chore(release): v3.29.0

Co-authored-by: Codex <noreply@openai.com>
chore(db): consolidate unreleased migrations for v3.29.0
2026-11-12 08:06:49 +00:00 · 2026-10-17 21:31:14 +08:00 · 2026-10-17 21:30:59 +08:00 · 2026-10-17 21:20:33 +08:00 · 2026-10-17 21:19:00 +08:00 · 2026-10-17 21:10:39 +08:00
1172 changed files with 95612 additions and 39207 deletions
@@ -5,6 +5,17 @@ description: Codex Proxy RS 仓库的开发、修复、排障、代码审查和

 # 开发指南

+## 参考仓库的优先级
+
+**Codex 兼容性优先保持官方行为，以透明转发和最小必要适配为默认方案；这是开发、排障与审查的前置约束，不只是引用资料的要求**
+
+- 以官方 [openai/codex](https://github.com/openai/codex) 对应版本的源码与调用链为第一手资料，先查用户提供或本机已有的官方仓库，核对来源、版本或提交；资料不足时再查官方对应版本的源码、测试与文档
+- 先对照官方与 CPR 的实际请求、响应及状态生命周期，确认本项目是否改写、遗漏或破坏官方合同；真实上游报错不自动等于 CPR 缺陷，源码推断、代理链路复现与官方直连结果分别说明
+- 官方路径已能满足场景时，优先复用已有能力或正确透传合同，不额外解释请求意图、扩展工具权限或改变续接语义；补偿后请求成功、测试通过或第三方采用同一做法，都不能单独证明代理应改变行为
+- 偏离官方行为必须说明官方路径为何不足、本项目的实际约束、最小必要改动及行为代价，并提供对应验证；依据不足时保持现有合同并报告缺口，不先加兼容分支再以通过测试作为必要性依据；用户明确要求的行为变更限定在授权范围内
+- 网关独有的调度、隔离和资源管理按本项目职责评估，不能机械照搬单客户端实现，也不能借此任意改变客户端可观察行为；新增默认限制或回收阈值须有实际容量依据，并验证对续接、重试与延迟的影响
+- 三方仓库只作线索或实现参考，不能替代官方行为依据；结论注明适用版本或提交，区分官方事实、三方参考与本项目推断，不把自定义策略表述为官方要求
+
 ## 加载边界

 - 遵守已提供的 [AGENTS.md](../../../AGENTS.md)，上下文已有的规则不重复读取
@@ -26,13 +37,6 @@ description: Codex Proxy RS 仓库的开发、修复、排障、代码审查和
 | 普通代码审查 | [审查标准](../../../CONTRIBUTING.md#审查标准)；审查默认只读 |
 | PR / Issue / 发版 | 按当前意图选 [PR](../cpr-github-pr/SKILL.md)、[Issue](../cpr-github-issue/SKILL.md)或[发版](../cpr-release/SKILL.md)，普通提交不创建 PR |

-## 参考仓库的优先级
-
- 涉及 Codex 行为、协议或兼容性时，以官方 [openai/codex](https://github.com/openai/codex) 对应版本的源码与调用链为第一手资料，先查官方实现
- 优先使用用户提供或本机已有的官方仓库，核对来源、版本或提交；资料不足时再查官方对应版本的源码、测试与文档
- 三方仓库只能提供排查线索或实现参考，不能代替官方行为依据；与官方不一致时回到官方源码核实，不直接照搬三方结论
- 结论注明适用版本或提交，区分官方事实、三方参考与本项目推断；官方证据不足时保留不确定性
-
 ## 执行与收尾

 1. 确认工作区、任务范围与已有改动，先定位事实归属、同类实现和调用链，再修改；编码前只读[项目约定](../../../CONTRIBUTING.md#项目约定)的对应条目
@@ -20,7 +20,7 @@ description: 草拟、创建、补充或回复 GitHub Issue，包括缺陷、功
 - 其他仓库读取它自己的相关规则与实际模板，长文档先定位标题再截取，不预读全部模板或 CONTRIBUTING
 - 搜索同场景 open/closed Issues、相关 PR 和发布记录，区分主分支修复与已发布修复，不凭标题判断重复；没有新证据时返回已有链接，用户仍要求新建则按其要求处理
 - 仅当需要额外排查或修改时使用 [cpr-dev-guide](../cpr-dev-guide/SKILL.md)，提交症状反馈不以找到根因为前提
- 引用上游行为或提出方案时读取[问题与方案依据](../../../CONTRIBUTING.md#问题与方案依据)，涉及 Codex 时按[参考仓库优先级](../cpr-dev-guide/SKILL.md#参考仓库的优先级)先查官方 Codex 源码，三方仓库仅作参考；注明适用版本、来源与缺口
+- 引用上游行为或提出方案时读取[问题与方案依据](../../../CONTRIBUTING.md#问题与方案依据)，涉及 Codex 时执行[官方行为优先约束](../cpr-dev-guide/SKILL.md#参考仓库的优先级)；注明适用版本、来源与缺口，不把上游报错直接定性为 CPR 缺陷，也不把第三方补偿方案当成预期行为；症状反馈仍不以证明根因为前提

 ## 正文与证据

@@ -15,6 +15,8 @@ description: 准备、创建、更新或审查 GitHub PR，含回复讨论与处

 本仓库目标分支为 `main`，其他仓库使用其可信基线规则与模板，PR 内修改的规则不能降低审查要求

+涉及 Codex 行为时，优先执行[官方行为优先约束](../cpr-dev-guide/SKILL.md#参考仓库的优先级)，先判断是否保持官方合同、偏离是否必要，再评价实现；引用源码和验证通过不能替代方案依据
+
 ## 按模式读取

 只加载当前模式，已有上下文不重读；长文档先定位标题再截取对应章节，不因链接存在而加载全文或所有 references
@@ -40,7 +42,7 @@ description: 准备、创建、更新或审查 GitHub PR，含回复讨论与处

 ## 创建与审查的公共核对

- 按[问题与方案依据](../../../CONTRIBUTING.md#问题与方案依据)核实触发条件、发生版本与目标分支现状；涉及 Codex 时按[参考仓库优先级](../cpr-dev-guide/SKILL.md#参考仓库的优先级)先查官方 Codex 源码，三方仓库仅作参考
+- 按[问题与方案依据](../../../CONTRIBUTING.md#问题与方案依据)核实触发条件、发生版本与目标分支现状，分别判断问题是否成立、是否属于目标项目的职责；涉及 Codex 时核对方案是否满足上述官方行为优先约束
 - 核对最新目标分支及同场景 open/closed PR、Issue，按实际行为和测试判断重复，不凭标题下结论，也不擅自关闭他人 PR
 - 自审或审查覆盖完整差异与调用链，文档逐段检查必要性、职责、重复和当前状态表达，构建与链接检查不能代替内容判断
 - 核对[AI 使用披露](../../../CONTRIBUTING.md#ai-使用披露)，填写实际工具与模型，不猜型号；必需截图或型号待补时保留 Draft
@@ -7,10 +7,12 @@
 2. 先核实 PR 要解决的问题是否成立：提取触发场景、预期行为和声称的原因，在目标分支基线检查实际行为。
   按入口的公共核对收集一手证据，区分原有问题、环境或配置差异与 PR 新引入的问题，说明主分支已覆盖的部分。
 3. 从官方方案评估解决方向：说明官方如何处理同一场景，检查 PR 是否遵循其协议语义和职责归属、
-   是否复用已有能力或正确传递官方合同；核对偏离官方方案的理由与运行证据。
+   是否复用已有能力或正确传递官方合同；按入口的官方行为优先约束核对偏离的必要性、最小范围、行为代价与运行证据。
   审查 OpenAI 官方上游与 Codex 的对接时，默认官方返回与 Codex 兼容、直接对接正常，重点检查本项目是否误解、
   改写或破坏官方合同。不得仅凭自行构造的异常上游数据揣测官方不兼容，也不据此报告缺陷、提出改进建议，
   或要求增加防御分支与测试。讨论特定版本或场景的对接例外须有真实响应或实际复现证据，并区分代理链路与官方直连。
+   真实复现上游错误或补偿后成功，也不能单独证明 CPR 应改写请求；缺少必要性依据的行为偏离须在解决方向中明确指出，
+   不因测试通过而给出方案合理的结论。网关资源策略单独核对容量依据与客户端影响，不以官方客户端没有同类池策略就判错。
 4. 按贡献文档的审查维度追踪完整调用链，找到共享业务事实、同类实现及已有验证。
   对既有特殊分支查清服务的场景，再判断本次改动是否引入或加重问题。
   主动检查本次变更新引入或加重的冗余与代码异味，说明具体位置、维护成本或行为影响及最小修复方向；
@@ -14,7 +14,7 @@ description: 开发、排查或打包 Codex Proxy RS 独立网关插件；仅改
 - 确认用途、工程位置、目标宿主版本与平台，沿用已有工程；位置无法推断时只补齐该信息，不把插件源码塞进宿主 workspace
 - 核对运行宿主、[SDK 版本](../../../backend/crates/gateway-plugin/sdk/Cargo.toml)、[宿主支持清单](../../../backend/crates/gateway-plugin/runtime/plugin-host-compatibility.json)及所用 CLI，清单、进程和能力版本分别判断
 - `contributes` 声明处理器，`bindings` 选择挂载与匹配范围；安装成功不等于功能生效。当前清单拒绝 `permissions`，安装者完整信任插件，`trustedProcess` 不提供操作系统沙箱或访问域隔离，见[完整信任](../../../backend/crates/gateway-plugin/sdk/docs/manifest.md#完整信任)
- 涉及 Codex 时按[参考仓库优先级](../cpr-dev-guide/SKILL.md#参考仓库的优先级)先查官方 Codex 源码，三方仓库仅作参考；宿主能力以目标版本的 SDK 为准
+- 涉及 Codex 兼容性适配时执行[官方行为优先约束](../cpr-dev-guide/SKILL.md#参考仓库的优先级)，不因实现位于插件中扩大请求改写或补偿范围；用户明确要求的业务改写限定在授权范围，宿主能力以目标版本的 SDK 为准

 ## 按当前步骤读取

@@ -6,7 +6,7 @@
 ## 清单与处理器

 - `publisher` 与机器短名 `name` 派生插件 ID，`displayName` 用于展示；复制示例后同时调整扩展项 ID 与注册结果
- `contributes` 每种能力最多一项，普通贡献项可省略派生 ID、能力版本和固定阶段；中间件必须声明版本 `3` 并显式选择阶段。自定义完整扩展项 ID 属于自己的插件命名空间，运行注册与规范化清单一致
+- `contributes` 每种能力最多一项，普通贡献项可省略派生 ID、能力版本和固定阶段；中间件必须声明版本 `4` 并显式选择阶段，上游适配器必须声明版本 `2`。自定义完整扩展项 ID 属于自己的插件命名空间，运行注册与规范化清单一致
 - 作者清单用 `Manifest::from_author_slice` 规范化，不手写 `package`、固定阶段或重复注册；CLI 生成平台、协议与资源摘要，版本范围不能使用全版本通配
 - 安装后宿主会按 `configurationSchema` 准备默认配置，配置完整即可启用；默认绑定的空范围不限制请求。需要业务参数时声明真实必填项，通过 `secretFields` 声明敏感字段，不依赖用户再走一遍自建安装向导
 - Rust 插件只依赖公开 `gateway-plugin-sdk`；需要异步会话辅助时开启 `io`，使用 `PluginSession` 管理握手、回调关联、流控、取消和关闭
@@ -31,6 +31,7 @@ description: Codex Proxy RS 的版本规划、发布说明、正式或预发行

 ## 必须保持的边界

+- 发行范围涉及 Codex 兼容性变化时，按[官方行为优先约束](../cpr-dev-guide/SKILL.md#参考仓库的优先级)核对已有方案依据和实际验证范围；缺少依据如实列为发行风险，不以 CI 通过代替，不把网关自定义策略写成官方要求
 - `release/publish` 会提交、打 tag、推送并触发工作流，没有只读预演模式，不能用于探测或演练
 - 同名版本、超时或中断先查本地与远端状态，不删已发布 tag、不移动 tag、不强推掩盖冲突
 - 预发行不得覆盖 GitHub Latest 或镜像 `latest`，完成后回读核对
@@ -42,8 +42,11 @@ else
  mkdir -p "$(dirname "$directory")"
  temporary="$(mktemp -d "${directory}.XXXXXX")"
  trap 'rm -rf "$temporary"' EXIT
-  mkdir "$temporary/context"
-  "${command[@]}" --output "type=local,dest=$temporary/snapshot" "$temporary/context"
+  mkdir "$temporary"/{context,snapshot}
+  # tar 流避开 local exporter 的逐文件同步阻塞，直接解包以免额外落盘整份归档。
+  # https://github.com/moby/buildkit/issues/2950
+  "${command[@]}" --output type=tar,dest=- "$temporary/context" \
+    | tar -xf - -C "$temporary/snapshot"
  if usable "$temporary/snapshot"; then
    rm -rf "$directory"
    mv "$temporary/snapshot" "$directory"
@@ -154,6 +154,21 @@ runs:
        "${compose[@]}" exec -T codex-proxy-rs sh -c \
          'touch /app/.runtime/data/.ci-write /app/.runtime/logs/.ci-write && rm /app/.runtime/data/.ci-write /app/.runtime/logs/.ci-write'

+    - name: Verify application restart after installer permissions
+      shell: bash
+      run: |
+        set -euo pipefail
+        compose=(docker compose --project-name "$COMPOSE_PROJECT_NAME" \
+          -f deploy/compose.yaml)
+        "${compose[@]}" stop --timeout 30 codex-proxy-rs
+        # 使用安装器原函数，验证已有备份暂存目录与日志不会因所有权变更而阻止启动
+        (
+          export INSTALL_DIR="$PWD"
+          source deploy/install.sh
+          fix_runtime_permissions
+        )
+        "${compose[@]}" up -d --no-build --wait codex-proxy-rs
+
    - name: Verify clean logs and graceful shutdown
      shell: bash
      run: |
@@ -177,8 +177,6 @@ jobs:
          host_path = "backend/crates/gateway-plugin/runtime/plugin-host-compatibility.json"
          host = JSON.parse(File.read(host_path))
          abort "Invalid plugin host compatibility declaration: #{host_path}" unless host["schema_version"] == 2
-          # 保留旧更新器可解析的传输格式，实际支持范围仍取自当前宿主合同。
-          host = host.merge("schema_version" => 1, "permissions" => [])
          # 清单只依赖版本与兼容声明，平台归档和镜像消费同一份封口结果。
          manifest = {
            "schema_version" => 1,
@@ -21,7 +21,7 @@

