塞 token 入库。
-                    let id_metadata = secret
-                        .id_token
-                        .as_ref()
-                        .and_then(|token| parse_chatgpt_jwt_claims(token.expose_secret()).ok())
-                        .unwrap_or_default();
-                    let access_metadata =
-                        parse_chatgpt_jwt_claims(secret.access_token.expose_secret())
-                            .unwrap_or_default();
-                    let metadata = CodexOAuthMetadata {
-                        email: id_metadata.email.or(access_metadata.email),
-                        chatgpt_plan_type: id_metadata
-                            .chatgpt_plan_type
-                            .or(access_metadata.chatgpt_plan_type),
-                        chatgpt_user_id: id_metadata
-                            .chatgpt_user_id
-                            .or(access_metadata.chatgpt_user_id),
-                        chatgpt_account_id: id_metadata
-                            .chatgpt_account_id
-                            .or(access_metadata.chatgpt_account_id),
-                    };
-                    CodexCredentialAdmin.prepare_unresolved_oauth(
-                        UnresolvedCodexOAuthCredential {
-                            account_id,
-                            name: candidate
-                                .name
-                                .clone()
-                                .or_else(|| candidate.email.clone())
-                                .or_else(|| metadata.email.clone())
-                                .filter(|name| !name.trim().is_empty())
-                                .unwrap_or_else(|| "Codex OAuth".to_owned()),
-                            secret,
-                            metadata,
-                            access_token_expires_at,
-                            next_refresh_at: None,
-                            enabled: true,
-                        },
-                    )?
-                }
-                ParsedCodexAuthentication::AgentIdentity { .. } => {
-                    let account_id = candidate
-                        .id
-                        .clone()
-                        .filter(|id| ProviderAccountId::new(id.clone()).is_ok())
-                        .unwrap_or_else(|| format!("acct_{}", uuid::Uuid::now_v7().simple()));
-                    if !account_ids.insert(account_id.clone()) {
-                        return Err(CodexCredentialAdminError::InvalidInput);
-                    }
-                    let facts =
-                        parse_cpr_account_facts(candidate.status.as_deref(), SystemTime::now())?;
-                    let mut account =
-                        self.prepare_agent_identity_import(&candidate, account_id, facts.enabled)?;
-                    let upstream_user_id = account
-                        .account
-                        .upstream_user_id()
-                        .ok_or(CodexCredentialAdminError::InvalidInput)?
-                        .to_owned();
-                    let upstream_account_id = account
-                        .account
-                        .upstream_account_id()
-                        .ok_or(CodexCredentialAdminError::InvalidInput)?
-                        .to_owned();
-                    if !upstream_identities.insert((upstream_user_id, upstream_account_id)) {
-                        return Err(CodexCredentialAdminError::InvalidInput);
-                    }
-                    account.account = facts.apply(account.account);
-                    account
-                }
+            let account_id = format!("acct_{}", uuid::Uuid::now_v7().simple());
+            let typed_account_id = ProviderAccountId::new(account_id.clone())
+                .map_err(|_| CodexCredentialAdminError::InvalidInput)?;
+            let (secret, access_token_expires_at) = self
+                .resolve_import_tokens(
+                    &typed_account_id,
+                    candidate.authentication.access_token.clone(),
+                    candidate.authentication.refresh_token.clone(),
+                    candidate.authentication.id_token.clone(),
+                )
+                .await?;
+            // 与官方 `parse_chatgpt_jwt_claims` 一致：先读 ID token，缺失字段
+            // 再由 access token 补齐。解析失败不阻塞 token 入库。
+            let id_metadata = secret
+                .id_token
+                .as_ref()
+                .and_then(|token| parse_chatgpt_jwt_claims(token.expose_secret()).ok())
+                .unwrap_or_default();
+            let access_metadata =
+                parse_chatgpt_jwt_claims(secret.access_token.expose_secret()).unwrap_or_default();
+            let metadata = CodexOAuthMetadata {
+                email: id_metadata.email.or(access_metadata.email),
+                chatgpt_plan_type: id_metadata
+                    .chatgpt_plan_type
+                    .or(access_metadata.chatgpt_plan_type),
+                chatgpt_user_id: id_metadata
+                    .chatgpt_user_id
+                    .or(access_metadata.chatgpt_user_id),
+                chatgpt_account_id: id_metadata
+                    .chatgpt_account_id
+                    .or(access_metadata.chatgpt_account_id),
             };
+            let prepared =
+                CodexCredentialAdmin.prepare_unresolved_oauth(UnresolvedCodexOAuthCredential {
+                    account_id,
+                    name: candidate
+                        .name
+                        .clone()
+                        .or_else(|| candidate.email.clone())
+                        .or_else(|| metadata.email.clone())
+                        .filter(|name| !name.trim().is_empty())
+                        .unwrap_or_else(|| "Codex OAuth".to_owned()),
+                    installation_id: uuid::Uuid::new_v4().to_string(),
+                    secret,
+                    metadata,
+                    access_token_expires_at,
+                    next_refresh_at: None,
+                    enabled: true,
+                })?;
             accounts.push(prepared);
         }
         Ok(PreparedCodexAccountImport { accounts })
@@ -991,6 +895,7 @@ impl CodexCredentialAdminService {
         let access_token = tokens
             .access_token
             .ok_or(CodexCredentialAdminError::InvalidCredential)?;
+        let access_token_expires_at = parse_access_token_expiration(&access_token);
         let secret = CodexOAuthSecret {
             access_token: SecretString::from(access_token),
             // RT 未轮换时仍保留导入提供的 RT，保证本次补全不会丢失后续刷新能力。
@@ -1005,10 +910,6 @@ impl CodexCredentialAdminService {
             Some(account_id.as_str()),
             &secret,
         );
-        let access_token_expires_at = tokens
-            .expires_in
-            .and_then(|expires_in| SystemTime::now().checked_add(expires_in))
-            .map(DateTime::<Utc>::from);
         Ok((secret, access_token_expires_at))
     }
 
@@ -1027,79 +928,6 @@ impl CodexCredentialAdminService {
                 .map(ExposeSecret::expose_secret),
         );
     }
-
-    fn prepare_agent_identity_import(
-        &self,
-        candidate: &ParsedCodexImportAccount,
-        account_id: String,
-        enabled: bool,
-    ) -> Result<NewProviderAccount, CodexCredentialAdminError> {
-        let ParsedCodexAuthentication::AgentIdentity {
-            runtime_id,
-            private_key,
-            task_id,
-        } = &candidate.authentication
-        else {
-            return Err(CodexCredentialAdminError::InvalidCredential);
-        };
-        let upstream_account_id = candidate
-            .chatgpt_account_id
-            .clone()
-            .ok_or(CodexCredentialAdminError::InvalidInput)?;
-        let upstream_user_id = candidate
-            .chatgpt_user_id
-            .clone()
-            .ok_or(CodexCredentialAdminError::InvalidInput)?;
-        let account_id = ProviderAccountId::new(account_id)
-            .map_err(|_| CodexCredentialAdminError::InvalidInput)?;
-        let provider = ProviderKind::new(PROVIDER_NAME)
-            .map_err(|_| CodexCredentialAdminError::InvalidInput)?;
-        let revision =
-            CredentialRevision::new(1).map_err(|_| CodexCredentialAdminError::InvalidCredential)?;
-        let credential =
-            CodexCredentialCodec::encode_agent_identity(CodexAgentIdentityCredentialData {
-                schema_version: CODEX_CREDENTIAL_SCHEMA_VERSION,
-                auth_mode: CodexAgentIdentityAuthMode::AgentIdentity,
-                installation_id: uuid::Uuid::new_v4().to_string(),
-                agent_runtime_id: runtime_id.clone(),
-                agent_private_key: private_key.clone(),
-                task_id: task_id.clone(),
-                cookies: Vec::new(),
-            })
-            .map_err(|_| CodexCredentialAdminError::InvalidCredential)?;
-        let name = candidate
-            .name
-            .clone()
-            .or_else(|| candidate.email.clone())
-            .filter(|name| !name.trim().is_empty())
-            .unwrap_or_else(|| "OpenAI Agent Identity".to_owned());
-        let account = ProviderAccount::new(
-            account_id,
-            provider,
-            name,
-            Some(upstream_user_id),
-            CODEX_AUTHENTICATION_KIND_AGENT_IDENTITY.to_owned(),
-            revision,
-            None,
-        )
-        .with_profile(
-            candidate.email.clone(),
-            Some(upstream_account_id),
-            candidate.plan_type.clone(),
-        )
-        .with_account_facts(
-            enabled,
-            CredentialState::Ready,
-            QuotaState::unknown(),
-            None,
-            None,
-        )
-        .with_refresh_schedule(false, None);
-        Ok(NewProviderAccount {
-            account,
-            credential,
-        })
-    }
 }
 
 fn optional_time(value: Option<chrono::DateTime<chrono::Utc>>) -> Option<SystemTime> {
@@ -1126,24 +954,40 @@ fn china_rfc3339(value: DateTime<Utc>) -> String {
         .to_rfc3339()
 }
 