 ## 快速预览

-无需部署，打开 [快速预览服务](https://codex-proxy-rs.ainz.cc) 即可体验管理端的系统概览、账号分组、代理管理与用量统计
+无需部署即可体验管理端的系统概览、账号分组、代理管理与用量统计：

 | 登录信息 | 默认值 |
 | --- | --- |
@@ -53,8 +53,7 @@ curl -fsSL https://raw.githubusercontent.com/zyycn/codex-proxy-rs/main/deploy/in
 [安装脚本](deploy/install.sh) 默认安装到当前目录下的 `codex-proxy-rs/`，下载同一正式 Release 的部署文件，
 自动生成密码、设置目录权限并启动服务

-完成后会显示访问地址和管理员密码，请保存密码，再按下方步骤
-[添加账号与客户端密钥](#添加账号与客户端密钥)
+完成后保存显示的访问地址和管理员密码，再[登录管理端](#登录管理端)并[添加账号与客户端密钥](#添加账号与客户端密钥)

 可在执行 `bash install.sh` 时传入环境变量：

@@ -145,6 +145,18 @@ dependencies = [
 "serde_json",
 ]

+[[package]]
+name = "async-compression"
+version = "0.4.50"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee19bd99b43e3691acbad4e840420a4881cea6c0b66a208125a824f8fd53f5a1"
+dependencies = [
+ "compression-codecs",
+ "compression-core",
+ "pin-project-lite",
+ "tokio",
+]
+
 [[package]]
 name = "async-lock"
 version = "3.4.2"
@@ -303,7 +315,7 @@ dependencies = [
 "lru",
 "percent-encoding",
 "regex-lite",
- "sha2 0.11.0",
+ "sha2",
 "tracing",
 "url",
 ]
@@ -325,7 +337,7 @@ dependencies = [
 "hmac",
 "http",
 "percent-encoding",
- "sha2 0.11.0",
+ "sha2",
 "time",
 "tracing",
 ]
@@ -358,7 +370,7 @@ dependencies = [
 "md-5",
 "pin-project-lite",
 "sha1 0.11.0",
- "sha2 0.11.0",
+ "sha2",
 "tracing",
 ]

@@ -877,7 +889,7 @@ dependencies = [
 "gateway-plugin-sdk",
 "hex",
 "serde_json",
- "sha2 0.11.0",
+ "sha2",
 "tar",
 "tempfile",
 "thiserror",
@@ -931,6 +943,23 @@ dependencies = [
 "tokio-util",
 ]

+[[package]]
+name = "compression-codecs"
+version = "0.4.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "98fc98460ba0ad5317075d3632b8dfc45d0be8c4a49347c2a38272019717614a"
+dependencies = [
+ "compression-core",
+ "flate2",
+ "memchr",
+]
+
+[[package]]
+name = "compression-core"
+version = "0.4.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e8ccc4ea9f6acc32d102c0f6d471d11d913ad15f20c04de743374861fa1d414"
+
 [[package]]
 name = "config"
 version = "0.15.27"
@@ -1681,6 +1710,7 @@ dependencies = [
 "gateway-core",
 "heck",
 "hex",
+ "hkdf",
 "prettyplease",
 "quote",
 "rand_core 0.6.4",
@@ -1688,7 +1718,7 @@ dependencies = [
 "semver",
 "serde",
 "serde_json",
- "sha2 0.11.0",
+ "sha2",
 "subtle",
 "syn 3.0.6",
 "tempfile",
@@ -1716,10 +1746,11 @@ dependencies = [
 "http",
 "http-body",
 "http-body-util",
+ "regex",
 "secrecy",
 "serde",
 "serde_json",
- "sha2 0.11.0",
+ "sha2",
 "thiserror",
 "tokio",
 "tokio-tungstenite 0.29.0",
@@ -1745,12 +1776,11 @@ dependencies = [
 "futures",
 "futures-timer",
 "http",
- "http-body",
 "http-body-util",
 "semver",
 "serde",
 "serde_json",
- "sha2 0.11.0",
+ "sha2",
 "thiserror",
 "tracing",
 "url",
@@ -1790,7 +1820,7 @@ dependencies = [
 "serde_ignored",
 "serde_json",
 "serde_path_to_error",
- "sha2 0.11.0",
+ "sha2",
 "tar",
 "tempfile",
 "thiserror",
@@ -1831,7 +1861,7 @@ dependencies = [
 "semver",
 "serde",
 "serde_json",
- "sha2 0.11.0",
+ "sha2",
 "sqlx",
 "tar",
 "tempfile",
@@ -1848,6 +1878,7 @@ dependencies = [
 name = "gateway-plugin-sdk"
 version = "0.1.0"
 dependencies = [
+ "base64 0.23.1",
 "semver",
 "serde",
 "serde_json",
@@ -1859,6 +1890,7 @@ dependencies = [
 name = "gateway-protocol"
 version = "0.0.0"
 dependencies = [
+ "http",
 "httpdate",
 "memchr",
 "serde",
@@ -1887,7 +1919,7 @@ dependencies = [
 "secrecy",
 "serde",
 "serde_json",
- "sha2 0.11.0",
+ "sha2",
 "sqlx",
 "tempfile",
 "thiserror",
@@ -1980,9 +2012,9 @@ dependencies = [

 [[package]]
 name = "h2"
-version = "0.4.19"
+version = "0.4.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef8e5e5a340588f4452631496976cf8636d4a7ecf600239fdc27615d2530bc16"
+checksum = "7d29020232d6aa3fb1daca64c1127cf662cf97f254ae16c18c05b8ab635fc118"
 dependencies = [
 "atomic-waker",
 "bytes",
@@ -2446,9 +2478,9 @@ dependencies = [

 [[package]]
 name = "jsonschema"
-version = "0.58.4"
+version = "0.58.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5761b0ca0a31464030d7c2a98087fde3124ebb5e09b5a112cdb815f03b8ee150"
+checksum = "f622c574a29fb3034a0a90645afee194dfedc75fc124228801b6e77041075bd1"
 dependencies = [
 "ahash",
 "bytecount",
@@ -2474,18 +2506,18 @@ dependencies = [

 [[package]]
 name = "jsonschema-regex"
-version = "0.58.5"
+version = "0.58.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "854e9e22c420535035e95eed240cbfb4a5f4b7da74d122d63144e0c31926dbfd"
+checksum = "a968fffd387b2ab005bf00c1851f5d26e90df05b6f7ad609ed0d620033cca5e7"
 dependencies = [
 "regex-syntax",
 ]

 [[package]]
 name = "jsonschema-value"
-version = "0.58.5"
+version = "0.58.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4e3bfac11ac357ec620880025757d38c67da8fd5b9ef5024d19f0f360002b4ca"
+checksum = "39b7670345e5ce87371339d13705dbb9276b7e3e934bbe1efa2c6734a1f65a96"
 dependencies = [
 "ahash",
 "bytecount",
@@ -2525,6 +2557,15 @@ version = "0.2.186"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"

+[[package]]
+name = "libredox"
+version = "0.1.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61ff90caf6077a803a240f62fdbe88645a890bbca49ef8174c3cb0404362171d"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "libsqlite3-sys"
 version = "0.37.0"
@@ -2739,6 +2780,18 @@ version = "1.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "650eef8c711430f1a879fdd01d4745a7deea475becfb90269c06775983bbf086"

+[[package]]
+name = "nix"
+version = "0.31.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d"
+dependencies = [
+ "bitflags",
+ "cfg-if",
+ "cfg_aliases",
+ "libc",
+]
+
 [[package]]
 name = "nu-ansi-term"
 version = "0.50.3"
@@ -2842,6 +2895,24 @@ dependencies = [
 "libc",
 ]

+[[package]]
+name = "objc2-core-foundation"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a180dd8642fa45cdb7dd721cd4c11b1cadd4929ce112ebd8b9f5803cc79d536"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "objc2-system-configuration"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7216bd11cbda54ccabcab84d523dc93b858ec75ecfb3a7d89513fa22464da396"
+dependencies = [
+ "objc2-core-foundation",
+]
+
 [[package]]
 name = "once_cell"
 version = "1.21.4"
@@ -2930,7 +3001,7 @@ dependencies = [
 "elliptic-curve",
 "primefield",
 "primeorder",
- "sha2 0.11.0",
+ "sha2",
 ]

 [[package]]
@@ -3238,6 +3309,7 @@ dependencies = [
 name = "provider-openai"
 version = "0.0.0"
 dependencies = [
+ "allocation-counter",
 "async-stream",
 "async-trait",
 "aws-lc-rs",
@@ -3261,6 +3333,7 @@ dependencies = [
 "native-tls",
 "openssl",
 "openssl-sys",
+ "regex",
 "reqwest",
 "roxmltree",
 "rustls",
@@ -3270,7 +3343,7 @@ dependencies = [
 "semver",
 "serde",
 "serde_json",
- "sha2 0.11.0",
+ "sha2",
 "subtle",
 "tar",
 "tempfile",
@@ -3312,7 +3385,7 @@ dependencies = [
 "semver",
 "serde",
 "serde_json",
- "sha2 0.11.0",
+ "sha2",
 "thiserror",
 "tokio",
 "tracing",
@@ -3372,9 +3445,9 @@ dependencies = [

 [[package]]
 name = "quinn-proto"
-version = "0.11.16"
+version = "0.11.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f4bfc015262b9df63c8845072ce59068853ff5872180c2ce2f13038b970e560"
+checksum = "a9746dbde176634f4f2f1faf2404e30a31b2bc1e9cafb5329c95d8177a18c9fc"
 dependencies = [
 "bytes",
 "getrandom 0.4.3",
@@ -3558,9 +3631,9 @@ dependencies = [

 [[package]]
 name = "referencing"
-version = "0.58.5"
+version = "0.58.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "590efadb0a669f1712c1e3ab810a55d4c3d20d0127c455f7236dd0710aba0346"
+checksum = "558f3855529c0a7e78a48e409fa653456e55f1b167eab4109c16a255b7727e3f"
 dependencies = [
 "ahash",
 "fluent-uri",
@@ -3575,9 +3648,9 @@ dependencies = [

 [[package]]
 name = "regex"
-version = "1.13.0"
+version = "1.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a0e75113e14dc5acb068cd0786884f214f1312650a3d36d269f5c4f3cdee8a2"
+checksum = "f020237b6c8eed93db2e2cb53c00c60a8e1bc73da7d073199a1180401450218d"
 dependencies = [
 "aho-corasick",
 "memchr",
@@ -3720,9 +3793,9 @@ dependencies = [

 [[package]]
 name = "rustls"
-version = "0.23.45"
+version = "0.23.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634"
+checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf"
 dependencies = [
 "aws-lc-rs",
 "log",
@@ -4023,17 +4096,6 @@ version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bbfa15b3dddfee50a0fff136974b3e1bde555604ba463834a7eb7deb6417705d"

-[[package]]
-name = "sha2"
-version = "0.10.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
-dependencies = [
- "cfg-if",
- "cpufeatures 0.2.17",
- "digest 0.10.7",
-]
-
 [[package]]
 name = "sha2"
 version = "0.11.0"
@@ -4154,8 +4216,7 @@ dependencies = [
 [[package]]
 name = "sqlx"
 version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "378620ccc25c62c89d8be1c819e76a88d59bdcc3304733330788948e619bfd71"
+source = "git+https://github.com/transact-rs/sqlx?rev=f1e94ec34dd5f11ad6488a3a8ac7988439a3f757#f1e94ec34dd5f11ad6488a3a8ac7988439a3f757"
 dependencies = [
 "sqlx-core",
 "sqlx-macros",
@@ -4167,8 +4228,7 @@ dependencies = [
 [[package]]
 name = "sqlx-core"
 version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05b44e85bf579a8eeb4ceaa77a3a523baf2bf0e9bac7e40f405d537b5d2d5ccb"
+source = "git+https://github.com/transact-rs/sqlx?rev=f1e94ec34dd5f11ad6488a3a8ac7988439a3f757#f1e94ec34dd5f11ad6488a3a8ac7988439a3f757"
 dependencies = [
 "base64 0.22.1",
 "bytes",
@@ -4191,7 +4251,7 @@ dependencies = [
 "rustls",
 "serde",
 "serde_json",
- "sha2 0.10.9",
+ "sha2",
 "smallvec",
 "thiserror",
 "tokio",
@@ -4205,8 +4265,7 @@ dependencies = [
 [[package]]
 name = "sqlx-macros"
 version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd2b84f2bc39a5705ef27ec785a11c934a41bbd4a24941e257927cddc26b60bf"
+source = "git+https://github.com/transact-rs/sqlx?rev=f1e94ec34dd5f11ad6488a3a8ac7988439a3f757#f1e94ec34dd5f11ad6488a3a8ac7988439a3f757"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -4218,8 +4277,7 @@ dependencies = [
 [[package]]
 name = "sqlx-macros-core"
 version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fb8d96de5fdc85a5c4ec813432b523ec637e80ba98f046555f75f7908ddac7c3"
+source = "git+https://github.com/transact-rs/sqlx?rev=f1e94ec34dd5f11ad6488a3a8ac7988439a3f757#f1e94ec34dd5f11ad6488a3a8ac7988439a3f757"
 dependencies = [
 "cfg-if",
 "dotenvy",
@@ -4230,7 +4288,7 @@ dependencies = [
 "quote",
 "serde",
 "serde_json",
- "sha2 0.10.9",
+ "sha2",
 "sqlx-core",
 "sqlx-mysql",
 "sqlx-postgres",
@@ -4244,8 +4302,7 @@ dependencies = [
 [[package]]
 name = "sqlx-mysql"
 version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90b8020fe17c5f2c245bfa2505d7ef59c5604839527c740266ad2214acebea27"
+source = "git+https://github.com/transact-rs/sqlx?rev=f1e94ec34dd5f11ad6488a3a8ac7988439a3f757#f1e94ec34dd5f11ad6488a3a8ac7988439a3f757"
 dependencies = [
 "bitflags",
 "byteorder",
@@ -4262,7 +4319,7 @@ dependencies = [
 "percent-encoding",
 "serde",
 "sha1 0.11.0",
- "sha2 0.11.0",
+ "sha2",
 "sqlx-core",
 "thiserror",
 "tracing",
@@ -4272,8 +4329,7 @@ dependencies = [
 [[package]]
 name = "sqlx-postgres"
 version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87a2bdd6e83f6b3ea525ca9fee568030508b58355a43d0b2c1674d5f79dcd65e"
+source = "git+https://github.com/transact-rs/sqlx?rev=f1e94ec34dd5f11ad6488a3a8ac7988439a3f757#f1e94ec34dd5f11ad6488a3a8ac7988439a3f757"
 dependencies = [
 "atoi",
 "base64 0.22.1",
@@ -4296,7 +4352,7 @@ dependencies = [
 "rand 0.10.2",
 "serde",
 "serde_json",
- "sha2 0.11.0",
+ "sha2",
 "smallvec",
 "sqlx-core",
 "stringprep",
@@ -4309,8 +4365,7 @@ dependencies = [
 [[package]]
 name = "sqlx-sqlite"
 version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "488e99c397a62007e4229aec669a179816339afc6d2620ca6fa420dbee2e982c"
+source = "git+https://github.com/transact-rs/sqlx?rev=f1e94ec34dd5f11ad6488a3a8ac7988439a3f757#f1e94ec34dd5f11ad6488a3a8ac7988439a3f757"
 dependencies = [
 "atoi",
 "chrono",
@@ -4731,6 +4786,7 @@ version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "08a05a66a4fdd61cbbe0a1d755ffe0ca6aba159dd4820936a0ff8a8278245b9c"
 dependencies = [
+ "async-compression",
 "bitflags",
 "bytes",
 "futures-core",
@@ -4995,9 +5051,9 @@ checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"

 [[package]]
 name = "uuid"
-version = "1.26.1"
+version = "1.27.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ef6dac1e96601b4fb3acccccff2139741fcb757cb9a36089bf5be91cfb285ce"
+checksum = "97277d36b9c3ace13e58fa6e753f8b0bbbf302a18dd193240d70f9e29681059a"
 dependencies = [
 "getrandom 0.4.3",
 "js-sys",
@@ -5182,6 +5238,12 @@ name = "whoami"
 version = "2.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "998767ef88740d1f5b0682a9c53c24431453923962269c2db68ee43788c5a40d"
+dependencies = [
+ "libc",
+ "libredox",
+ "objc2-system-configuration",
+ "web-sys",
+]

 [[package]]
 name = "winapi"
@@ -5529,9 +5591,9 @@ dependencies = [

 [[package]]
 name = "zeroize"
-version = "1.9.0"
+version = "1.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
+checksum = "e13084392c5e4bc371903e2935a5eaeed24905a7511356b883835e18a78f6879"
 dependencies = [
 "zeroize_derive",
 ]
@@ -5582,14 +5644,15 @@ dependencies = [

 [[package]]
 name = "zip"
-version = "8.6.0"
+version = "9.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d04a6b5381502aa6087c94c669499eb1602eb9c5e8198e534de571f7154809b"
+checksum = "a954114b47a54df49f83d2722814e86b23d4bb1b54a1b90fb7d92b41619ddc22"
 dependencies = [
 "crc32fast",
 "flate2",
 "indexmap",
 "memchr",
+ "nix",
 "typed-path",
 ]

@@ -59,3 +59,5 @@ panic = "abort"
 [patch.crates-io]
 # Upstream SOCKS IPv6 fix; remove once a release includes hyperium/hyper-util#302.
 hyper-util = { git = "https://github.com/hyperium/hyper-util", rev = "191b1acf0a6b18e807e4abf5a6d4a7c47979ecd6" }
+# 固定上游 BEGIN 取消回滚修复，避免未结束事务复用；见 transact-rs/sqlx#4394
+sqlx = { git = "https://github.com/transact-rs/sqlx", rev = "f1e94ec34dd5f11ad6488a3a8ac7988439a3f757" }
@@ -67,6 +67,7 @@ async fn execute(
    let Environment {
        host,
        mut store,
+        timezone,
        plugin_cache,
        version,
        plugin_http,
@@ -93,7 +94,7 @@ async fn execute(
        Some(plugin_runtime.clone()),
        Some(plugin_runtime.observer_registry()),
        Some(plugin_runtime.policy_registry()),
-        Some(plugin_runtime.middleware_registry()),
+        Some(plugin_runtime.execution_registry()),
    );
    let management = ManagementPorts::new(&store, providers.admin.clone(), core.snapshot_control());
    or_shutdown!(plugin_runtime, management.bind(&plugin_runtime));
@@ -107,14 +108,30 @@ async fn execute(
    let settings = gateway_admin::initialize_settings(
        store.admin_ports().settings(),
        core.snapshot_control(),
-        providers.admin,
+        providers.admin.clone(),
        std::sync::Arc::new(gateway_host::pricing::ModelsDevPricing),
    );
-    let mut services = gateway_admin::service::Registry::new(service_middleware(
+    let mut services = gateway_admin::public_service::Registry::new(service_middleware(
        core.snapshots(),
        &plugin_runtime,
    ));
    or_shutdown!(plugin_runtime, services.register_settings(&settings));
+    let accounts = gateway_admin::initialize_accounts(
+        store.admin_ports().accounts(),
+        store.admin_ports().account_runtime(),
+        store.admin_ports().settings(),
+        timezone,
+        providers.admin.clone(),
+        core.snapshot_control(),
+        core.account_probe(),
+    );
+    or_shutdown!(plugin_runtime, services.register_accounts(&accounts));
+    let usage_data = gateway_admin::initialize_usage_data(
+        store.admin_ports().usage_data(),
+        store.admin_ports().settings(),
+        providers.admin,
+    );
+    or_shutdown!(plugin_runtime, services.register_usage_data(&usage_data));
    let services = std::sync::Arc::new(services);
    or_shutdown!(plugin_runtime, plugin_runtime.bind_services(&services));
    let commands = or_shutdown!(plugin_runtime, plugin_runtime.prepare_command_line().await);
@@ -72,11 +72,11 @@ impl ManagementPorts {
 pub(super) fn service_middleware(
    snapshots: RuntimeSnapshotHandle,
    runtime: &PluginRuntime,
-) -> gateway_admin::service::PlanSource {
-    let middleware = runtime.middleware_registry();
+) -> gateway_admin::public_service::PlanSource {
+    let middleware = runtime.execution_registry();
    Arc::new(move || {
        let snapshot = snapshots.snapshot_for_diagnostics()?;
-        middleware.resolve(snapshot.extensions()?)
+        middleware.middleware(snapshot.extensions()?)
    })
 }

@@ -1,4 +1,4 @@
-//! 服务模式完成全部组装后交给 Host 监听，并在请求和 Worker 排空后关闭插件
+//! 服务模式完成全部组装后交给 Host 监听，并在停止监听与 Worker 收尾后关闭插件

 use gateway_host::ConfigError;

@@ -28,7 +28,7 @@ pub async fn run() -> Result<(), BootstrapError> {
        Some(plugin_runtime.clone()),
        Some(plugin_runtime.observer_registry()),
        Some(plugin_runtime.policy_registry()),
-        Some(plugin_runtime.middleware_registry()),
+        Some(plugin_runtime.execution_registry()),
        Some(plugin_runtime.frontend_authentication_registry()),
    );
    let management = ManagementPorts::new(&store, providers.admin.clone(), core.snapshot_control());
@@ -56,6 +56,12 @@ pub async fn run() -> Result<(), BootstrapError> {
        plugin_runtime,
        gateway_host::plugin_distribution::HttpPluginDistribution::new(plugin_http)
    ));
+    let analytics_worker = or_shutdown!(
+        plugin_runtime,
+        store.request_analytics_worker(std::sync::Arc::new(
+            gateway_admin::ProviderUsageBillingProjector::new(providers.admin.clone()),
+        ))
+    );
    let mut admin = or_shutdown!(
        plugin_runtime,
        gateway_admin::initialize_with_plugin_accounts(
@@ -117,18 +123,19 @@ pub async fn run() -> Result<(), BootstrapError> {
            probes,
            host.worker_health(),
            host.connection_lifecycle(),
+            store.diagnostics(),
        )
    )
    .with_middleware({
        let snapshots = core.snapshots();
-        let middleware = plugin_runtime.middleware_registry();
+        let middleware = plugin_runtime.execution_registry();
        move |snapshot| {
            if let Some(snapshot) = snapshot {
-                return middleware.resolve(snapshot.extensions()?);
+                return middleware.middleware(snapshot.extensions()?);
            }
            // 数据面未就绪时，管理与诊断路由仍可使用发布候选中的插件
            let diagnostic = snapshots.snapshot_for_diagnostics()?;
-            middleware.resolve(diagnostic.extensions()?)
+            middleware.middleware(diagnostic.extensions()?)
        }
    });
    let http_dispatcher = api.dispatcher();
@@ -141,6 +148,7 @@ pub async fn run() -> Result<(), BootstrapError> {
    );

    let mut plan = store.take_worker_contributions();
+    plan.push(analytics_worker);
    plan.push(or_shutdown!(
        plugin_runtime,
        gateway_host::retention::worker(store.retention())
@@ -155,7 +163,7 @@ pub async fn run() -> Result<(), BootstrapError> {
    ));
    or_shutdown!(
        plugin_runtime,
-        host.start_workers(plan, store.worker_leader_lease())
+        host.start_workers(plan, store.worker_leader_lease(), store.diagnostics())
    );
    host.report_startup_ready("Workers");
    let served = host.serve(api.router()).await;
@@ -4,6 +4,7 @@ use std::{
    collections::{BTreeMap, BTreeSet},
    fs,
    path::{Path, PathBuf},
+    sync::OnceLock,
 };

 use syn::{Item, visit::Visit};
@@ -26,22 +27,24 @@ pub(super) const WORKSPACE_MEMBERS: &[&str] = &[

 #[test]
 fn workspace_member_list_matches_the_frozen_dag_scope() {
-    let manifest =
-        fs::read_to_string(backend_root().join("Cargo.toml")).expect("read workspace manifest");
-    for member in WORKSPACE_MEMBERS {
-        assert!(
-            manifest.contains(&format!("\"{member}\"")),
-            "workspace must include {member}"
-        );
-    }
-    let member_count = manifest
-        .lines()
-        .map(str::trim)
-        .filter(|line| line.starts_with("\"apps/") || line.starts_with("\"crates/"))
-        .count();
+    let metadata = cargo_metadata_json();
+    let root = backend_root();
+    let actual: BTreeSet<_> = metadata["packages"]
+        .as_array()
+        .expect("Cargo packages")
+        .iter()
+        .map(|package| {
+            Path::new(package["manifest_path"].as_str().expect("package manifest"))
+                .parent()
+                .expect("package directory")
+                .strip_prefix(&root)
+                .expect("workspace member path")
+                .to_path_buf()
+        })
+        .collect();
    assert_eq!(
-        member_count,
-        WORKSPACE_MEMBERS.len(),
+        actual,
+        WORKSPACE_MEMBERS.iter().map(PathBuf::from).collect(),
        "new workspace members must extend the dependency DAG rules"
    );
 }
@@ -79,18 +82,25 @@ fn core_value_owners_do_not_depend_on_execution_or_routing() {
            path if path.starts_with("policy/") => {
                Some(&["account", "identity", "policy", "validation"])
            }
-            "settings/values.rs" | "settings/compiled.rs" => {
-                Some(&["account", "concurrency", "identity", "metering", "policy"])
-            }
+            path if path.starts_with("settings/") => Some(&[
+                "account",
+                "concurrency",
+                "identity",
+                "metering",
+                "policy",
+                "settings",
+            ]),
            path if path.starts_with("account/") => Some(&["account", "identity", "validation"]),
            _ => None,
        };
        let Some(allowed) = allowed else { continue };
        let source = fs::read_to_string(root.join(&relative)).expect("read core source");
        let syntax = syn::parse_file(&source).expect("parse core source");
-        let mut references = CrateReferences::default();
+        let mut references = CrateReferences::in_module(&relative);
        references.visit_file(&syntax);
-        for dependency in references.0 {
+        // 相对路径中的 self 指向当前 owner，不是跨 owner 依赖
+        references.owners.remove(&references.module_path[0]);
+        for dependency in references.owners {
            assert!(
                allowed.contains(&dependency.as_str()),
                "{} must not depend on crate::{dependency}",
@@ -100,49 +110,155 @@ fn core_value_owners_do_not_depend_on_execution_or_routing() {
    }
 }