-const fn map_refresh_failure(error: RefreshFailure) -> CodexCredentialAdminError {
+fn map_refresh_failure(error: RefreshFailure) -> CodexCredentialAdminError {
     match error {
-        RefreshFailure::InvalidGrant => CodexCredentialAdminError::RefreshRejected,
-        RefreshFailure::Banned => CodexCredentialAdminError::AccountBanned,
-        RefreshFailure::RetryableTransport => CodexCredentialAdminError::RefreshUnavailable,
-        RefreshFailure::Transport => CodexCredentialAdminError::RefreshAmbiguous,
+        RefreshFailure::InvalidGrant { message, .. } => {
+            CodexCredentialAdminError::RefreshRejected { message }
+        }
+        RefreshFailure::Banned { message, .. } => {
+            CodexCredentialAdminError::AccountBanned { message }
+        }
+        RefreshFailure::RetryableTransport { .. } => CodexCredentialAdminError::RefreshUnavailable,
+        RefreshFailure::Transport { message, .. } => {
+            CodexCredentialAdminError::RefreshAmbiguous { message }
+        }
     }
 }
 
+fn log_manual_refresh_failure(account_id: &ProviderAccountId, error: &RefreshFailure) {
+    let upstream = error.upstream();
+    tracing::warn!(
+        account_id = %account_id,
+        failure_class = error.classification(),
+        upstream_message = ?error.message(),
+        upstream_status = ?upstream.map(super::token_client::RefreshUpstreamFailure::status),
+        upstream_code = ?upstream.and_then(super::token_client::RefreshUpstreamFailure::code),
+        upstream_type = ?upstream.and_then(super::token_client::RefreshUpstreamFailure::error_type),
+        upstream_body = ?upstream.map(super::token_client::RefreshUpstreamFailure::body),
+        "OpenAI OAuth manual refresh failed"
+    );
+}
+
 fn parse_import_document(
     payload: &Value,
 ) -> Result<Vec<ParsedCodexImportAccount>, CodexCredentialAdminError> {
     let mut accounts = Vec::new();
     for value in import_account_values(payload)? {
-        if looks_like_agent_identity_account(value) {
-            accounts.push(parse_agent_identity_account(value)?);
-            continue;
-        }
         if !is_openai_oauth_candidate(value) {
             continue;
         }
@@ -1157,72 +1001,9 @@ fn parse_oauth_import_account(
 ) -> Result<ParsedCodexImportAccount, CodexCredentialAdminError> {
     let credentials = value.get("credentials").unwrap_or(value);
     Ok(ParsedCodexImportAccount {
-        id: first_string(value, &["id"]),
         name: first_string(value, &["name", "label"]),
         email: first_string(value, &["email"]).or_else(|| first_string(credentials, &["email"])),
-        plan_type: first_string(value, &["plan_type", "planType"])
-            .or_else(|| first_string(credentials, &["plan_type", "planType"])),
-        chatgpt_account_id: None,
-        chatgpt_user_id: None,
         authentication: parse_oauth_import_tokens(value)?,
-        status: first_string(value, &["status"]),
-    })
-}
-
-fn parse_agent_identity_account(
-    value: &Value,
-) -> Result<ParsedCodexImportAccount, CodexCredentialAdminError> {
-    let account = value
-        .as_object()
-        .ok_or(CodexCredentialAdminError::InvalidInput)?;
-    if account
-        .get("platform")
-        .and_then(Value::as_str)
-        .is_some_and(|platform| !platform.eq_ignore_ascii_case("openai"))
-        || account
-            .get("type")
-            .and_then(Value::as_str)
-            .is_some_and(|kind| !kind.eq_ignore_ascii_case("oauth"))
-    {
-        return Err(CodexCredentialAdminError::InvalidInput);
-    }
-    let identity = value
-        .get("agent_identity")
-        .or_else(|| value.get("credentials"))
-        .unwrap_or(value);
-    let auth_mode = first_string(value, &["auth_mode", "authMode"])
-        .or_else(|| first_string(identity, &["auth_mode", "authMode"]));
-    if auth_mode.as_deref() != Some("agentIdentity") {
-        return Err(CodexCredentialAdminError::InvalidCredential);
-    }
-    let runtime_id = first_string(identity, &["agent_runtime_id", "agentRuntimeId"])
-        .ok_or(CodexCredentialAdminError::InvalidCredential)?;
-    let private_key = first_string(identity, &["agent_private_key", "agentPrivateKey"])
-        .ok_or(CodexCredentialAdminError::InvalidCredential)?;
-    Ok(ParsedCodexImportAccount {
-        id: first_string(value, &["id"]),
-        name: first_string(value, &["name", "label"]),
-        email: first_string(identity, &["email"]),
-        plan_type: first_string(identity, &["plan_type", "planType"]),
-        chatgpt_account_id: first_string(
-            identity,
-            &[
-                "chatgpt_account_id",
-                "chatgptAccountId",
-                "account_id",
-                "accountId",
-            ],
-        ),
-        chatgpt_user_id: first_string(
-            identity,
-            &["chatgpt_user_id", "chatgptUserId", "user_id", "userId"],
-        ),
-        authentication: ParsedCodexAuthentication::AgentIdentity {
-            runtime_id,
-            private_key,
-            task_id: first_string(identity, &["task_id", "taskId"]),
-        },
-        status: first_string(value, &["status"]),
     })
 }
 
@@ -1251,9 +1032,9 @@ fn parse_oauth_import_tokens(
             Value::Object(object) => {
                 for (key, value) in object {
                     let token = match key.as_str() {
-                        "accessToken" => &mut access_token,
-                        "refreshToken" => &mut refresh_token,
-                        "idToken" => &mut id_token,
+                        "accessToken" | "access_token" => &mut access_token,
+                        "refreshToken" | "refresh_token" => &mut refresh_token,
+                        "idToken" | "id_token" => &mut id_token,
                         _ => {
                             pending.push(value);
                             continue;
@@ -1271,24 +1052,13 @@ fn parse_oauth_import_tokens(
     if access_token.is_none() && refresh_token.is_none() {
         return Err(CodexCredentialAdminError::InvalidCredential);
     }
-    Ok(ParsedCodexAuthentication::OAuth {
+    Ok(ParsedCodexAuthentication {
         access_token,
         refresh_token,
         id_token,
     })
 }
 
-fn looks_like_agent_identity_account(value: &Value) -> bool {
-    let identity = value
-        .get("agent_identity")
-        .or_else(|| value.get("credentials"))
-        .unwrap_or(value);
-    first_string(value, &["auth_mode", "authMode"])
-        .or_else(|| first_string(identity, &["auth_mode", "authMode"]))
-        .is_some_and(|mode| mode == "agentIdentity")
-        || first_string(identity, &["agent_runtime_id", "agentRuntimeId"]).is_some()
-}
-
 fn is_openai_oauth_candidate(value: &Value) -> bool {
     let Some(account) = value.as_object() else {
         return false;
@@ -1317,66 +1087,3 @@ fn first_string(value: &Value, keys: &[&str]) -> Option<String> {
         .filter(|value| !value.is_empty())
         .map(str::to_owned)
 }
-
-struct ImportedCprAccountFacts {
-    enabled: bool,
-    credential_state: CredentialState,
-    quota: QuotaState,
-    error_reason: Option<AccountErrorReason>,
-}
-
-impl ImportedCprAccountFacts {
-    fn apply(self, account: ProviderAccount) -> ProviderAccount {
-        account.with_account_facts(
-            self.enabled,
-            self.credential_state,
-            self.quota,
-            self.error_reason,
-            None,
-        )
-    }
-}
-
-fn parse_cpr_account_facts(
-    status: Option<&str>,
-    observed_at: SystemTime,
-) -> Result<ImportedCprAccountFacts, CodexCredentialAdminError> {
-    match status
-        .map(str::trim)
-        .unwrap_or("active")
-        .to_ascii_lowercase()
-        .as_str()
-    {
-        "active" => Ok(ImportedCprAccountFacts {
-            enabled: true,
-            credential_state: CredentialState::Ready,
-            quota: QuotaState::unknown(),
-            error_reason: None,
-        }),
-        "disabled" => Ok(ImportedCprAccountFacts {
-            enabled: false,
-            credential_state: CredentialState::Ready,
-            quota: QuotaState::unknown(),
-            error_reason: None,
-        }),
-        "expired" => Ok(ImportedCprAccountFacts {
-            enabled: true,
-            credential_state: CredentialState::Expired,
-            quota: QuotaState::unknown(),
-            error_reason: Some(AccountErrorReason::CredentialExpired),
-        }),
-        "quota_exhausted" => Ok(ImportedCprAccountFacts {
-            enabled: true,
-            credential_state: CredentialState::Ready,
-            quota: QuotaState::exhausted(QuotaEvidence::ProviderDenied, observed_at, None),
-            error_reason: None,
-        }),
-        "banned" => Ok(ImportedCprAccountFacts {
-            enabled: true,
-            credential_state: CredentialState::Banned,
-            quota: QuotaState::unknown(),
-            error_reason: Some(AccountErrorReason::AccountBanned),
-        }),
-        _ => Err(CodexCredentialAdminError::InvalidInput),
-    }
-}

backend/crates/providers/openai/src/credential/affinity.rs

@@ -1,4 +1,4 @@
-//! OpenAI 会话锚点到 Store 不透明亲和键的单向派生。
+//! OpenAI 根会话锚点到 Store 不透明账号亲和键及诊断上下文的单向派生。
 
 use gateway_core::policy::ClientApiKeyId;
 use gateway_core::provider_ports::ProviderSessionAffinityKey;
@@ -7,46 +7,109 @@ use sha2::{Digest, Sha256};
 use crate::transport::protocol::responses::CodexResponsesRequest;
 use crate::transport::request::derive_conversation_anchor;
 
-pub(crate) fn derive_codex_session_affinity_key(
+const AFFINITY_KEY_HASH_LENGTH: usize = 12;
+
+/// 一次请求派生出的账号亲和键及其结构化日志上下文。
+pub(crate) struct CodexSessionAffinity {
+    key: ProviderSessionAffinityKey,
+    key_hash: String,
+    anchor_source: &'static str,
+    anchor: String,
+    session_id: Option<String>,
+}
+
+impl CodexSessionAffinity {
+    #[must_use]
+    pub(crate) const fn key(&self) -> &ProviderSessionAffinityKey {
+        &self.key
+    }
+
+    #[must_use]
+    pub(crate) fn key_hash(&self) -> &str {
+        &self.key_hash
+    }
+
+    #[must_use]
+    pub(crate) const fn anchor_source(&self) -> &'static str {
+        self.anchor_source
+    }
+
+    #[must_use]
+    pub(crate) fn anchor(&self) -> &str {
+        &self.anchor
+    }
+
+    #[must_use]
+    pub(crate) fn session_id(&self) -> Option<&str> {
+        self.session_id.as_deref()
+    }
+
+    #[must_use]
+    pub(crate) const fn session_id_present(&self) -> bool {
+        self.session_id.is_some()
+    }
+
+    #[must_use]
+    pub(crate) fn into_key(self) -> ProviderSessionAffinityKey {
+        self.key
+    }
+}
+
+pub(crate) fn derive_codex_session_affinity(
     request: &CodexResponsesRequest,
     client_api_key_id: &ClientApiKeyId,
-) -> Option<ProviderSessionAffinityKey> {
-    let session_key = if let Some(conversation_id) = request
-        .local_conversation_id
-        .as_deref()
-        .map(str::trim)
-        .filter(|value| !value.is_empty())
-    {
-        if let Ok(key) = ProviderSessionAffinityKey::try_new(conversation_id.to_owned()) {
-            Some(key)
-        } else {
-            opaque_affinity_key("local-conversation", conversation_id)
-        }
-    } else {
-        let (domain, value) = derive_conversation_anchor(request)?;
-        opaque_affinity_key(domain, &value)
-    };
-
-    let session_discriminator = request.subagent_kind();
-    let session_key =
-        session_key.and_then(|session_key| match session_discriminator.as_deref() {
-            None => Some(session_key),
-            Some(discriminator) => {
-                // 仅扩展原会话锚点的键空间；后续查找、绑定和调度仍使用同一套亲和逻辑。
-                opaque_affinity_key(
-                    "subagent-session",
-                    &format!("{discriminator}\0{}", session_key.expose_to_store()),
-                )
-            }
-        })?;
-    opaque_affinity_key(
+) -> Option<CodexSessionAffinity> {
+    let session_id = non_empty(request.client_session_id.as_deref()).map(str::to_owned);
+    let (anchor_source, anchor) = derive_account_affinity_anchor(request)?;
+    let session_key = opaque_affinity_key(anchor_source, &anchor)?;
+    let key = opaque_affinity_key(
         "client-session",
         &format!(
             "{}\0{}",
             client_api_key_id.as_str(),
             session_key.expose_to_store()
         ),
-    )
+    )?;
+    // 亲和键本身已经是 SHA-256；日志沿用 WebSocket 诊断的 12 位短哈希长度。
+    let key_hash = key
+        .expose_to_store()
+        .chars()
+        .take(AFFINITY_KEY_HASH_LENGTH)
+        .collect();
+    Some(CodexSessionAffinity {
+        key,
+        key_hash,
+        anchor_source,
+        anchor,
+        session_id,
+    })
+}
+
+/// 账号选择优先使用根会话事实；`local_conversation_id` 仍可按 child thread 隔离
+/// WebSocket 与 continuation 状态，但 child 身份不再拆分账号首选项。账号不可调度时
+/// selector 仍可按既有策略切换，并由 request scope 清理账号绑定状态。
+fn derive_account_affinity_anchor(
+    request: &CodexResponsesRequest,
+) -> Option<(&'static str, String)> {
+    non_empty(request.client_session_id.as_deref())
+        .map(|value| ("root-session", value.to_owned()))
+        .or_else(|| {
+            non_empty(request.client_conversation_id.as_deref())
+                .map(|value| ("root-conversation", value.to_owned()))
+        })
+        .or_else(|| {
+            request
+                .explicit_prompt_cache_key
+                .then(|| request.prompt_cache_key())
+                .flatten()
+                .and_then(|value| non_empty(Some(value)))
+                .map(|value| ("root-prompt-cache", value.to_owned()))
+        })
+        .or_else(|| {
+            non_empty(request.local_conversation_id.as_deref())
+                .map(|value| ("local-conversation", value.to_owned()))
+        })
+        .or_else(|| derive_conversation_anchor(request))
 }
 
 fn opaque_affinity_key(domain: &str, value: &str) -> Option<ProviderSessionAffinityKey> {