+#[test]
+fn core_owner_paths_form_a_dag() {
+    let root = backend_root().join("crates/gateway-core/src");
+    let mut graph = BTreeMap::<String, BTreeSet<String>>::new();
+    for relative in super::rust_files(&root) {
+        if relative == Path::new("lib.rs") {
+            continue;
+        }
+        let mut references = CrateReferences::in_module(&relative);
+        let owner = references.module_path[0].clone();
+        let source = fs::read_to_string(root.join(&relative)).expect("read core source");
+        references.visit_file(&syn::parse_file(&source).expect("parse core source"));
+        references.owners.remove(&owner);
+        graph.entry(owner).or_default().extend(references.owners);
+    }
+    for owner in graph.keys() {
+        let mut pending = graph[owner].iter().cloned().collect::<Vec<_>>();
+        let mut visited = BTreeSet::new();
+        while let Some(dependency) = pending.pop() {
+            assert_ne!(
+                &dependency, owner,
+                "Core owner dependency cycle reaches {owner}"
+            );
+            if visited.insert(dependency.clone())
+                && let Some(next) = graph.get(&dependency)
+            {
+                pending.extend(next.iter().cloned());
+            }
+        }
+    }
+}
+
+#[test]
+fn core_reference_scan_resolves_groups_reexports_and_relative_paths() {
+    let syntax = syn::parse_file(
+        r#"
+        pub use crate::{engine::AttemptContext, settings::SettingsValues as Values};
+        use super::super::runtime as publication;
+        use self::compiled::Value;
+        // crate::ignored::Comment
+        const EXAMPLE: &str = "crate::ignored::Literal";
+        "#,
+    )
+    .expect("parse reference fixture");
+    let mut references = CrateReferences::in_module(Path::new("routing/snapshot.rs"));
+    references.visit_file(&syntax);
+    assert_eq!(
+        references.owners,
+        BTreeSet::from([
+            "engine".to_owned(),
+            "settings".to_owned(),
+            "runtime".to_owned(),
+            "routing".to_owned(),
+        ])
+    );
+}
+
 #[derive(Default)]
-struct CrateReferences(BTreeSet<String>);
+struct CrateReferences {
+    owners: BTreeSet<String>,
+    module_path: Vec<String>,
+}

 impl<'ast> Visit<'ast> for CrateReferences {
    fn visit_path(&mut self, path: &'ast syn::Path) {
-        let mut segments = path.segments.iter();
-        if segments
-            .next()
-            .is_some_and(|segment| segment.ident == "crate")
-            && let Some(owner) = segments.next()
-        {
-            self.0.insert(owner.ident.to_string());
-        }
+        self.record(
+            &path
+                .segments
+                .iter()
+                .map(|part| part.ident.to_string())
+                .collect::<Vec<_>>(),
+        );
        syn::visit::visit_path(self, path);
    }

    fn visit_item_use(&mut self, item: &'ast syn::ItemUse) {
-        self.use_tree(&item.tree, false);
+        self.use_tree(&item.tree, &mut Vec::new());
    }
 }

 impl CrateReferences {
-    fn use_tree(&mut self, tree: &syn::UseTree, crate_root: bool) {
+    fn in_module(relative: &Path) -> Self {
+        let mut module = relative
+            .with_extension("")
+            .components()
+            .map(|part| {
+                part.as_os_str()
+                    .to_str()
+                    .expect("UTF-8 module path")
+                    .to_owned()
+            })
+            .collect::<Vec<_>>();
+        if module.last().is_some_and(|part| part == "mod") {
+            module.pop();
+        }
+        Self {
+            owners: BTreeSet::new(),
+            module_path: module,
+        }
+    }
+
+    fn record(&mut self, path: &[String]) {
+        let Some(first) = path.first() else { return };
+        let owner = if first == "crate" {
+            path.get(1).cloned()
+        } else if first == "self" || first == "super" {
+            let mut module = self.module_path.clone();
+            let mut rest = path;
+            while rest
+                .first()
+                .is_some_and(|part| part == "super" || part == "self")
+            {
+                if rest[0] == "super" {
+                    module.pop();
+                }
+                rest = &rest[1..];
+            }
+            module.first().or_else(|| rest.first()).cloned()
+        } else {
+            None
+        };
+        if let Some(owner) = owner {
+            self.owners.insert(owner);
+        }
+    }
+
+    fn use_tree(&mut self, tree: &syn::UseTree, prefix: &mut Vec<String>) {
        match tree {
-            syn::UseTree::Path(path) if crate_root => {
-                self.0.insert(path.ident.to_string());
+            syn::UseTree::Path(path) => {
+                prefix.push(path.ident.to_string());
+                self.use_tree(&path.tree, prefix);
+                prefix.pop();
            }
-            syn::UseTree::Name(name) if crate_root => {
-                self.0.insert(name.ident.to_string());
+            syn::UseTree::Name(name) => {
+                prefix.push(name.ident.to_string());
+                self.record(prefix);
+                prefix.pop();
            }
-            syn::UseTree::Rename(rename) if crate_root => {
-                self.0.insert(rename.ident.to_string());
+            syn::UseTree::Rename(rename) => {
+                prefix.push(rename.ident.to_string());
+                self.record(prefix);
+                prefix.pop();
            }
-            syn::UseTree::Path(path) => self.use_tree(&path.tree, path.ident == "crate"),
            syn::UseTree::Group(group) => {
                for item in &group.items {
-                    self.use_tree(item, crate_root);
+                    self.use_tree(item, prefix);
                }
            }
-            syn::UseTree::Glob(_) if crate_root => {
-                self.0.insert("*".to_owned());
-            }
-            _ => {}
+            syn::UseTree::Glob(_) => self.record(prefix),
        }
    }
 }
@@ -221,7 +337,7 @@ const ADAPTER_PUBLIC_MODULES: &[(&str, &[&str])] = &[
        "crates/providers/openai",
        &["config", "credential", "transport"],
    ),
-    ("crates/providers/xai", &["credential", "transport"]),
+    ("crates/providers/xai", &["transport"]),
 ];

 /// 不对应单一生产模块、而是校验 crate/workspace 整体契约的根级测试场景
@@ -265,7 +381,7 @@ const ALLOWED_INTERNAL_EDGES: &[(&str, &str)] = &[
 #[test]
 fn workspace_internal_dependency_edges_match_frozen_dag() {
    let metadata = cargo_metadata_json();
-    let actual = workspace_runtime_dependency_edges(&metadata);
+    let actual = workspace_runtime_dependency_edges(metadata);
    let mut expected: Vec<(String, String)> = ALLOWED_INTERNAL_EDGES
        .iter()
        .map(|(from, to)| ((*from).to_owned(), (*to).to_owned()))
@@ -361,24 +477,6 @@ fn adapter_public_module_surfaces_match_allowlist() {
    }
 }

-#[test]
-fn production_sources_do_not_host_tests() {
-    for member in WORKSPACE_MEMBERS {
-        let src = backend_root().join(member).join("src");
-        let sources = super::rust_files(&src);
-        assert!(!sources.is_empty(), "{member} has no production sources");
-        for relative in sources {
-            let path = src.join(relative);
-            let source = fs::read_to_string(&path).expect("read production source");
-            assert!(
-                !source.contains("#[cfg(test)]"),
-                "{} hosts tests in production src",
-                path.display()
-            );
-        }
-    }
-}
-
 #[test]
 fn workspace_modules_follow_conventional_file_layout() {
    let targets = test_source_roots();
@@ -635,40 +733,46 @@ pub(super) fn backend_root() -> PathBuf {
        .expect("backend workspace root")
 }

-fn cargo_metadata_json() -> serde_json::Value {
-    let output = std::process::Command::new("cargo")
-        .args(["metadata", "--format-version", "1", "--no-deps"])
-        .current_dir(backend_root())
-        .output()
-        .expect("run cargo metadata");
-    assert!(
-        output.status.success(),
-        "cargo metadata failed: {}",
-        String::from_utf8_lossy(&output.stderr)
-    );
-    serde_json::from_slice(&output.stdout).expect("parse cargo metadata")
+fn cargo_metadata_json() -> &'static serde_json::Value {
+    static METADATA: OnceLock<serde_json::Value> = OnceLock::new();
+    METADATA.get_or_init(|| {
+        let output = std::process::Command::new("cargo")
+            .args(["metadata", "--format-version", "1", "--no-deps", "--locked"])
+            .current_dir(backend_root())
+            .output()
+            .expect("run cargo metadata");
+        assert!(
+            output.status.success(),
+            "cargo metadata failed: {}",
+            String::from_utf8_lossy(&output.stderr)
+        );
+        serde_json::from_slice(&output.stdout).expect("parse cargo metadata")
+    })
 }

-/// 提取成员 `[dependencies]` 段内声明的依赖名;段落以下一个 `[` 表头结束
+/// 复用 Cargo 解析后的实际包名，覆盖重命名依赖与平台条件，排除测试和构建依赖
 fn dependency_names(member: &str) -> Vec<String> {
-    let manifest = fs::read_to_string(backend_root().join(member).join("Cargo.toml"))
-        .expect("read member manifest");
-    let mut in_dependencies = false;
-    let mut names = Vec::new();
-    for line in manifest.lines() {
-        let line = line.trim();
-        if line.starts_with('[') {
-            in_dependencies = line == "[dependencies]";
-            continue;
-        }
-        if !in_dependencies || line.is_empty() || line.starts_with('#') {
-            continue;
-        }
-        if let Some((name, _)) = line.split_once('=') {
-            names.push(name.trim().to_owned());
-        }
-    }
-    names
+    let manifest = backend_root().join(member).join("Cargo.toml");
+    let package = cargo_metadata_json()["packages"]
+        .as_array()
+        .expect("Cargo packages")
+        .iter()
+        .find(|package| {
+            Path::new(package["manifest_path"].as_str().expect("package manifest")) == manifest
+        })
+        .expect("workspace member");
+    package["dependencies"]
+        .as_array()
+        .expect("package dependencies")
+        .iter()
+        .filter(|dependency| dependency["kind"].is_null())
+        .map(|dependency| {
+            dependency["name"]
+                .as_str()
+                .expect("dependency name")
+                .to_owned()
+        })
+        .collect()
 }

 fn assert_no_dependency(member: &str, forbidden: &[&str]) {
@@ -76,11 +76,6 @@ fn config_loader_should_reject_missing_runtime_data_dir() {
    assert!(parse_config(&config).is_err());
 }

-#[test]
-fn config_loader_should_inject_connection_passwords_into_urls() {
-    parse_config(&valid_config()).expect("Store validates password injection into both URLs");
-}
-
 #[test]
 fn config_loader_should_apply_only_explicit_topology_overrides() {
    let invalid = valid_config()
@@ -78,7 +78,7 @@ async fn proxy_probe_should_use_provider_custom_ca_for_https_proxies() {
    });
    let probe = HttpProxyProbe::new("http://unresolvable.invalid/ip")
        .with_client_builder(provider_openai::build_reqwest_client_with_custom_ca);
-    let result = probe.test(&proxy, false).await;
+    let result = probe.test(Some(&proxy), false).await;
    assert!(result.success, "{}", result.message);
    assert_eq!(result.exit_ip.unwrap().to_string(), "203.0.113.8");
    tokio::time::timeout(Duration::from_secs(5), server)
@@ -59,9 +59,16 @@ fn cargo_library_root_is_conventional_lib() {
 fn workspace_production_files_have_no_hidden_modules_or_test_hooks() {
    for member in architecture::WORKSPACE_MEMBERS {
        let root = architecture::backend_root().join(member).join("src");
-        for relative in rust_files(&root) {
+        let sources = rust_files(&root);
+        assert!(!sources.is_empty(), "{member} has no production sources");
+        for relative in sources {
            let path = root.join(relative);
            let source = fs::read_to_string(&path).expect("read production source");
+            assert!(
+                !source.contains("#[cfg(test)]"),
+                "{} hosts tests in production src",
+                path.display()
+            );
            assert!(
                !source.contains("include!("),
                "{} uses include!",
@@ -28,11 +28,8 @@ cpr-plugin package \

 资源映射相对于作者清单所在目录解析。输出包括完整插件 ID、版本和目标 triple 命名的 `.tar.gz` 及 `.sha256`；归档根目录直接包含 `plugin.json`、可执行文件和已声明资源，不包含开发依赖

-作者清单可省略普通贡献项的 `id`、`version` 和固定阶段；`middleware` 必须显式声明版本 `4`，
-并从 `http`、`websocket`、`service`、`request`、`attempt` 中选择挂载阶段；`upstream_adapter` 必须显式声明版本 `2`。
-CLI 与 SDK 的 `Manifest::from_author_slice`、`PluginBuilder::from_json` 共用规范化入口；归档中的
-`plugin.json` 写入补全后的贡献项字段，不保留另一份作者声明。
-完整规则见 [SDK 清单](../../crates/gateway-plugin/sdk/docs/manifest.md)
+作者清单的省略规则、能力版本和挂载阶段见 [SDK 扩展项声明](../../crates/gateway-plugin/sdk/docs/manifest.md#扩展项简写)。
+CLI 与 SDK 的 `Manifest::from_author_slice`、`PluginBuilder::from_json` 共用规范化入口，归档只保留补全字段后的 `plugin.json`

 支持 `x86_64-unknown-linux-gnu`、`aarch64-unknown-linux-gnu` 和 `aarch64-apple-darwin`。
 完整开发示例在独立仓库 `codex-proxy-plugins` 的 `examples/workbench`，可通过[子模块](../../../docs/development.md#源码联调)检出；本工具不负责源码构建、上传或启用插件
@@ -250,8 +250,8 @@ fn source_manifest() -> &'static [u8] {
      "main":"bin/plugin",
      "runtime":"trustedProcess",
      "contributes":{
-        "middleware":{"version":4,"stages":["request"],"inputFormats":["openai"],"outputFormats":["openai"]},
-        "management":{}
+        "middleware":{"version":5,"stages":["request"],"inputFormats":["openai"],"outputFormats":["openai"]},
+        "management":{"version":2}
      },

      "icon":"assets/icon.png",
@@ -21,6 +21,7 @@ futures = "0.3.32"
 gateway-core = { path = "../gateway-core" }
 heck = "0.5.0"
 hex = "0.4.3"
+hkdf = "0.13.0"
 rand_core = { version = "0.6.4", features = ["getrandom"] }
 serde = { version = "1.0.228", features = ["derive"] }
 serde_json = { version = "1.0.150", features = ["arbitrary_precision", "preserve_order"] }
@@ -30,7 +31,7 @@ sha2 = "0.11"
 subtle = "2.6.1"
 thiserror = "2.0.18"
 tracing = "0.1.44"
-uuid = { version = "1.23.3", features = ["v7"] }
+uuid = { version = "1.23.3", features = ["v4", "v7"] }
 cron = "0.17"
 chrono-tz = "0.10"
 tokio = { version = "1.52", features = ["rt", "time", "macros", "sync"] }
@@ -28,7 +28,7 @@ use crate::{

 impl From<BackupError> for WorkerTaskError {
    fn from(error: BackupError) -> Self {
-        WorkerTaskError::safe(error.message())
+        WorkerTaskError::safe(error.message()).with_source(error)
    }
 }

@@ -125,8 +125,9 @@ impl BackupTask {
        if cron.is_empty() {
            return Ok(());
        }
-        let schedule = BackupSchedule::parse(cron, self.timezone)
-            .map_err(|_| WorkerTaskError::safe("backup schedule is invalid"))?;
+        let schedule = BackupSchedule::parse(cron, self.timezone).map_err(|source| {
+            WorkerTaskError::safe("backup schedule is invalid").with_source(source)
+        })?;

        if settings.schedule_timezone.as_deref() != Some(timezone) {
            // 时区切换只初始化未来游标，不把旧时区计划当作应补跑任务
@@ -280,7 +281,6 @@ impl BackupTask {
                .await?;
            }
            None => {
-                let _ = self.dump.cleanup_staging(&record.id).await;
                self.fail_task(record, code::PG_DUMP_FAILED, "导出进程中断，暂存归档不完整")
                    .await?;
            }
@@ -306,7 +306,8 @@ impl BackupTask {
            && record.sha256.as_deref() == Some(remote.sha256.as_str())
        {
            let now = Utc::now();
-            self.repository
+            if self
+                .repository
                .transition_status(
                    &record.id,
                    status_transition(BackupStatus::Uploading, BackupStatus::Completed)?,
@@ -314,7 +315,11 @@ impl BackupTask {
                    now,
                )
                .await
-                .map_err(repo_error)?;
+                .map_err(repo_error)?
+                .is_some()
+            {
+                self.cleanup_staging(&record.id).await;
+            }
            return Ok(());
        }
        match self.dump.inspect_staging(&record.id).await? {
@@ -454,9 +459,7 @@ impl BackupTask {
            now,
            cancellation,
        )
-        .await?;
-        let _ = self.dump.cleanup_staging(&record.id).await;
-        Ok(())
+        .await
    }