backend/crates/providers/openai/src/credential/agent_identity.rs

@@ -1,486 +0,0 @@
-//! OpenAI Agent Identity 签名、task 注册与 revision-fenced 恢复。
-
-use std::collections::HashMap;
-use std::fmt;
-use std::sync::Arc;
-
-use async_trait::async_trait;
-use base64::Engine as _;
-use base64::engine::general_purpose::{STANDARD, URL_SAFE_NO_PAD};
-use chrono::{DateTime, SecondsFormat, Utc};
-use crypto_box::SecretKey as BoxSecretKey;
-use ed25519_dalek::pkcs8::DecodePrivateKey as _;
-use ed25519_dalek::{Signer as _, SigningKey};
-use gateway_core::engine::credential::{ProviderAccount, ProviderAccountId};
-use reqwest::StatusCode;
-use secrecy::SecretString;
-use serde::{Deserialize, Serialize};
-use sha2::{Digest as _, Sha512};
-use thiserror::Error;
-use tokio::sync::Mutex;
-use url::Url;
-
-use super::repository::{CodexCredentialRepository, CredentialRepositoryError};
-use super::security::{CodexRuntimeAuthentication, CodexRuntimeCredential};
-use crate::transport::websocket::CodexWebSocketExchangeError;
-use crate::transport::{CodexClientError, CodexWebSocketPool};
-
-const OFFICIAL_AGENT_IDENTITY_AUTH_BASE_URL: &str = "https://auth.openai.com/api/accounts/";
-const MAX_TASK_RESPONSE_BYTES: usize = 64 * 1024;
-
-/// 已验证且只存在于 OpenAI Provider 运行时的 Agent Identity 密钥。
-pub struct CodexAgentIdentitySecret {
-    runtime_id: String,
-    signing_key: SigningKey,
-    task_id: Option<String>,
-}
-
-impl CodexAgentIdentitySecret {
-    pub fn from_pkcs8(
-        runtime_id: String,
-        encoded_private_key: &str,
-        task_id: Option<String>,
-    ) -> Result<Self, CodexAgentIdentityError> {
-        if !valid_identifier(&runtime_id)
-            || task_id
-                .as_deref()
-                .is_some_and(|value| !valid_identifier(value))
-        {
-            return Err(CodexAgentIdentityError::InvalidCredential);
-        }
-        let der = STANDARD
-            .decode(encoded_private_key.trim())
-            .map_err(|_| CodexAgentIdentityError::InvalidCredential)?;
-        let signing_key = SigningKey::from_pkcs8_der(&der)
-            .map_err(|_| CodexAgentIdentityError::InvalidCredential)?;
-        Ok(Self {
-            runtime_id,
-            signing_key,
-            task_id,
-        })
-    }
-
-    #[must_use]
-    pub fn runtime_id(&self) -> &str {
-        &self.runtime_id
-    }
-
-    #[must_use]
-    pub fn task_id(&self) -> Option<&str> {
-        self.task_id.as_deref()
-    }
-
-    pub fn authorization_header(
-        &self,
-        now: DateTime<Utc>,
-    ) -> Result<SecretString, CodexAgentIdentityError> {
-        let task_id = self.task_id().ok_or(CodexAgentIdentityError::MissingTask)?;
-        let timestamp = timestamp(now);
-        let payload = format!("{}:{task_id}:{timestamp}", self.runtime_id);
-        let signature = self.signing_key.sign(payload.as_bytes());
-        let envelope = AgentAssertionEnvelope {
-            agent_runtime_id: &self.runtime_id,
-            task_id,
-            timestamp: &timestamp,
-            signature: STANDARD.encode(signature.to_bytes()),
-        };
-        let encoded = serde_json::to_vec(&envelope)
-            .map_err(|_| CodexAgentIdentityError::InvalidCredential)?;
-        Ok(SecretString::from(format!(
-            "AgentAssertion {}",
-            URL_SAFE_NO_PAD.encode(encoded)
-        )))
-    }
-
-    fn registration(&self, now: DateTime<Utc>) -> AgentTaskRegistration {
-        let timestamp = timestamp(now);
-        let payload = format!("{}:{timestamp}", self.runtime_id);
-        let signature = self.signing_key.sign(payload.as_bytes());
-        AgentTaskRegistration {
-            timestamp,
-            signature: STANDARD.encode(signature.to_bytes()),
-        }
-    }
-
-    fn decrypt_task_id(&self, encoded: &str) -> Result<String, CodexAgentIdentityError> {
-        let ciphertext = STANDARD
-            .decode(encoded.trim())
-            .map_err(|_| CodexAgentIdentityError::InvalidTaskResponse)?;
-        let digest = Sha512::digest(self.signing_key.to_bytes());
-        let mut curve_key = [0_u8; 32];
-        curve_key.copy_from_slice(&digest[..32]);
-        let secret = BoxSecretKey::from(curve_key);
-        let plaintext = secret
-            .unseal(&ciphertext)
-            .map_err(|_| CodexAgentIdentityError::InvalidTaskResponse)?;
-        let task_id = String::from_utf8(plaintext)
-            .map_err(|_| CodexAgentIdentityError::InvalidTaskResponse)?;
-        let task_id = task_id.trim().to_owned();
-        if !valid_identifier(&task_id) {
-            return Err(CodexAgentIdentityError::InvalidTaskResponse);
-        }
-        Ok(task_id)
-    }
-}
-
-impl fmt::Debug for CodexAgentIdentitySecret {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter
-            .debug_struct("CodexAgentIdentitySecret")
-            .field("runtime_id", &"<redacted>")
-            .field("signing_key", &"<redacted>")
-            .field("task_id", &self.task_id.as_ref().map(|_| "<redacted>"))
-            .finish()
-    }
-}
-
-#[derive(Serialize)]
-struct AgentAssertionEnvelope<'a> {
-    agent_runtime_id: &'a str,
-    task_id: &'a str,
-    timestamp: &'a str,
-    signature: String,
-}
-
-#[derive(Serialize)]
-struct AgentTaskRegistration {
-    timestamp: String,
-    signature: String,
-}
-
-#[derive(Deserialize)]
-struct AgentTaskRegistrationResponse {
-    #[serde(default, alias = "taskId")]
-    task_id: Option<String>,
-    #[serde(default, alias = "encryptedTaskId")]
-    encrypted_task_id: Option<String>,
-}
-
-#[async_trait]
-pub trait CodexAgentIdentityTaskRegistrar: Send + Sync + 'static {
-    async fn register(
-        &self,
-        credential: &CodexAgentIdentitySecret,
-    ) -> Result<String, CodexAgentIdentityError>;
-}
-
-pub struct OfficialCodexAgentIdentityTaskRegistrar {
-    client: reqwest::Client,
-    base_url: Url,
-}
-
-impl OfficialCodexAgentIdentityTaskRegistrar {
-    pub fn new(client: reqwest::Client) -> Result<Self, CodexAgentIdentityError> {
-        let base_url = Url::parse(OFFICIAL_AGENT_IDENTITY_AUTH_BASE_URL)
-            .map_err(|_| CodexAgentIdentityError::InvalidConfiguration)?;
-        Ok(Self { client, base_url })
-    }
-}
-
-impl fmt::Debug for OfficialCodexAgentIdentityTaskRegistrar {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter
-            .debug_struct("OfficialCodexAgentIdentityTaskRegistrar")
-            .field("base_url", &self.base_url)
-            .finish_non_exhaustive()
-    }
-}
-
-#[async_trait]
-impl CodexAgentIdentityTaskRegistrar for OfficialCodexAgentIdentityTaskRegistrar {
-    async fn register(
-        &self,
-        credential: &CodexAgentIdentitySecret,
-    ) -> Result<String, CodexAgentIdentityError> {
-        let mut endpoint = self.base_url.clone();
-        endpoint
-            .path_segments_mut()
-            .map_err(|_| CodexAgentIdentityError::InvalidConfiguration)?
-            .extend(["v1", "agent", credential.runtime_id(), "task", "register"]);
-        let response = self
-            .client
-            .post(endpoint)
-            .header(reqwest::header::ACCEPT, "application/json")
-            .json(&credential.registration(Utc::now()))
-            .send()
-            .await
-            .map_err(|_| CodexAgentIdentityError::TaskRegistrationUnavailable)?;
-        if !response.status().is_success() {
-            return Err(CodexAgentIdentityError::TaskRegistrationRejected);
-        }
-        if response
-            .content_length()
-            .is_some_and(|length| length > MAX_TASK_RESPONSE_BYTES as u64)
-        {
-            return Err(CodexAgentIdentityError::InvalidTaskResponse);
-        }
-        let body = response
-            .bytes()
-            .await
-            .map_err(|_| CodexAgentIdentityError::TaskRegistrationUnavailable)?;
-        if body.len() > MAX_TASK_RESPONSE_BYTES {
-            return Err(CodexAgentIdentityError::InvalidTaskResponse);
-        }
-        let result = serde_json::from_slice::<AgentTaskRegistrationResponse>(&body)
-            .map_err(|_| CodexAgentIdentityError::InvalidTaskResponse)?;
-        if let Some(task_id) = result.task_id.map(|value| value.trim().to_owned())
-            && valid_identifier(&task_id)
-        {
-            return Ok(task_id);
-        }
-        let encrypted = result
-            .encrypted_task_id
-            .as_deref()
-            .ok_or(CodexAgentIdentityError::InvalidTaskResponse)?;
-        credential.decrypt_task_id(encrypted)
-    }
-}
-
-pub struct PreparedCodexRuntimeCredential {
-    pub account: ProviderAccount,
-    pub credential: CodexRuntimeCredential,
-}
-
-/// Agent task 的唯一注册与恢复 owner。
-pub struct CodexAgentIdentityTaskService {
-    repository: CodexCredentialRepository,
-    registrar: Arc<dyn CodexAgentIdentityTaskRegistrar>,
-    websocket_pool: Arc<CodexWebSocketPool>,
-    account_locks: Mutex<HashMap<ProviderAccountId, Arc<Mutex<()>>>>,
-}
-
-impl CodexAgentIdentityTaskService {
-    #[must_use]
-    pub fn new(
-        repository: CodexCredentialRepository,
-        registrar: Arc<dyn CodexAgentIdentityTaskRegistrar>,
-        websocket_pool: Arc<CodexWebSocketPool>,
-    ) -> Self {
-        Self {
-            repository,
-            registrar,
-            websocket_pool,
-            account_locks: Mutex::new(HashMap::new()),
-        }
-    }
-
-    pub async fn prepare(
-        &self,
-        account: &ProviderAccount,
-    ) -> Result<PreparedCodexRuntimeCredential, CodexAgentIdentityError> {
-        let prepared = self.load_current(account.id()).await?;
-        if !matches!(
-            &prepared.credential.authentication,
-            CodexRuntimeAuthentication::AgentIdentity(secret) if secret.task_id().is_none()
-        ) {
-            return Ok(prepared);
-        }
-        self.ensure_task(account.id(), None).await
-    }
-
-    pub async fn recover(
-        &self,
-        account_id: &ProviderAccountId,
-        expected_task_id: &str,
-    ) -> Result<PreparedCodexRuntimeCredential, CodexAgentIdentityError> {
-        self.ensure_task(account_id, Some(expected_task_id)).await
-    }
-
-    pub async fn recover_after_rejected_task(
-        &self,
-        account_id: &ProviderAccountId,
-        authentication: &CodexRuntimeAuthentication,
-        error: &CodexClientError,
-    ) -> Result<Option<PreparedCodexRuntimeCredential>, CodexAgentIdentityError> {
-        let CodexRuntimeAuthentication::AgentIdentity(secret) = authentication else {
-            return Ok(None);
-        };
-        let Some(task_id) = secret.task_id() else {
-            return Ok(None);
-        };
-        if !is_agent_identity_task_invalid_client_error(error) {
-            return Ok(None);
-        }
-        self.recover(account_id, task_id).await.map(Some)
-    }
-
-    async fn ensure_task(
-        &self,
-        account_id: &ProviderAccountId,
-        expected_task_id: Option<&str>,
-    ) -> Result<PreparedCodexRuntimeCredential, CodexAgentIdentityError> {
-        let lock = {
-            let mut locks = self.account_locks.lock().await;
-            Arc::clone(
-                locks
-                    .entry(account_id.clone())
-                    .or_insert_with(|| Arc::new(Mutex::new(()))),
-            )
-        };
-        let _guard = lock.lock().await;
-        let current = self.load_current(account_id).await?;
-        let CodexRuntimeAuthentication::AgentIdentity(secret) = &current.credential.authentication
-        else {
-            return Ok(current);
-        };
-        match (expected_task_id, secret.task_id()) {
-            (None, Some(_)) => return Ok(current),
-            (Some(expected), Some(actual)) if actual != expected => return Ok(current),
-            _ => {}
-        }
-        let task_id = self.registrar.register(secret).await?;
-        let mut data = self.repository.load_complete_data(&current.account).await?;
-        let agent = data
-            .agent_identity_mut()
-            .ok_or(CodexAgentIdentityError::InvalidCredential)?;
-        match (expected_task_id, agent.task_id.as_deref()) {
-            (None, Some(_)) => return self.load_current(account_id).await,
-            (Some(expected), Some(actual)) if actual != expected => {
-                return self.load_current(account_id).await;
-            }
-            _ => agent.task_id = Some(task_id),
-        }
-        self.repository
-            .compare_and_swap_data(&current.account, data)
-            .await?;
-        self.websocket_pool.evict_account(account_id.as_str()).await;
-        self.load_current(account_id).await
-    }
-
-    pub(crate) async fn load_current(
-        &self,
-        account_id: &ProviderAccountId,
-    ) -> Result<PreparedCodexRuntimeCredential, CodexAgentIdentityError> {
-        let account = self
-            .repository
-            .store()
-            .get_account(account_id)
-            .await?
-            .filter(|account| account.provider().as_str() == "openai")
-            .ok_or(CodexAgentIdentityError::NotFound)?;
-        let credential = self.repository.load_runtime_credential(&account).await?;
-        Ok(PreparedCodexRuntimeCredential {
-            account,
-            credential,
-        })
-    }
-}
-
-impl fmt::Debug for CodexAgentIdentityTaskService {
-    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter
-            .debug_struct("CodexAgentIdentityTaskService")
-            .field("repository", &"CodexCredentialRepository")
-            .field("registrar", &"CodexAgentIdentityTaskRegistrar")
-            .finish_non_exhaustive()
-    }
-}
-
-#[derive(Debug, Error)]
-pub enum CodexAgentIdentityError {
-    #[error("OpenAI Agent Identity credential is invalid")]
-    InvalidCredential,
-    #[error("OpenAI Agent Identity task is unavailable")]
-    MissingTask,
-    #[error("OpenAI Agent Identity task registration is unavailable")]
-    TaskRegistrationUnavailable,
-    #[error("OpenAI Agent Identity task registration was rejected")]
-    TaskRegistrationRejected,
-    #[error("OpenAI Agent Identity task registration response is invalid")]
-    InvalidTaskResponse,
-    #[error("OpenAI Agent Identity configuration is invalid")]
-    InvalidConfiguration,
-    #[error("OpenAI Agent Identity account was not found")]
-    NotFound,
-    #[error("OpenAI Agent Identity credential store is unavailable")]
-    Repository,
-}
-
-impl From<CredentialRepositoryError> for CodexAgentIdentityError {
-    fn from(_: CredentialRepositoryError) -> Self {
-        Self::Repository
-    }
-}
-
-impl From<gateway_core::error::StoreError> for CodexAgentIdentityError {
-    fn from(_: gateway_core::error::StoreError) -> Self {
-        Self::Repository
-    }
-}
-
-#[must_use]
-pub fn is_agent_identity_task_invalid_response(status: StatusCode, body: &str) -> bool {
-    if status != StatusCode::UNAUTHORIZED {
-        return false;
-    }
-    let lower = body.to_ascii_lowercase();
-    let compact = lower
-        .chars()
-        .filter(|character| !character.is_ascii_whitespace())
-        .collect::<String>();
-    [
-        "\"code\":\"invalid_task_id\"",
-        "\"code\":\"task_not_found\"",
-        "\"code\":\"task_expired\"",
-        "\"error\":\"invalid_task_id\"",
-    ]
-    .iter()
-    .any(|marker| compact.contains(marker))
-        || [
-            "invalid task_id",
-            "invalid task id",
-            "task_id is invalid",
-            "task id is invalid",
-            "task not found",
-            "task expired",
-            "unknown task_id",
-            "unknown task id",
-        ]
-        .iter()
-        .any(|marker| lower.contains(marker))
-}
-
-fn is_agent_identity_task_invalid_client_error(error: &CodexClientError) -> bool {
-    match error {
-        CodexClientError::Upstream { status, body, .. } => {
-            is_agent_identity_task_invalid_response(*status, body)
-        }
-        CodexClientError::WebSocket(CodexWebSocketExchangeError::Upstream(upstream)) => {
-            StatusCode::from_u16(upstream.status_code)
-                .ok()
-                .is_some_and(|status| {
-                    is_agent_identity_task_invalid_response(status, &upstream.body)
-                })
-        }
-        CodexClientError::WebSocket(CodexWebSocketExchangeError::PostSendAmbiguous {
-            source: Some(source),
-            ..
-        }) => is_agent_identity_task_invalid_websocket_error(source),
-        _ => false,
-    }
-}
-
-fn is_agent_identity_task_invalid_websocket_error(error: &CodexWebSocketExchangeError) -> bool {
-    match error {
-        CodexWebSocketExchangeError::Upstream(upstream) => {
-            StatusCode::from_u16(upstream.status_code)
-                .ok()
-                .is_some_and(|status| {
-                    is_agent_identity_task_invalid_response(status, &upstream.body)
-                })
-        }
-        CodexWebSocketExchangeError::PostSendAmbiguous {
-            source: Some(source),
-            ..
-        } => is_agent_identity_task_invalid_websocket_error(source),
-        _ => false,
-    }
-}
-
-fn timestamp(now: DateTime<Utc>) -> String {
-    now.to_rfc3339_opts(SecondsFormat::Secs, true)
-}
-
-fn valid_identifier(value: &str) -> bool {
-    !value.is_empty() && value.len() <= 2_048 && !value.chars().any(char::is_control)
-}