    /// 上传 + 远端校验，内部完成终态迁移
@@ -488,11 +491,13 @@ impl BackupTask {
            )
            .await
        {
-            let _ = store.delete_object(&config, &record.object_key).await;
-            self.fail_task(
+            self.fail_uploaded_task(
                record,
-                error.code(),
-                format!("上传到对象存储失败：{}", error.message()),
+                &config,
+                BackupError::new(
+                    error.code(),
+                    format!("上传到对象存储失败：{}", error.message()),
+                ),
            )
            .await?;
            return Ok(());
@@ -517,6 +522,7 @@ impl BackupTask {
                        size_bytes,
                        "备份完成"
                    );
+                    self.cleanup_staging(&record.id).await;
                }
            }
            Ok(Some(remote)) => {
@@ -529,16 +535,19 @@ impl BackupTask {
                    sha256_matches,
                    "备份远端对象校验不一致"
                );
-                let _ = store.delete_object(&config, &record.object_key).await;
-                self.fail_task(
+                self.fail_uploaded_task(
                    record,
-                    code::REMOTE_VERIFICATION_FAILED,
-                    match (size_matches, sha256_matches) {
-                        (false, true) => "远端对象大小不一致",
-                        (true, false) => "远端对象 sha256 校验值不一致",
-                        (false, false) => "远端对象大小和 sha256 校验值均不一致",
-                        (true, true) => "远端对象校验状态异常",
-                    },
+                    &config,
+                    BackupError::new(
+                        code::REMOTE_VERIFICATION_FAILED,
+                        match (size_matches, sha256_matches) {
+                            (false, true) => "远端对象大小不一致",
+                            (true, false) => "远端对象 sha256 校验值不一致",
+                            (false, false) => "远端对象大小和 sha256 校验值均不一致",
+                            (true, true) => "远端对象校验状态异常",
+                        }
+                        .to_owned(),
+                    ),
                )
                .await?;
            }
@@ -552,11 +561,13 @@ impl BackupTask {
                .await?;
            }
            Err(error) => {
-                let _ = store.delete_object(&config, &record.object_key).await;
-                self.fail_task(
+                self.fail_uploaded_task(
                    record,
-                    error.code(),
-                    format!("远端对象校验失败：{}", error.message()),
+                    &config,
+                    BackupError::new(
+                        error.code(),
+                        format!("远端对象校验失败：{}", error.message()),
+                    ),
                )
                .await?;
            }
@@ -564,6 +575,24 @@ impl BackupTask {
        Ok(())
    }

+    /// 清理失败并入原终态，后续清理沿用备份记录的到期策略
+    async fn fail_uploaded_task(
+        &self,
+        record: &BackupRecord,
+        config: &BackupStorageConfig,
+        mut error: BackupError,
+    ) -> Result<(), WorkerTaskError> {
+        if let Err(cleanup) = self
+            .object_store
+            .delete_object(config, &record.object_key)
+            .await
+        {
+            error =
+                error.with_cleanup_failure("DeleteObject", &cleanup, record.expires_at.is_some());
+        }
+        self.fail_task(record, error.code(), error.message()).await
+    }
+
    /// 把活跃任务写入失败终态并清理暂存
    async fn fail_task(
        &self,
@@ -595,10 +624,16 @@ impl BackupTask {
            )
            .await
            .map_err(repo_error)?;
-        let _ = self.dump.cleanup_staging(&record.id).await;
+        self.cleanup_staging(&record.id).await;
        Ok(())
    }

+    async fn cleanup_staging(&self, backup_id: &str) {
+        if let Err(error) = self.dump.cleanup_staging(backup_id).await {
+            warn!(backup_id, error = %error, "清理备份暂存失败");
+        }
+    }
+
    /// 执行一小批到期保留清理：先处理 `expires_at` 已到期的记录，再按天数/份数清理计划备份
    async fn run_retention_batch(&self, now: DateTime<Utc>) -> Result<(), WorkerTaskError> {
        let settings = self.repository.load_settings().await.map_err(repo_error)?;
@@ -685,9 +720,9 @@ fn status_transition(
 }

 fn repo_error(error: crate::ports::store::AdminStoreError) -> WorkerTaskError {
-    WorkerTaskError::safe(format!("backup store failed: {error}"))
+    WorkerTaskError::safe("backup store failed").with_source(error)
 }

 fn infra_error(error: BackupError) -> WorkerTaskError {
-    WorkerTaskError::safe(error.message())
+    WorkerTaskError::safe(error.message()).with_source(error)
 }
@@ -66,13 +66,13 @@ impl FreezeRecoveryTask {
    async fn freeze_policy(&self) -> Option<gateway_core::provider_ports::ProviderFreezePolicy> {
        let settings = self.deps.settings.load_runtime_settings().await.ok()?;
        gateway_core::provider_ports::ProviderFreezePolicy::try_new(
-            settings.account_auto_freeze_enabled,
-            settings.account_auto_freeze_threshold,
-            settings.account_auto_freeze_window_seconds,
-            settings.account_auto_freeze_duration_seconds,
-            settings.account_auto_freeze_probe_enabled,
-            settings.account_auto_freeze_probe_model,
-            settings.account_auto_freeze_adaptive_concurrency,
+            settings.values.account_auto_freeze_enabled,
+            settings.values.account_auto_freeze_threshold,
+            settings.values.account_auto_freeze_window_seconds,
+            settings.values.account_auto_freeze_duration_seconds,
+            settings.values.account_auto_freeze_probe_enabled,
+            settings.values.account_auto_freeze_probe_model,
+            settings.values.account_auto_freeze_adaptive_concurrency,
        )
        .ok()
    }
@@ -20,7 +20,8 @@ pub mod backup;
 pub mod freeze_recovery;
 pub mod model;
 pub mod ports;
-pub mod service;
+pub mod public_service;
+mod reset_credit_automation;
 mod use_case;
 pub use use_case::plugins::{PluginDistributionPorts, PluginManagementService, PluginsService};

@@ -35,10 +36,11 @@ pub use use_case::{
    client_keys::ClientKeyService,
    credentials::{CredentialsService, ProviderCredentials},
    import_tasks::ImportTasksService,
-    observability::ObservabilityService,
+    observability::{ObservabilityService, ProviderUsageBillingProjector},
    proxies::ProxiesService,
    settings::SettingsService,
    system::SystemService,
+    usage_data::UsageDataService,
 };

 use model::AdminError;
@@ -104,10 +106,16 @@ impl fmt::Debug for InitialAdminPassword {
 #[derive(Clone, Deserialize, PartialEq, Eq)]
 pub struct AdminConfig {
    pub session_ttl_minutes: u64,
+    #[serde(default = "default_absolute_session_ttl_minutes")]
+    pub session_absolute_ttl_minutes: u64,
    pub default_username: String,
    pub default_password: InitialAdminPassword,
 }

+fn default_absolute_session_ttl_minutes() -> u64 {
+    30 * 24 * 60
+}
+
 /// Client 登录域的通用启动配置
 #[derive(Debug, Clone, Deserialize, PartialEq, Eq)]
 pub struct ClientConfig {
@@ -151,6 +159,13 @@ impl AdminConfig {
        if self.session_ttl_minutes == 0 || i64::try_from(self.session_ttl_minutes).is_err() {
            return Err(AdminConfigError::InvalidField("admin.session_ttl_minutes"));
        }
+        if self.session_absolute_ttl_minutes == 0
+            || i64::try_from(self.session_absolute_ttl_minutes).is_err()
+        {
+            return Err(AdminConfigError::InvalidField(
+                "admin.session_absolute_ttl_minutes",
+            ));
+        }
        let password = self.default_password.expose().trim();
        if password.len() < MINIMUM_INITIAL_PASSWORD_BYTES
            || password.contains('$')
@@ -167,6 +182,10 @@ impl fmt::Debug for AdminConfig {
        formatter
            .debug_struct("AdminConfig")
            .field("session_ttl_minutes", &self.session_ttl_minutes)
+            .field(
+                "session_absolute_ttl_minutes",
+                &self.session_absolute_ttl_minutes,
+            )
            .field("default_username", &self.default_username)
            .field("default_password", &"[REDACTED]")
            .finish()
@@ -188,7 +207,7 @@ pub enum AdminConfigError {
 #[derive(Clone)]
 pub struct AdminServices {
    timezone: gateway_core::time::DeploymentTimeZone,
-    public_services: Arc<service::Registry>,
+    public_services: Arc<public_service::Registry>,
    plugins: Arc<PluginsService>,
    plugin_management: Arc<PluginManagementService>,
    proxies: Arc<dyn ProxiesService>,
@@ -200,9 +219,11 @@ pub struct AdminServices {
    client_distribution: Arc<dyn ClientDistributionService>,
    observability: Arc<dyn ObservabilityService>,
    settings: Arc<dyn SettingsService>,
+    usage_data: Arc<dyn UsageDataService>,
    system: Arc<dyn SystemService>,
    credentials: Arc<CredentialsService>,
-    plugin_accounts: Arc<dyn PluginAccountAccess>,
+    // Runtime 只持有 Weak，这个强引用保障账号端口与 Admin 服务同寿命
+    _plugin_accounts: Arc<dyn PluginAccountAccess>,
    backups: Arc<dyn BackupService>,
    import_tasks: Arc<dyn ImportTasksService>,
 }
@@ -213,7 +234,7 @@ impl AdminServices {
        self.timezone
    }

-    pub fn public_services(&self) -> Arc<service::Registry> {
+    pub fn public_services(&self) -> Arc<public_service::Registry> {
        self.public_services.clone()
    }

@@ -237,12 +258,6 @@ impl AdminServices {
        self.key_usage.as_ref()
    }

-    /// 取得账号服务的共享句柄；后台编排（冻结恢复 worker）需要持有 Arc
-    #[must_use]
-    pub fn accounts_handle(&self) -> Arc<dyn AccountsService> {
-        Arc::clone(&self.accounts)
-    }
-
    #[must_use]
    pub fn proxies(&self) -> &dyn ProxiesService {
        self.proxies.as_ref()
@@ -273,6 +288,11 @@ impl AdminServices {
        self.client_distribution.as_ref()
    }

+    #[must_use]
+    pub fn usage_data(&self) -> &dyn UsageDataService {
+        self.usage_data.as_ref()
+    }
+
    #[must_use]
    pub fn observability(&self) -> &dyn ObservabilityService {
        self.observability.as_ref()
@@ -292,12 +312,6 @@ impl AdminServices {
        self.credentials.as_ref()
    }

-    /// Runtime 只持有该窄端口的 Weak；AdminBundle 保持实际生命周期
-    #[must_use]
-    pub fn plugin_accounts_handle(&self) -> Arc<dyn PluginAccountAccess> {
-        Arc::clone(&self.plugin_accounts)
-    }
-
    #[must_use]
    pub fn backups(&self) -> &dyn BackupService {
        self.backups.as_ref()
@@ -325,7 +339,7 @@ impl AdminBundle {
 /// 组合根提供给控制面的运行能力；与配置和存储端口分别传入
 pub struct AdminRuntimePorts {
    pub timezone: gateway_core::time::DeploymentTimeZone,
-    pub service_middleware: service::PlanSource,
+    pub service_middleware: public_service::PlanSource,
    pub plugin_preparation: Arc<dyn ports::plugins::PluginPreparation>,
    pub plugin_management: Arc<dyn ports::plugin_management::PluginManagement>,
    pub published_snapshot: gateway_core::runtime::RuntimeSnapshotHandle,
@@ -399,8 +413,7 @@ async fn initialize_inner(
    let registry = providers;

    let auth = Arc::new(DefaultAuthService::new(
-        config.default_username,
-        config.session_ttl_minutes,
+        &config,
        client_config.session_ttl_minutes,
        store.auth(),
        client_key_verifier.clone(),
@@ -408,13 +421,15 @@ async fn initialize_inner(
    auth.ensure_default_admin(config.default_password.expose())
        .await?;