backend/crates/providers/openai/src/credential/catalog.rs

@@ -19,7 +19,6 @@ use thiserror::Error;
 use tokio::sync::Notify;
 use uuid::Uuid;
 
-use super::agent_identity::CodexAgentIdentityTaskService;
 use super::repository::{CodexCredentialRepository, CredentialRepositoryError};
 use crate::transport::profile::CodexWireProfileState;
 use crate::transport::{CodexBackendClient, CodexCatalogModel, CodexRequestContext};
@@ -138,8 +137,6 @@ pub enum CodexCredentialCatalogError {
     InvalidCredentialData,
     #[error("Codex model catalog upstream query failed: {detail}")]
     Upstream { detail: String },
-    #[error("Codex model catalog contains conflicting account facts")]
-    ConflictingModelFacts,
     #[error("Codex model catalog cache is unavailable")]
     Cache,
     #[error("Codex model catalog ETag is invalid")]
@@ -184,7 +181,6 @@ pub struct CodexCredentialCatalogService {
     profile: CodexWireProfileState,
     http: reqwest::Client,
     base_url: String,
-    agent_identity: Arc<CodexAgentIdentityTaskService>,
     plan_catalog_cache: Arc<dyn ProviderCatalogCachePort>,
     cache: Arc<RwLock<CatalogCacheState>>,
     etags: Arc<Mutex<CatalogEtagState>>,
@@ -197,7 +193,6 @@ impl CodexCredentialCatalogService {
         profile: CodexWireProfileState,
         http: reqwest::Client,
         base_url: String,
-        agent_identity: Arc<CodexAgentIdentityTaskService>,
         plan_catalog_cache: Arc<dyn ProviderCatalogCachePort>,
     ) -> Self {
         Self {
@@ -205,7 +200,6 @@ impl CodexCredentialCatalogService {
             profile,
             http,
             base_url,
-            agent_identity,
             plan_catalog_cache,
             cache: Arc::new(RwLock::new(CatalogCacheState::default())),
             etags: Arc::new(Mutex::new(CatalogEtagState::default())),
@@ -359,11 +353,6 @@ impl CodexCredentialCatalogService {
                         union_order.push(entry.key().clone());
                         entry.insert(model.clone());
                     }
-                    // 展示与元数据允许跨套餐漂移，union 取首见值；只有路由
-                    // 事实冲突才让整轮刷新失败。
-                    Entry::Occupied(entry) if conflicting_routing_facts(entry.get(), model) => {
-                        return Err(CodexCredentialCatalogError::ConflictingModelFacts);
-                    }
                     Entry::Occupied(_) => {}
                 }
             }
@@ -436,52 +425,24 @@ impl CodexCredentialCatalogService {
         client: &CodexBackendClient,
         account: &ProviderAccount,
     ) -> Result<FetchedAccountModels, CodexCredentialCatalogError> {
-        let mut prepared = self
-            .agent_identity
-            .prepare(account)
+        let credential = self
+            .repository
+            .load_runtime_credential(account)
             .await
             .map_err(|_| CodexCredentialCatalogError::InvalidCredentialData)?;
-        let mut request_id = format!("catalog_{}", Uuid::now_v7().simple());
-        let mut authorization = prepared
-            .credential
+        let request_id = format!("catalog_{}", Uuid::now_v7().simple());
+        let authorization = credential
             .authentication
-            .authorization_header(chrono::Utc::now())
+            .authorization_header()
             .map_err(|_| CodexCredentialCatalogError::InvalidCredentialData)?;
-        let mut result = client
+        let result = client
             .fetch_models_with_context(CodexRequestContext::auxiliary(
                 authorization.expose_secret(),
-                prepared.account.upstream_account_id(),
+                account.upstream_account_id(),
                 &request_id,
                 None,
             ))
             .await;
-        if let Err(error) = &result
-            && let Some(recovered) = self
-                .agent_identity
-                .recover_after_rejected_task(
-                    prepared.account.id(),
-                    &prepared.credential.authentication,
-                    error,
-                )
-                .await
-                .map_err(|_| CodexCredentialCatalogError::InvalidCredentialData)?
-        {
-            prepared = recovered;
-            request_id = format!("catalog_{}", Uuid::now_v7().simple());
-            authorization = prepared
-                .credential
-                .authentication
-                .authorization_header(chrono::Utc::now())
-                .map_err(|_| CodexCredentialCatalogError::InvalidCredentialData)?;
-            result = client
-                .fetch_models_with_context(CodexRequestContext::auxiliary(
-                    authorization.expose_secret(),
-                    prepared.account.upstream_account_id(),
-                    &request_id,
-                    None,
-                ))
-                .await;
-        }
         let snapshot = result.map_err(|error| CodexCredentialCatalogError::Upstream {
             detail: error.to_string(),
         })?;
@@ -661,13 +622,6 @@ fn model_ids(models: &[CodexCatalogModel]) -> Vec<String> {
         .collect()
 }
 
-/// 路由正确性只依赖 Responses API 支持证据（决定 Generate operation 是否
-/// 编译进 `ModelCapabilities`）；display_name/limits/metadata 等展示事实
-/// 跨套餐漂移不构成冲突。
-fn conflicting_routing_facts(existing: &CodexCatalogModel, candidate: &CodexCatalogModel) -> bool {
-    existing.capabilities().responses_api() != candidate.capabilities().responses_api()
-}
-
 fn catalog_candidates_by_scope(
     accounts: Vec<ProviderAccount>,
 ) -> Result<BTreeMap<CodexCatalogScope, Vec<ProviderAccount>>, CodexCredentialCatalogError> {

backend/crates/providers/openai/src/credential/mod.rs

@@ -2,10 +2,10 @@
 
 mod admin;
 mod affinity;
-mod agent_identity;
 mod catalog;
 mod cookie;
 mod oauth;
+mod profile_statistics;
 mod quota;
 mod recovery_log;
 mod refresh;
@@ -16,15 +16,10 @@ pub mod token_client;
 mod types;
 
 pub(crate) use affinity::{
-    derive_codex_cyber_policy_session_key, derive_codex_session_affinity_key,
+    CodexSessionAffinity, derive_codex_cyber_policy_session_key, derive_codex_session_affinity,
 };
 pub(crate) use oauth::oauth_owner_ref;
-
-pub use agent_identity::{
-    CodexAgentIdentityError, CodexAgentIdentitySecret, CodexAgentIdentityTaskRegistrar,
-    CodexAgentIdentityTaskService, OfficialCodexAgentIdentityTaskRegistrar,
-    PreparedCodexRuntimeCredential, is_agent_identity_task_invalid_response,
-};
+pub(crate) use types::parse_access_token_expiration;
 
 pub use admin::{
     CodexCprExportDocument, CodexCredentialAdmin, CodexCredentialAdminError,
@@ -43,10 +38,11 @@ pub use oauth::{
     CodexPendingAuthorization, CompleteCodexOAuthAuthorization, CompletedCodexOAuthAuthorization,
     CompletedCodexOAuthCredential, StartCodexOAuthAuthorization, StoredCodexPendingAuthorization,
 };
+pub use profile_statistics::{CodexCredentialProfileService, CodexProfileStatisticsError};
 pub use quota::{
     CodexAccountQuotaSnapshot, CodexCredentialQuotaError, CodexCredentialQuotaService,
     CodexQuotaFact, CodexQuotaRefreshPolicy, CodexQuotaSyncSummary, CodexQuotaWindow,
-    CodexQuotaWindowKind, CodexQuotaWindowRole, parse_codex_quota_usage,
+    CodexQuotaWindowKind, CodexQuotaWindowRole, CodexResetCreditsError, parse_codex_quota_usage,
 };
 pub use refresh::{
     CodexCredentialRefreshError, CodexCredentialRefreshOutcome, CodexCredentialRefreshService,
@@ -57,15 +53,13 @@ pub use security::{
     CodexCredentialCodec, CodexCredentialDataError, CodexRuntimeAuthentication,
     CodexRuntimeCredential,
 };
-pub(crate) use selector::CodexCyberPolicyScope;
 pub use selector::{
     CodexAccountFailure, CodexCredentialLease, CodexCredentialSelector, CredentialSelectionError,
     SelectCodexCredential,
 };
+pub(crate) use selector::{CodexCyberPolicyScope, SelectCodexProviderEndpointCredential};
 pub use types::{
-    CODEX_AUTHENTICATION_KIND_AGENT_IDENTITY, CODEX_AUTHENTICATION_KIND_OAUTH, CodexAccountProfile,
-    CodexAgentIdentityAuthMode, CodexAgentIdentityCredentialData, CodexCookie,
-    CodexCookieCaptureOutcome, CodexCredentialData, CodexCredentialPrincipal,
-    CodexOAuthCredentialData, CodexOAuthSecret, RotateCodexCredential, RuntimeCodexCookie,
-    UpsertCodexCookie,
+    CODEX_AUTHENTICATION_KIND_OAUTH, CodexAccountProfile, CodexCookie, CodexCookieCaptureOutcome,
+    CodexCredentialData, CodexCredentialPrincipal, CodexOAuthCredentialData, CodexOAuthSecret,
+    RotateCodexCredential, RuntimeCodexCookie, UpsertCodexCookie,
 };

backend/crates/providers/openai/src/credential/oauth.rs

@@ -1,10 +1,6 @@
 //! Codex Authorization Code + PKCE/OIDC 管理流。
 
-use std::{
-    fmt,
-    sync::Arc,
-    time::{Duration, SystemTime},
-};
+use std::{fmt, sync::Arc, time::Duration};
 
 use async_trait::async_trait;
 use base64::{Engine as _, engine::general_purpose::URL_SAFE_NO_PAD};
@@ -35,10 +31,17 @@ use super::token_client::{
     AuthorizationCodeExchangeError, AuthorizationCodeExchanger, AuthorizationCodeGrant,
     OFFICIAL_CODEX_OAUTH_CLIENT_ID, OFFICIAL_CODEX_REDIRECT_URI,
 };
-use super::types::parse_chatgpt_jwt_claims;
+use super::types::{parse_access_token_expiration, parse_chatgpt_jwt_claims};
+use crate::transport::profile::CodexWireProfileState;
 
 const AUTHORIZATION_ENDPOINT: &str = "https://auth.openai.com/oauth/authorize";
-const AUTHORIZATION_SCOPE: &str = "openid profile email offline_access";
+const DESKTOP_AUTH_ENDPOINT: &str = "https://chatgpt.com/codex/desktop-auth";
+const AUTHORIZATION_SCOPE: &str =
+    "openid profile email offline_access api.connectors.read api.connectors.invoke";
+const AUTHORIZATION_ORIGINATOR: &str = "Codex Desktop";
+const STREAMLINED_LOGIN_QUERY: &str = "codex_streamlined_login";
+const NO_UNIVERSAL_LINKS_QUERY: &str = "no_universal_links";
+const SURFACE_STABLE_ID_DOMAIN: &[u8] = b"openai/codex-desktop/surface-stable-id/v1\0";
 const AUTHORIZATION_TTL: TimeDelta = TimeDelta::minutes(10);
 const AUTHORIZATION_CLAIM_TTL: Duration = Duration::from_secs(90);
 const MAX_CALLBACK_BYTES: usize = 16 * 1024;
@@ -137,6 +140,7 @@ pub struct CodexPendingAuthorization {
     state: SecretString,
     nonce: SecretString,
     code_verifier: SecretString,
+    installation_id: String,
     reauthorization: Option<ProviderAccountId>,
     mutation: PendingAuthorizationMutation,
 }
@@ -150,6 +154,7 @@ pub struct StoredCodexPendingAuthorization {
     pub state: SecretString,
     pub nonce: SecretString,
     pub code_verifier: SecretString,
+    pub installation_id: String,
     pub reauthorization_account_id: Option<String>,
     pub mutation: PendingAuthorizationMutation,
 }
@@ -172,6 +177,7 @@ impl CodexPendingAuthorization {
             state: input.state,
             nonce: input.nonce,
             code_verifier: input.code_verifier,
+            installation_id: input.installation_id,
             reauthorization,
             mutation: input.mutation,
         };
@@ -183,6 +189,7 @@ impl CodexPendingAuthorization {
             || !valid_secret(pending.state.expose_secret())
             || !valid_secret(pending.nonce.expose_secret())
             || !valid_secret(pending.code_verifier.expose_secret())
+            || !valid_installation_id(&pending.installation_id)
             || !pending_mutation_matches(&pending)
         {
             return Err(CodexOAuthPendingStoreError::InvalidValue);
@@ -230,6 +237,11 @@ impl CodexPendingAuthorization {
         &self.code_verifier
     }
 
+    #[must_use]
+    pub fn installation_id(&self) -> &str {
+        &self.installation_id
+    }
+
     #[must_use]
     pub const fn reauthorization(&self) -> Option<&ProviderAccountId> {
         self.reauthorization.as_ref()
@@ -253,6 +265,7 @@ impl fmt::Debug for CodexPendingAuthorization {
             .field("state", &"<redacted>")
             .field("nonce", &"<redacted>")
             .field("code_verifier", &"<redacted>")
+            .field("installation_id", &"<pseudonymous>")
             .field("reauthorization", &self.reauthorization)
             .field("mutation", &self.mutation)
             .finish()
@@ -348,6 +361,7 @@ pub struct CodexOAuthAdminService {
     store: Arc<dyn ProviderAccountStore>,
     credentials: CodexCredentialAdmin,
     oauth_client_id: String,
+    profile: CodexWireProfileState,
 }
 
 struct CodexOAuthAuthorizationCommitGuard {
@@ -397,6 +411,7 @@ impl CodexOAuthAdminService {
         exchanger: Arc<dyn AuthorizationCodeExchanger>,
         store: Arc<dyn ProviderAccountStore>,
         credentials: CodexCredentialAdmin,
+        profile: CodexWireProfileState,
     ) -> Self {
         Self {
             pending,
@@ -404,6 +419,7 @@ impl CodexOAuthAdminService {
             store,
             credentials,
             oauth_client_id: OFFICIAL_CODEX_OAUTH_CLIENT_ID.to_owned(),
+            profile,
         }
     }
 
@@ -420,8 +436,10 @@ impl CodexOAuthAdmin for CodexOAuthAdminService {
         &self,
         command: StartCodexOAuthAuthorization,
     ) -> Result<CodexOAuthAuthorizationStarted, CodexOAuthAdminError> {
-        let (name, reauthorization) = match command.mutation.target() {
-            AuthorizationMutationTarget::Create { name } => (name.clone(), None),
+        let (name, reauthorization, installation_id) = match command.mutation.target() {
+            AuthorizationMutationTarget::Create { name } => {
+                (name.clone(), None, Uuid::new_v4().to_string())
+            }
             AuthorizationMutationTarget::Reauthorize { account_id } => {
                 let current = self
                     .store
@@ -433,10 +451,15 @@ impl CodexOAuthAdmin for CodexOAuthAdminService {
                 {
                     return Err(CodexOAuthAdminError::NotFound);
                 }
-                (current.account.name().to_owned(), Some(account_id.clone()))
+                let installation_id = current_installation_id(&current)?;
+                (
+                    current.account.name().to_owned(),
+                    Some(account_id.clone()),
+                    installation_id,
+                )
             }
         };
-        self.start_pending(command.mutation, name, reauthorization)
+        self.start_pending(command.mutation, name, reauthorization, installation_id)
             .await
     }
 