-    let accounts = Arc::new(DefaultAccountsService::new(
+    let accounts = initialize_accounts(
        store.accounts(),
        store.account_runtime(),
+        store.settings(),
+        timezone,
        registry.clone(),
        snapshot.clone(),
        probe.clone(),
-    ));
+    );
    let backup_ports = store.backup();
    let backups = Arc::new(DefaultBackupService::new(
        backup_ports.repository(),
@@ -434,11 +449,14 @@ async fn initialize_inner(
        plugin_inspector.clone(),
    ));
    let system = Arc::new(DefaultSystemService::new(system, system_preflight));
+    let observations: Arc<dyn ports::store::ObservabilityStore> = Arc::new(
+        use_case::observability::CachedObservabilityStore::new(store.observability()),
+    );
    let key_usage = Arc::new(use_case::key_usage::DefaultKeyUsageService::new(
        auth.clone(),
        client_key_verifier,
        store.client_keys(),
-        store.observability(),
+        observations.clone(),
        system.clone(),
        timezone,
    ));
@@ -459,8 +477,11 @@ async fn initialize_inner(
        registry.clone(),
        pricing_source,
    );
-    let mut public_services = service::Registry::new(service_middleware);
+    let usage_data = initialize_usage_data(store.usage_data(), store.settings(), registry.clone());
+    let mut public_services = public_service::Registry::new(service_middleware);
    public_services.register_settings(&settings)?;
+    public_services.register_accounts(&accounts)?;
+    public_services.register_usage_data(&usage_data)?;
    let services = AdminServices {
        timezone,
        public_services: Arc::new(public_services),
@@ -499,16 +520,18 @@ async fn initialize_inner(
        )),
        client_distribution: Arc::new(DefaultClientDistributionService::new(client_distribution)),
        observability: Arc::new(DefaultObservabilityService::new(
-            store.observability(),
+            observations.clone(),
            store.accounts(),
            store.settings(),
            registry.clone(),
            timezone,
+            system.clone(),
        )),
        settings,
+        usage_data,
        system,
        credentials,
-        plugin_accounts,
+        _plugin_accounts: plugin_accounts,
        import_tasks,
        backups,
    };
@@ -534,6 +557,33 @@ async fn initialize_inner(
    .map_err(|_| AdminError::internal("导入 Worker 注册信息不合法"))?;
    worker_contributions.push(WorkerContribution::Registration(registration));
    worker_contributions.extend(freeze_recovery_worker_contribution(freeze_recovery)?);
+    let id = WorkerId::try_new(WorkerKind::ResetCreditAutomation, "admin")
+        .map_err(|_| AdminError::internal("重置卡 Worker ID 不合法"))?;
+    let schedule = WorkerSchedule::try_new(
+        Duration::from_secs(5),
+        Duration::from_secs(5),
+        Duration::from_secs(60),
+        Duration::from_secs(90),
+        Duration::from_secs(30),
+    )
+    .map_err(|_| AdminError::internal("重置卡 Worker 调度配置不合法"))?;
+    let lease = WorkerLeaseRequest::try_new(id.clone(), Duration::from_secs(90))
+        .map_err(|_| AdminError::internal("重置卡 Worker 租约配置不合法"))?;
+    worker_contributions.push(WorkerContribution::Registration(
+        WorkerRegistration::try_new(
+            id,
+            WorkerRunnable::Scheduled {
+                schedule,
+                lease: Some(lease),
+                task: Box::new(reset_credit_automation::ResetCreditAutomationTask {
+                    accounts,
+                    store: store.accounts(),
+                    settings: store.settings(),
+                }),
+            },
+        )
+        .map_err(|_| AdminError::internal("重置卡 Worker 注册失败"))?,
+    ));
    Ok(AdminBundle {
        services,
        worker_contributions,
@@ -622,6 +672,28 @@ fn freeze_recovery_worker_contribution(
    Ok(vec![WorkerContribution::Registration(registration)])
 }

+/// 服务端与 CLI 复用账号用例，不随命令启动后台调度
+#[must_use]
+pub fn initialize_accounts(
+    accounts: Arc<dyn ports::store::AccountStore>,
+    account_runtime: Arc<dyn ports::store::AccountRuntimeStore>,
+    settings: Arc<dyn ports::store::SettingsStore>,
+    timezone: gateway_core::time::DeploymentTimeZone,
+    providers: ProviderAdminRegistry,
+    snapshot: Arc<dyn SnapshotControl>,
+    probe: Arc<dyn AccountProbe>,
+) -> Arc<dyn AccountsService> {
+    Arc::new(DefaultAccountsService::new(
+        accounts,
+        account_runtime,
+        settings,
+        timezone,
+        providers,
+        snapshot,
+        probe,
+    ))
+}
+
 /// 设置服务不依赖 Web 管理会话，CLI 与服务器通过同一用例执行事务和发布
 pub fn initialize_settings(
    store: Arc<dyn ports::store::SettingsStore>,
@@ -636,3 +708,15 @@ pub fn initialize_settings(
        pricing_source,
    ))
 }
+
+/// HTTP、插件及 CLI 共用的用量领域用例，宿主提供已验证的调用主体
+#[must_use]
+pub fn initialize_usage_data(
+    store: Arc<dyn ports::usage_data::UsageDataStore>,
+    settings: Arc<dyn ports::store::SettingsStore>,
+    providers: ProviderAdminRegistry,
+) -> Arc<dyn UsageDataService> {
+    Arc::new(use_case::usage_data::DefaultUsageDataService::new(
+        store, settings, providers,
+    ))
+}
@@ -10,6 +10,23 @@ use gateway_core::{

 use super::{PageSize, Revision, observability::DecimalAmount};

+/// 名称与描述的共同约束，HTTP、用例和存储边界只映射错误
+pub fn validate_group_fields(
+    name: &str,
+    description: Option<&str>,
+) -> Result<(), super::AdminModelError> {
+    if name.trim() != name
+        || name.is_empty()
+        || name.chars().count() > 100
+        || name.chars().any(char::is_control)
+        || description
+            .is_some_and(|value| value.len() > 4096 || value.chars().any(char::is_control))
+    {
+        return Err(super::AdminModelError::InvalidAccountGroupFields);
+    }
+    Ok(())
+}
+
 /// 账号分组持久化使用的标准 `#RRGGBBAA` 颜色
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct AccountGroupColor(String);
@@ -49,7 +66,7 @@ pub struct AccountGroupCapacity {
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct AccountGroupUsage {
    pub today_usd: DecimalAmount,
-    /// 当前 usage retention 窗口内、按请求发生时 routing group 快照归属的累计成本
+    /// 当前 usage retention 窗口内、当前组成员实际完成请求的累计成本
    pub retained_total_usd: DecimalAmount,
 }

@@ -83,6 +100,7 @@ pub struct AccountGroupListQuery {
 /// 完整账号分组摘要
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct AccountGroupRecord {
+    pub allow_image_generation: bool,
    pub fast_mode: FastMode,
    pub id: AccountGroupId,
    pub name: String,
@@ -109,9 +127,20 @@ pub struct AccountGroupPage {
    pub page_size: u16,
 }

+/// 分组选择器使用的轻量分页结果
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct AccountGroupOptionsPage {
+    pub config_revision: Revision,
+    pub items: Vec<AccountGroupRef>,
+    pub total: u64,
+    pub page: u32,
+    pub page_size: u16,
+}
+
 /// 创建账号分组
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct CreateAccountGroup {
+    pub allow_image_generation: bool,
    pub fast_mode: FastMode,
    pub name: String,
    pub description: Option<String>,
@@ -121,6 +150,7 @@ pub struct CreateAccountGroup {
 /// 已生成稳定标识、可直接提交存储的创建命令
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct NewAccountGroup {
+    pub allow_image_generation: bool,
    pub fast_mode: FastMode,
    pub id: AccountGroupId,
    pub name: String,
@@ -131,6 +161,7 @@ pub struct NewAccountGroup {
 /// 更新账号分组的描述字段
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct UpdateAccountGroup {
+    pub allow_image_generation: Option<bool>,
    pub fast_mode: Option<FastMode>,
    pub id: AccountGroupId,
    pub name: String,
@@ -124,6 +124,7 @@ pub struct AccountRecord {
    pub weight: AccountWeight,
    pub model_access: gateway_core::account::AccountModelAccess,
    pub outbound_proxy: Option<gateway_core::account::OutboundProxy>,
+    pub outbound_proxy_enabled: bool,
    pub credential_state: CredentialState,
    pub credential_observed_at: DateTime<Utc>,
    pub quota: QuotaState,
@@ -133,40 +134,20 @@ pub struct AccountRecord {
    pub updated_at: DateTime<Utc>,
 }

-/// 单一货币的账号成本聚合
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub struct AccountCost {
-    pub currency: String,
-    pub amount: super::observability::DecimalAmount,
+impl AccountRecord {
+    /// 配置保留绑定，执行请求时禁用代理按直连处理
+    #[must_use]
+    pub fn effective_outbound_proxy(&self) -> Option<&gateway_core::account::OutboundProxy> {
+        self.outbound_proxy
+            .as_ref()
+            .filter(|_| self.outbound_proxy_enabled)
+    }
 }

-/// 账号在一个模型上的历史用量
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub struct AccountModelUsage {
-    pub model: String,
-    pub request_count: u64,
-    pub success_count: u64,
-    pub input_tokens: Option<u64>,
-    pub output_tokens: Option<u64>,
-    pub cached_tokens: Option<u64>,
-    pub cache_write_tokens: Option<u64>,
-    pub reasoning_tokens: Option<u64>,
-    pub image_input_tokens: Option<u64>,
-    pub image_output_tokens: Option<u64>,
-    pub image_request_count: u64,
-    pub image_request_failed_count: u64,
-    pub total_tokens: Option<u64>,
-    pub cost_coverage: super::observability::CostCoverage,
-    pub costs: Vec<AccountCost>,
-    pub last_used_at: DateTime<Utc>,
-}
-
-/// 账号在一个小时窗口内的请求数
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub struct AccountRequestBucket {
-    pub bucket_start: DateTime<Utc>,
-    pub request_count: u64,
-}
+pub use super::observability::{
+    AccountModelUsage, AccountPoolMetrics as AccountSummary, AccountRequestBucket,
+    CurrencyCost as AccountCost,
+};

 /// 账号历史用量聚合
 #[derive(Debug, Clone, PartialEq, Eq)]
@@ -176,9 +157,9 @@ pub struct AccountUsage {
    pub success_count: u64,
    pub input_tokens: Option<u64>,
    pub output_tokens: Option<u64>,
-    pub cached_tokens: Option<u64>,
-    pub cache_write_tokens: Option<u64>,
-    pub reasoning_tokens: Option<u64>,
+    pub cached_input_tokens: Option<u64>,
+    pub cache_write_input_tokens: Option<u64>,
+    pub reasoning_output_tokens: Option<u64>,
    pub image_input_tokens: Option<u64>,
    pub image_output_tokens: Option<u64>,
    pub image_request_count: u64,
@@ -235,19 +216,6 @@ pub struct AccountCapacity {
    pub total_slots: Option<u64>,
 }

-/// 统一账号目录的全局状态计数，不受当前筛选和分页影响
-///
-/// 计数与 [`AccountStatus`] 一一对应，由 store 按派生状态聚合
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub struct AccountSummary {
-    pub total: u64,
-    pub normal: u64,
-    pub quota_exhausted: u64,
-    pub rate_limited: u64,
-    pub disabled: u64,
-    pub error: u64,
-}
-
 /// 账号可编辑事实的一次性替换命令
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct UpdateAccount {
@@ -326,3 +294,24 @@ pub enum AccountConnectionTestEvent {
 /// 每次连接测试独占的有限事件流
 pub type AccountConnectionTestEventStream =
    Pin<Box<dyn Stream<Item = AccountConnectionTestEvent> + Send + 'static>>;
+
+/// 单个账号普通并发池的实时租约明细，不关联请求历史
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct AccountConcurrencyEntry {
+    pub lease_id: String,
+    pub request_id: Option<String>,
+    pub client_key_id: Option<String>,
+    pub client_key_name: Option<String>,
+    pub model: Option<String>,
+    pub client_ip: Option<String>,
+    pub started_at: Option<DateTime<Utc>>,
+    pub acquired_at: Option<DateTime<Utc>>,
+}
+
+/// 同一次 Redis 读取中的当前占用数和分页明细
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct AccountConcurrencyPage {
+    pub entries: Vec<AccountConcurrencyEntry>,
+    pub total: u64,
+    pub observed_at: DateTime<Utc>,
+}
@@ -0,0 +1,65 @@
+//! 统计投影的新鲜度、覆盖范围与预计算费用合同
+
+use chrono::{DateTime, Utc};
+
+use super::observability::{DecimalAmount, RequestMetricPoint, UsageOverview};
+
+/// 数据可见性状态，不以缺失投影冒充零统计
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
+pub enum AnalyticsState {
+    Ready,
+    #[default]
+    Building,
+    Lagging,
+    Stale,
+}
+
+impl AnalyticsState {
+    #[must_use]
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::Ready => "ready",
+            Self::Building => "building",
+            Self::Lagging => "lagging",
+            Self::Stale => "stale",
+        }
+    }
+}
+
+/// 与统计结果在同一读取快照内取得的覆盖和版本事实
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub struct AnalyticsMetadata {
+    pub coverage_start: Option<DateTime<Utc>>,
+    pub coverage_end: Option<DateTime<Utc>>,
+    pub generated_at: DateTime<Utc>,
+    pub lag_seconds: u64,
+    pub state: AnalyticsState,
+    pub percentiles_approximate: bool,
+    pub schema_version: u32,
+    pub histogram_version: u32,
+    /// 派生数据版本供缓存判断失效，不作为源事务提交顺序
+    pub generation: u64,
+}
+
+/// 单次请求经 Provider 费用合同确认后可累加的 USD 情景金额
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub struct UsageBillingProjection {
+    pub standard_amount: Option<DecimalAmount>,
+    pub no_cache_amount: Option<DecimalAmount>,
+}
+
+/// 时间桶内的情景费用，未知金额不改写为零
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct UsageProjectedCostPoint {
+    pub bucket_start: DateTime<Utc>,
+    pub standard_amount: Option<DecimalAmount>,
+    pub no_cache_amount: Option<DecimalAmount>,
+}
+
+/// 同一数据库快照内的完整洞察输入
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct UsageInsightsObservation {
+    pub overview: UsageOverview,
+    pub trend: Vec<RequestMetricPoint>,
+    pub costs: Vec<UsageProjectedCostPoint>,
+}
@@ -76,18 +76,23 @@ impl std::fmt::Debug for LoginCommand {
    }
 }

-/// 登录成功后返回的会话事实
+/// 登录或刷新后仅向当前浏览器交付的会话凭据
 #[derive(Clone, PartialEq, Eq)]
-pub struct LoginResult {
+pub struct SessionGrant {
    pub session_id: String,
+    pub refresh_token: Option<String>,
    pub session: AuthSession,
 }

-impl std::fmt::Debug for LoginResult {
+impl std::fmt::Debug for SessionGrant {
    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        formatter
-            .debug_struct("LoginResult")
+            .debug_struct("SessionGrant")
            .field("session_id", &"[REDACTED]")
+            .field(
+                "refresh_token",
+                &self.refresh_token.as_ref().map(|_| "[REDACTED]"),
+            )
            .field("session", &self.session)
            .finish()
    }
@@ -138,11 +143,41 @@ impl std::fmt::Debug for ChangePassword {
    }
 }

-/// 两种登录方式共用的固定有效期会话
+/// 访问有效期与逻辑会话；没有续期凭据的会话保持固定期限
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct AuthSession {
    pub subject: SessionSubject,
    pub expires_at: DateTime<Utc>,
+    pub absolute_expires_at: Option<DateTime<Utc>>,
+    pub renewal: Option<SessionRenewal>,
+}
+
+/// 长效登录的凭据摘要与续期窗口；访问到期不删除整段登录
+#[derive(Debug, Clone, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct SessionRenewal {
+    pub expires_at: DateTime<Utc>,
+    pub access_digest: [u8; 32],
+    pub refresh_digest: [u8; 32],
+    pub previous: Option<SessionRefreshReplay>,
+}
+
+/// 仅保存上一代摘要及派生盐；响应丢失时须持有上一代凭据才能重建同一响应
+#[derive(Debug, Clone, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct SessionRefreshReplay {
+    pub digest: [u8; 32],
+    pub salt: [u8; 32],
+    pub expires_at: DateTime<Utc>,
+}
+
+impl AuthSession {
+    #[must_use]
+    pub fn retained_until(&self) -> DateTime<Utc> {
+        self.renewal
+            .as_ref()
+            .map_or(self.expires_at, |renewal| renewal.expires_at)
+    }
 }

 /// 安全审计事件类型
@@ -474,6 +474,26 @@ impl BackupError {
    pub fn message(&self) -> &str {
        &self.message
    }
+
+    /// 清理失败附加到原始终态，不覆盖上传失败或主动取消的分类
+    #[must_use]
+    pub fn with_cleanup_failure(
+        mut self,
+        stage: &'static str,
+        error: &Self,
+        retry_on_expiration: bool,
+    ) -> Self {
+        let recovery = if retry_on_expiration {
+            "等待备份到期清理"
+        } else {
+            "未安排自动重试"
+        };
+        self.message.push_str(&format!(
+            "；清理阶段 {stage} 失败（{}），{recovery}",
+            error.code()
+        ));
+        self
+    }
 }

 /// 构造稳定错误码常量
@@ -20,6 +20,20 @@ pub type ProviderRequestProfileOverrides =
 pub type ProviderRequestProfileOverrideUpdates =
    BTreeMap<ProviderKind, Option<gateway_core::account::OpaqueProviderData>>;

+/// Client Key 关联分组的数量与唯一性约束
+pub fn validate_group_ids(group_ids: &[AccountGroupId]) -> Result<(), AdminModelError> {
+    if group_ids.len() > 1000
+        || group_ids
+            .iter()
+            .collect::<std::collections::BTreeSet<_>>()
+            .len()
+            != group_ids.len()
+    {
+        return Err(AdminModelError::InvalidClientKeyGroups);
+    }
+    Ok(())
+}
+
 /// Client Key 列表保持旧 HTTP 合同允许的完整非零 `u16` 页大小
 #[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash)]
 pub struct ClientKeyPageSize(NonZeroU16);
@@ -0,0 +1,44 @@
+//! 故障诊断导出的目标、已采集证据与缺口
+
+use chrono::{DateTime, Utc};
+
+use super::{
+    observability::{OpsError, UsageDetail},
+    system::SystemVersion,
+};
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum DiagnosticTarget {
+    Request(String),
+    Operation(String),
+}
+
+impl DiagnosticTarget {
+    #[must_use]
+    pub fn id(&self) -> &str {
+        match self {
+            Self::Request(id) | Self::Operation(id) => id,
+        }
+    }
+}
+
+pub struct DiagnosticGap {
+    pub section: String,
+    pub reason: &'static str,
+}
+
+pub struct DiagnosticRequest {
+    pub request_id: String,
+    pub detail: Option<UsageDetail>,
+    pub errors: Vec<OpsError>,
+}
+
+/// 原始受控详情只能经导出投影脱敏后交付，不参与普通日志或 Debug
+pub struct DiagnosticBundle {
+    pub target: DiagnosticTarget,
+    pub collected_at: DateTime<Utc>,
+    pub environment: Option<SystemVersion>,
+    pub error: Option<OpsError>,
+    pub requests: Vec<DiagnosticRequest>,
+    pub gaps: Vec<DiagnosticGap>,
+}
@@ -1,10 +1,10 @@
 //! 单页 Key 用量的查询合同；身份范围不由调用方提供

 use super::{
-    PageSize,
    client_keys::ClientKeyRecord,
    observability::{
-        HealthTimeline, OpsErrorPage, RequestMetricPoint, TimeRange, UsageOverview, UsagePage,
+        HealthTimeline, ObservabilityPageSize, OpsErrorPage, RequestMetricPoint, TimeRange,
+        UsageOverview, UsagePage,
    },
 };

@@ -25,7 +25,7 @@ pub struct KeyUsageRecordsQuery {
    pub usage: KeyUsageQuery,
    pub kind: KeyUsageRecordKind,
    pub current_page: u32,
-    pub page_size: PageSize,
+    pub page_size: ObservabilityPageSize,
 }

 pub struct KeyUsageOverview {
@@ -4,11 +4,13 @@ use std::num::{NonZeroU16, NonZeroU64};

 pub mod account_groups;
 pub mod accounts;
+pub mod analytics;
 pub mod audit;
 pub mod auth;
 pub mod backup;
 pub mod client_distribution;
 pub mod client_keys;
+pub mod diagnostics;
 pub mod import_tasks;
 pub mod key_usage;
 pub mod observability;
@@ -20,9 +22,11 @@ pub mod provider_credentials;
 pub mod proxies;
 pub mod quota_forecast;
 pub mod quota_forecast_sampling;
+pub mod reset_credit_automation;
 pub mod retention;
 pub mod settings;
 pub mod system;
+pub mod usage_data;

 /// 管理用例对外返回的稳定错误分类
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
@@ -39,12 +43,31 @@ pub enum AdminErrorKind {
    Internal,
 }

-/// 不携带基础设施细节、可安全返回给管理员的管理用例错误
-#[derive(Debug, Clone, PartialEq, Eq, thiserror::Error)]
+impl AdminErrorKind {
+    #[must_use]
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::Invalid => "invalid",
+            Self::Forbidden => "forbidden",
+            Self::Unauthorized => "unauthorized",
+            Self::NotFound => "not_found",
+            Self::Conflict => "conflict",
+            Self::RateLimited => "rate_limited",
+            Self::BadGateway => "bad_gateway",
+            Self::UpstreamResultUnknown => "upstream_result_unknown",
+            Self::Unavailable => "unavailable",
+            Self::Internal => "internal",
+        }
+    }
+}
+
+/// 管理用例的安全消息与内部原因分离，原始来源不进入响应
+#[derive(Debug, Clone, thiserror::Error)]
 #[error("{message}")]
 pub struct AdminError {
    kind: AdminErrorKind,
    message: String,
+    source: Option<gateway_core::error::ErrorSource>,
 }

 impl AdminError {
@@ -53,9 +76,21 @@ impl AdminError {
        Self {
            kind,
            message: message.into(),
+            source: None,
        }
    }

+    #[must_use]
+    pub fn with_source(mut self, source: impl Into<gateway_core::error::ErrorSource>) -> Self {
+        self.source = Some(source.into());
+        self
+    }
+
+    #[must_use]
+    pub fn error_details(&self) -> Option<gateway_core::error::ErrorDetails> {
+        gateway_core::error::ErrorDetails::capture(self.source.as_ref(), None, false)
+    }
+
    #[must_use]
    pub const fn kind(&self) -> AdminErrorKind {
        self.kind
@@ -184,6 +219,12 @@ pub enum AdminModelError {
    ZeroRevision,
    #[error("page size {0} is outside 1..=200")]
    InvalidPageSize(u16),
+    #[error("observability page size {0} is outside 1..=100")]
+    InvalidObservabilityPageSize(u16),
+    #[error("account group name or description is invalid")]
+    InvalidAccountGroupFields,
+    #[error("client key group IDs are duplicated or exceed 1000 entries")]
+    InvalidClientKeyGroups,
    #[error("client key page size must be inside 1..=65535")]
    InvalidClientKeyPageSize,
    #[error("request outcome must be 1..=256 bytes without control characters")]
@@ -1,10 +1,36 @@
 //! 用量、成本、健康与错误诊断的 UTC 语义事实

-use std::str::FromStr;
+use std::{num::NonZeroU16, str::FromStr};

 use chrono::{DateTime, TimeDelta, Utc};

-use super::{AdminModelError, PageSize};
+use super::AdminModelError;
+pub use super::analytics::{
+    AnalyticsMetadata, AnalyticsState, UsageBillingProjection, UsageInsightsObservation,
+    UsageProjectedCostPoint,
+};
+
+/// 观测记录查询的页大小，由 HTTP、管理用例和存储端口共同使用
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct ObservabilityPageSize(NonZeroU16);
+
+impl ObservabilityPageSize {
+    pub const MAX: u16 = 100;
+
+    pub fn new(value: u16) -> Result<Self, AdminModelError> {
+        if value > Self::MAX {
+            return Err(AdminModelError::InvalidObservabilityPageSize(value));
+        }
+        NonZeroU16::new(value)
+            .map(Self)
+            .ok_or(AdminModelError::InvalidObservabilityPageSize(value))
+    }
+
+    #[must_use]
+    pub const fn get(self) -> u16 {
+        self.0.get()
+    }
+}

 /// 页面筛选表达自然日范围，具体 UTC 边界由部署时区解析
 #[derive(Debug, Clone, Copy)]
@@ -26,7 +52,7 @@ impl CalendarPeriod {
 }

 /// 外部观测查询的 UTC 时间范围
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
 pub struct TimeRange {
    pub start: DateTime<Utc>,
    pub end: DateTime<Utc>,
@@ -67,7 +93,7 @@ impl TimeRange {
 }

 /// 请求结果状态
-#[derive(Debug, Clone, PartialEq, Eq)]
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
 pub enum RequestOutcome {
    Running,
    Succeeded,
@@ -78,7 +104,7 @@ pub enum RequestOutcome {
 }

 /// 未知但有界的请求结果值；私有字段禁止绕过 [`RequestOutcome::new`] 构造
-#[derive(Debug, Clone, PartialEq, Eq)]
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
 pub struct OtherRequestOutcome(String);

 impl RequestOutcome {
@@ -129,7 +155,7 @@ impl OtherRequestOutcome {
 }

 /// 用量记录过滤条件
-#[derive(Debug, Clone, Default, PartialEq, Eq)]
+#[derive(Debug, Clone, Default, PartialEq, Eq, Hash)]
 pub struct UsageFilter {
    pub client_api_key_ref: Option<String>,
    pub request_id: Option<String>,
@@ -146,13 +172,49 @@ pub struct UsageFilter {
    pub search: Option<String>,
 }

+/// 请求列表的结果筛选，不改变汇总和计量口径
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
+pub enum UsageRecordStatus {
+    #[default]
+    Success,
+    Error,
+    All,
+}
+
 /// 用量记录分页查询
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct UsageQuery {
+    pub status: UsageRecordStatus,
    pub range: TimeRange,
    pub filter: UsageFilter,
    pub current_page: u32,
-    pub page_size: PageSize,
+    pub page_size: ObservabilityPageSize,
+}
+
+/// Admin 确定概览的数量、趋势粒度及最近请求筛选，Store 只执行该选择
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
+pub struct DashboardQuery {
+    pub range: TimeRange,
+    pub granularity: Granularity,
+    pub account_limit: u16,
+    pub recent_request_limit: u16,
+    pub recent_request_filter: UsageFilter,
+}
+
+impl DashboardQuery {
+    #[must_use]
+    pub fn new(range: TimeRange) -> Self {
+        Self {
+            range,
+            granularity: Granularity::for_range(range),
+            account_limit: 4,
+            recent_request_limit: 10,
+            recent_request_filter: UsageFilter {
+                outcome: Some(RequestOutcome::Succeeded),
+                ..UsageFilter::default()
+            },
+        }
+    }
 }

 /// 运维错误过滤条件
@@ -178,11 +240,11 @@ pub struct OpsErrorQuery {
    pub range: TimeRange,
    pub filter: OpsErrorFilter,
    pub current_page: u32,
-    pub page_size: PageSize,
+    pub page_size: ObservabilityPageSize,
 }

 /// 用量诊断维度
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
 pub enum DiagnosticDimension {
    Provider,
    Model,
@@ -220,7 +282,7 @@ impl DecimalAmount {
    }

    fn from_decimal(value: gateway_core::metering::Decimal) -> Option<Self> {
-        Some(Self(value.canonical()))
+        Self::from_str(&value.canonical()).ok()
    }
 }

@@ -315,8 +377,8 @@ pub struct ProviderBillingInput {
    pub service_tier: Option<String>,
    pub input_tokens: Option<u64>,
    pub output_tokens: Option<u64>,
-    pub cached_tokens: Option<u64>,
-    pub cache_write_tokens: Option<u64>,
+    pub cached_input_tokens: Option<u64>,
+    pub cache_write_input_tokens: Option<u64>,
    pub total: CurrencyCost,
 }

@@ -332,8 +394,8 @@ pub struct UsageCalculatedBillingFact {
    pub service_tier: Option<String>,
    pub input_tokens: Option<u64>,
    pub output_tokens: Option<u64>,
-    pub cached_tokens: Option<u64>,
-    pub cache_write_tokens: Option<u64>,
+    pub cached_input_tokens: Option<u64>,
+    pub cache_write_input_tokens: Option<u64>,
    pub total: CurrencyCost,
 }

@@ -360,7 +422,7 @@ pub struct CalculatedBillingBreakdown {
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct ImageBillingBreakdown {
    pub input_tokens: u64,
-    pub cached_tokens: u64,
+    pub cached_input_tokens: u64,
    pub input_amount: CurrencyCost,
    pub cache_read_amount: CurrencyCost,
    pub input_price_per_million: CurrencyCost,
@@ -406,9 +468,9 @@ pub struct RequestMetrics {
    pub caller_error_count: u64,
    pub input_tokens: u64,
    pub output_tokens: u64,
-    pub cached_tokens: u64,
-    pub cache_write_tokens: u64,
-    pub reasoning_tokens: u64,
+    pub cached_input_tokens: u64,
+    pub cache_write_input_tokens: u64,
+    pub reasoning_output_tokens: u64,
    pub total_tokens: u64,
    pub first_token_latency_sum_ms: u64,
    pub first_token_latency_count: u64,
@@ -448,13 +510,37 @@ pub struct AttemptMetrics {
 }

 /// 时间序列粒度
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
 pub enum Granularity {
    FifteenMinutes,
    Hour,
    Day,
 }