@@ -488,6 +511,9 @@ impl CodexOAuthAdminService {
                 .load_current_credential(target)
                 .await
                 .map_err(map_store_error)?;
+            if current_installation_id(&current)? != pending.installation_id() {
+                return Err(CodexOAuthAdminError::Conflict);
+            }
             Some(current)
         } else {
             None
@@ -497,13 +523,12 @@ impl CodexOAuthAdminService {
             .map(current_oauth_refresh_token)
             .transpose()?
             .flatten();
-        let (mut secret, id_token, expires_in) = self
+        let (mut secret, id_token) = self
             .exchange_pending(&pending, callback_url, fallback_refresh_token)
             .await?;
         let mutation = pending.mutation.clone();
-        let access_token_expires_at = expires_in
-            .and_then(|expires_in| SystemTime::now().checked_add(expires_in))
-            .map(DateTime::<Utc>::from);
+        let access_token_expires_at =
+            parse_access_token_expiration(secret.access_token.expose_secret());
         let metadata = parse_chatgpt_jwt_claims(id_token.expose_secret())
             .map_err(|_| CodexOAuthAdminError::TokenRejected)?;
         secret.id_token = Some(id_token);
@@ -525,6 +550,7 @@ impl CodexOAuthAdminService {
                     .prepare_unresolved_oauth(UnresolvedCodexOAuthCredential {
                         account_id,
                         name: pending.name,
+                        installation_id: pending.installation_id,
                         secret,
                         metadata,
                         access_token_expires_at,
@@ -544,6 +570,7 @@ impl CodexOAuthAdminService {
         mutation: PendingAuthorizationMutation,
         name: String,
         reauthorization: Option<ProviderAccountId>,
+        installation_id: String,
     ) -> Result<CodexOAuthAuthorizationStarted, CodexOAuthAdminError> {
         if !valid_text(&name) {
             return Err(CodexOAuthAdminError::InvalidInput);
@@ -562,17 +589,21 @@ impl CodexOAuthAdminService {
             state: SecretString::from(random_secret()?),
             nonce: SecretString::from(random_secret()?),
             code_verifier: SecretString::from(random_secret()?),
+            installation_id,
             reauthorization_account_id: reauthorization.as_ref().map(ToString::to_string),
             mutation,
         })
         .map_err(map_pending_error)?;
+        let profile = self.profile.snapshot();
+        let authorization_url =
+            authorization_url(&pending, &self.oauth_client_id, &profile.desktop_version)?;
         self.pending
             .create(&pending)
             .await
             .map_err(map_pending_error)?;
         Ok(CodexOAuthAuthorizationStarted {
             flow_id: pending.flow_id.clone(),
-            authorization_url: authorization_url(&pending, &self.oauth_client_id)?,
+            authorization_url,
             expires_at,
         })
     }
@@ -635,14 +666,7 @@ impl CodexOAuthAdminService {
         pending: &CodexPendingAuthorization,
         callback_url: &str,
         fallback_refresh_token: Option<SecretString>,
-    ) -> Result<
-        (
-            super::types::CodexOAuthSecret,
-            SecretString,
-            Option<Duration>,
-        ),
-        CodexOAuthAdminError,
-    > {
+    ) -> Result<(super::types::CodexOAuthSecret, SecretString), CodexOAuthAdminError> {
         let (code, callback_state) = callback_parts(callback_url)?;
         if !constant_time_equal(
             pending.state.expose_secret().as_bytes(),
@@ -673,7 +697,7 @@ impl CodexOAuthAdminService {
                 .as_ref()
                 .map(ExposeSecret::expose_secret),
         );
-        Ok((secret, tokens.id_token, tokens.expires_in))
+        Ok((secret, tokens.id_token))
     }
 }
 
@@ -688,27 +712,70 @@ fn current_oauth_refresh_token(
         .and_then(|oauth| oauth.refresh_token.clone()))
 }
 
+fn current_installation_id(current: &LoadedCredential) -> Result<String, CodexOAuthAdminError> {
+    let runtime = CodexCredentialCodec::decode(&current.credential)
+        .map_err(|_| CodexOAuthAdminError::Credential)?;
+    if runtime.authentication.oauth().is_none() {
+        return Err(CodexOAuthAdminError::Credential);
+    }
+    Ok(runtime.installation_id)
+}
+
+fn derive_surface_stable_id(installation_id: &str) -> Result<String, CodexOAuthAdminError> {
+    let installation_id =
+        Uuid::parse_str(installation_id).map_err(|_| CodexOAuthAdminError::Credential)?;
+    let mut digest = Sha256::new();
+    digest.update(SURFACE_STABLE_ID_DOMAIN);
+    digest.update(installation_id.as_bytes());
+    let digest = digest.finalize();
+    let mut bytes = [0_u8; 16];
+    bytes.copy_from_slice(&digest[..16]);
+    bytes[6] = (bytes[6] & 0x0f) | 0x40;
+    bytes[8] = (bytes[8] & 0x3f) | 0x80;
+    Ok(Uuid::from_bytes(bytes).hyphenated().to_string())
+}
+
 fn authorization_url(
     pending: &CodexPendingAuthorization,
     oauth_client_id: &str,
+    desktop_version: &str,
 ) -> Result<String, CodexOAuthAdminError> {
-    let mut url =
+    if !valid_text(desktop_version) {
+        return Err(CodexOAuthAdminError::InvalidInput);
+    }
+    let mut inner =
         Url::parse(AUTHORIZATION_ENDPOINT).map_err(|_| CodexOAuthAdminError::InvalidInput)?;
     let challenge = URL_SAFE_NO_PAD.encode(Sha256::digest(
         pending.code_verifier.expose_secret().as_bytes(),
     ));
-    url.query_pairs_mut()
-        .append_pair("response_type", "code")
-        .append_pair("client_id", oauth_client_id)
-        .append_pair("redirect_uri", OFFICIAL_CODEX_REDIRECT_URI)
-        .append_pair("scope", AUTHORIZATION_SCOPE)
-        .append_pair("state", pending.state.expose_secret())
-        .append_pair("nonce", pending.nonce.expose_secret())
-        .append_pair("code_challenge", &challenge)
-        .append_pair("code_challenge_method", "S256")
-        .append_pair("id_token_add_organizations", "true")
-        .append_pair("codex_cli_simplified_flow", "true");
-    Ok(url.into())
+    let stable_id = derive_surface_stable_id(pending.installation_id())?;
+    {
+        let mut query = inner.query_pairs_mut();
+        query
+            .append_pair("response_type", "code")
+            .append_pair("client_id", oauth_client_id)
+            .append_pair("redirect_uri", OFFICIAL_CODEX_REDIRECT_URI)
+            .append_pair("scope", AUTHORIZATION_SCOPE)
+            .append_pair("code_challenge", challenge.as_str())
+            .append_pair("code_challenge_method", "S256")
+            .append_pair("id_token_add_organizations", "true")
+            .append_pair("codex_cli_simplified_flow", "true")
+            .append_pair("state", pending.state.expose_secret())
+            .append_pair("originator", AUTHORIZATION_ORIGINATOR)
+            .append_pair("codex_app_version", desktop_version)
+            .append_pair("source_surface_stable_id", &stable_id)
+            .append_pair("codex_origin_stable_id", &stable_id)
+            .append_pair(STREAMLINED_LOGIN_QUERY, "true");
+    }
+
+    let mut outer =
+        Url::parse(DESKTOP_AUTH_ENDPOINT).map_err(|_| CodexOAuthAdminError::InvalidInput)?;
+    outer
+        .query_pairs_mut()
+        .append_pair("authorize_url", inner.as_str())
+        .append_pair(STREAMLINED_LOGIN_QUERY, "true")
+        .append_pair(NO_UNIVERSAL_LINKS_QUERY, "1");
+    Ok(outer.into())
 }
 
 fn callback_parts(value: &str) -> Result<(SecretString, SecretString), CodexOAuthAdminError> {
@@ -760,6 +827,12 @@ fn valid_secret(value: &str) -> bool {
     valid_text(value) && value.len() >= 16
 }
 
+fn valid_installation_id(value: &str) -> bool {
+    Uuid::parse_str(value)
+        .ok()
+        .is_some_and(|uuid| uuid.get_version_num() == 4)
+}
+
 pub(crate) fn oauth_owner_ref(owner: &AuthorizationOwner) -> String {
     let mut digest = Sha256::new();
     match owner {