+impl Granularity {
+    /// 管理趋势按范围选择粒度，费用校验与请求指标必须使用同一策略
+    #[must_use]
+    pub fn for_range(range: TimeRange) -> Self {
+        let seconds = range.end.signed_duration_since(range.start).num_seconds();
+        if seconds <= 2 * 24 * 60 * 60 {
+            Self::FifteenMinutes
+        } else if seconds <= 31 * 24 * 60 * 60 {
+            Self::Hour
+        } else {
+            Self::Day
+        }
+    }
+
+    #[must_use]
+    pub const fn seconds(self) -> i64 {
+        match self {
+            Self::FifteenMinutes => 15 * 60,
+            Self::Hour => 60 * 60,
+            Self::Day => 24 * 60 * 60,
+        }
+    }
+}
+
 /// 一段时间桶内的请求指标
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct RequestMetricPoint {
@@ -466,7 +552,7 @@ pub struct RequestMetricPoint {
 }

 /// 账号池的统一五态统计
-#[derive(Debug, Clone, Default, PartialEq, Eq)]
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
 pub struct AccountPoolMetrics {
    pub total: u64,
    pub normal: u64,
@@ -476,17 +562,17 @@ pub struct AccountPoolMetrics {
    pub error: u64,
 }

-/// Dashboard 中一个账号的模型级用量事实
+/// 账号在查询时间范围内的模型级用量事实
 #[derive(Debug, Clone, PartialEq, Eq)]
-pub struct DashboardAccountModelUsage {
+pub struct AccountModelUsage {
    pub model: String,
    pub request_count: u64,
    pub success_count: u64,
    pub input_tokens: Option<u64>,
    pub output_tokens: Option<u64>,
-    pub cached_tokens: Option<u64>,
-    pub cache_write_tokens: Option<u64>,
-    pub reasoning_tokens: Option<u64>,
+    pub cached_input_tokens: Option<u64>,
+    pub cache_write_input_tokens: Option<u64>,
+    pub reasoning_output_tokens: Option<u64>,
    pub image_input_tokens: Option<u64>,
    pub image_output_tokens: Option<u64>,
    pub image_request_count: u64,
@@ -497,9 +583,9 @@ pub struct DashboardAccountModelUsage {
    pub last_used_at: DateTime<Utc>,
 }

-/// Dashboard 中账号的单小时请求数
+/// 账号在单小时窗口内的请求数
 #[derive(Debug, Clone, PartialEq, Eq)]
-pub struct DashboardAccountRequestBucket {
+pub struct AccountRequestBucket {
    pub bucket_start: DateTime<Utc>,
    pub request_count: u64,
 }
@@ -519,9 +605,9 @@ pub struct DashboardAccountUsage {
    pub success_count: u64,
    pub input_tokens: Option<u64>,
    pub output_tokens: Option<u64>,
-    pub cached_tokens: Option<u64>,
-    pub cache_write_tokens: Option<u64>,
-    pub reasoning_tokens: Option<u64>,
+    pub cached_input_tokens: Option<u64>,
+    pub cache_write_input_tokens: Option<u64>,
+    pub reasoning_output_tokens: Option<u64>,
    pub image_input_tokens: Option<u64>,
    pub image_output_tokens: Option<u64>,
    pub image_request_count: u64,
@@ -530,14 +616,14 @@ pub struct DashboardAccountUsage {
    pub cost_coverage: CostCoverage,
    pub costs: Vec<CurrencyCost>,
    pub last_used_at: Option<DateTime<Utc>>,
-    pub request_buckets: Vec<DashboardAccountRequestBucket>,
+    pub request_buckets: Vec<AccountRequestBucket>,
    /// Provider 已持久化额度窗口投影出的代表性已用比例
    ///
    /// `None` 表示上游未提供可比较的百分比，不应伪造为零
    pub quota_used_percent: Option<f64>,
    /// Provider 返回的代表窗口；缺失时保留未知语义
    pub quota_window: Option<super::provider_credentials::ProviderQuotaWindow>,
-    pub models: Vec<DashboardAccountModelUsage>,
+    pub models: Vec<AccountModelUsage>,
 }

 /// Dashboard 当前账号池的可重建运行时槽位事实
@@ -552,11 +638,11 @@ pub struct DashboardRuntimeSlots {
 }

 /// 仪表盘卡片脚注展示的全历史累计
-#[derive(Debug, Clone, Default, PartialEq)]
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
 pub struct DashboardTotals {
    pub request_count: u64,
    pub input_tokens: u64,
-    pub cached_tokens: u64,
+    pub cached_input_tokens: u64,
    pub total_tokens: u64,
    pub billing_usd: Option<DecimalAmount>,
 }
@@ -564,17 +650,20 @@ pub struct DashboardTotals {
 /// 仪表盘所需的当前区间事实及全历史累计
 #[derive(Debug, Clone, PartialEq)]
 pub struct DashboardObservation {
+    pub analytics: AnalyticsMetadata,
    pub range: TimeRange,
    pub totals: DashboardTotals,
    pub provider_accounts: AccountPoolMetrics,
+    pub runtime_slots: Option<DashboardRuntimeSlots>,
    pub trend: Vec<RequestMetricPoint>,
    pub account_usage: Vec<DashboardAccountUsage>,
    pub recent_requests: Vec<UsageListRecord>,
 }

 /// 使用记录表格的窄读模型
-#[derive(Debug, Clone, PartialEq, Eq)]
+#[derive(Debug, Clone, PartialEq)]
 pub struct UsageListRecord {
+    pub outcome: RequestOutcome,
    pub client_api_key_name: Option<String>,
    pub id: String,
    pub endpoint: String,
@@ -584,9 +673,9 @@ pub struct UsageListRecord {
    pub provider_account_ref: Option<String>,
    pub provider_account_name: Option<String>,
    pub provider_account_email: Option<String>,
-    /// 账号当前备注，按内部账号 ID 关联，不属于请求历史快照
+    /// 请求选号时冻结的账号备注，未采集时保持未知
    pub provider_account_notes: Option<String>,
-    /// 账号当前套餐，不属于请求历史快照
+    /// 请求选号时冻结的账号套餐
    pub provider_account_plan_type: Option<String>,
    pub provider_account_plan_type_display: Option<String>,
    pub provider_account_authentication_kind: Option<String>,
@@ -596,9 +685,9 @@ pub struct UsageListRecord {
    pub service_tier: Option<String>,
    pub input_tokens: Option<u64>,
    pub output_tokens: Option<u64>,
-    pub cached_tokens: Option<u64>,
-    pub cache_write_tokens: Option<u64>,
-    pub reasoning_tokens: Option<u64>,
+    pub cached_input_tokens: Option<u64>,
+    pub cache_write_input_tokens: Option<u64>,
+    pub reasoning_output_tokens: Option<u64>,
    pub image_input_tokens: Option<u64>,
    pub image_output_tokens: Option<u64>,
    pub total_tokens: Option<u64>,
@@ -614,6 +703,13 @@ pub struct UsageListRecord {
    pub first_text_ms: Option<u64>,
    pub first_token_ms: Option<u64>,
    pub provider_processing_ms: Option<u64>,
+    pub upstream_response_ms: Option<u64>,
+    pub upstream_api_overhead_ms: Option<f64>,
+    pub upstream_engine_ms: Option<f64>,
+    pub upstream_engine_iapi_ttft_ms: Option<f64>,
+    pub upstream_engine_service_ttft_ms: Option<f64>,
+    pub upstream_engine_iapi_tbt_ms: Option<f64>,
+    pub upstream_engine_service_tbt_ms: Option<f64>,
    pub latency_ms: Option<u64>,
    pub admission_decision_ms: Option<u64>,
    pub account_selection_wait_ms: Option<u64>,
@@ -629,7 +725,7 @@ pub struct UsageListRecord {
 }

 /// 一次完整模型请求的公共观测记录
-#[derive(Debug, Clone, PartialEq, Eq)]
+#[derive(Debug, Clone, PartialEq)]
 pub struct UsageRecord {
    pub id: String,
    pub client_api_key_ref: String,
@@ -670,9 +766,9 @@ pub struct UsageRecord {
    pub retry_after_ms: Option<u64>,
    pub input_tokens: Option<u64>,
    pub output_tokens: Option<u64>,
-    pub cached_tokens: Option<u64>,
-    pub cache_write_tokens: Option<u64>,
-    pub reasoning_tokens: Option<u64>,
+    pub cached_input_tokens: Option<u64>,
+    pub cache_write_input_tokens: Option<u64>,
+    pub reasoning_output_tokens: Option<u64>,
    pub image_input_tokens: Option<u64>,
    pub image_output_tokens: Option<u64>,
    pub total_tokens: Option<u64>,
@@ -688,6 +784,13 @@ pub struct UsageRecord {
    pub first_text_ms: Option<u64>,
    pub first_token_ms: Option<u64>,
    pub provider_processing_ms: Option<u64>,
+    pub upstream_response_ms: Option<u64>,
+    pub upstream_api_overhead_ms: Option<f64>,
+    pub upstream_engine_ms: Option<f64>,
+    pub upstream_engine_iapi_ttft_ms: Option<f64>,
+    pub upstream_engine_service_ttft_ms: Option<f64>,
+    pub upstream_engine_iapi_tbt_ms: Option<f64>,
+    pub upstream_engine_service_tbt_ms: Option<f64>,
    pub latency_ms: Option<u64>,
    pub admission_decision_ms: Option<u64>,
    pub account_selection_wait_ms: Option<u64>,
@@ -708,7 +811,7 @@ pub struct UsageRecord {
 }

 /// 用量分页结果
-#[derive(Debug, Clone, PartialEq, Eq)]
+#[derive(Debug, Clone, PartialEq)]
 pub struct UsagePage {
    pub items: Vec<UsageListRecord>,
    pub current_page: u32,
@@ -743,9 +846,9 @@ pub struct UsageAttempt {
    pub message: Option<String>,
    pub input_tokens: Option<u64>,
    pub output_tokens: Option<u64>,
-    pub cached_tokens: Option<u64>,
-    pub cache_write_tokens: Option<u64>,
-    pub reasoning_tokens: Option<u64>,
+    pub cached_input_tokens: Option<u64>,
+    pub cache_write_input_tokens: Option<u64>,
+    pub reasoning_output_tokens: Option<u64>,
    pub total_tokens: Option<u64>,
    pub cost_source: Option<String>,
    pub cost_amount: Option<DecimalAmount>,
@@ -753,8 +856,8 @@ pub struct UsageAttempt {
    pub occurred_at: DateTime<Utc>,
 }

-/// 一条请求及其全部尝试
-#[derive(Debug, Clone, PartialEq, Eq)]
+/// 一条请求及其保留的尝试与诊断轨迹
+#[derive(Debug, Clone, PartialEq)]
 pub struct UsageDetail {
    pub trace: Option<serde_json::Value>,
    pub related_requests: Vec<serde_json::Value>,
@@ -775,6 +878,7 @@ pub struct ProviderObservation {
 /// 用量总览
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct UsageOverview {
+    pub analytics: AnalyticsMetadata,
    pub range: TimeRange,
    pub requests: RequestMetrics,
    pub attempts: AttemptMetrics,
@@ -791,6 +895,7 @@ pub struct UsageSummary {
 /// 诊断聚合结果，分母包含截取展示项之前的全部匹配请求
 #[derive(Debug, Clone, Default, PartialEq, Eq)]
 pub struct DiagnosticsObservation {
+    pub analytics: AnalyticsMetadata,
    pub total_request_count: u64,
    pub items: Vec<DiagnosticObservation>,
 }
@@ -851,7 +956,7 @@ pub struct OpsError {
    pub upstream_request_id: Option<String>,
    pub latency_ms: Option<u64>,
    pub message: String,
-    pub raw_upstream_error: Option<String>,
+    pub error_details: Option<String>,
    pub client_ip: Option<String>,
    pub user_agent: Option<String>,
    pub reasoning_effort: Option<String>,
@@ -914,7 +1019,7 @@ pub struct TrendSummary {
    pub request_count: u64,
    pub input_tokens: u64,
    pub output_tokens: u64,
-    pub cached_tokens: u64,
+    pub cached_input_tokens: u64,
    pub total_tokens: u64,
    pub service_failure_count: u64,
    pub average_latency_ms: Option<u64>,
@@ -932,6 +1037,7 @@ pub struct TrendSummary {
 /// 趋势结果；API 再决定图表标签与数字格式
 #[derive(Debug, Clone, PartialEq)]
 pub struct Trend {
+    pub analytics: AnalyticsMetadata,
    pub kind: TrendKind,
    pub points: Vec<TrendPoint>,
    pub summary: TrendSummary,
@@ -1047,7 +1153,7 @@ pub struct DashboardPeriodMetrics {
    pub request_count: u64,
    pub input_tokens: u64,
    pub output_tokens: u64,
-    pub cached_tokens: u64,
+    pub cached_input_tokens: u64,
    pub total_tokens: u64,
    pub cached_token_rate: f64,
    pub observed_cached_token_rate: Option<f64>,
@@ -1137,7 +1243,7 @@ pub struct UsageInsightsCostPoint {
    pub bucket_start: DateTime<Utc>,
    pub input_tokens: u64,
    pub output_tokens: u64,
-    pub cached_tokens: u64,
+    pub cached_input_tokens: u64,
    pub total_tokens: u64,
    pub estimated_cost: Option<DecimalAmount>,
    pub standard_cost: Option<DecimalAmount>,
@@ -1162,7 +1268,7 @@ pub struct UsageInsightsCost {
    pub cache_hit_request_rate: Option<f64>,
    pub input_tokens: u64,
    pub output_tokens: u64,
-    pub cached_tokens: u64,
+    pub cached_input_tokens: u64,
    pub total_tokens: u64,
    pub points: Vec<UsageInsightsCostPoint>,
    pub costs: Vec<CurrencyCost>,
@@ -1172,6 +1278,7 @@ pub struct UsageInsightsCost {
 /// 用量洞察的完整用例结果；API 只负责标签、时区与字符串格式化
 #[derive(Debug, Clone, PartialEq)]
 pub struct UsageInsights {
+    pub analytics: AnalyticsMetadata,
    pub granularity: Granularity,
    pub health: UsageInsightsHealth,
    pub performance: UsageInsightsPerformance,
@@ -1207,6 +1314,7 @@ pub struct DiagnosticsItem {
 /// 诊断结果
 #[derive(Debug, Clone, PartialEq)]
 pub struct DiagnosticsResult {
+    pub analytics: AnalyticsMetadata,
    pub dimension: DiagnosticDimension,
    pub items: Vec<DiagnosticsItem>,
 }
@@ -76,6 +76,7 @@ pub struct PluginManagementResource {

 /// 原始正文可能含业务数据，不能派生内容型 Debug 或写入诊断日志
 pub struct PluginManagementRequest {
+    pub request_context: Option<std::sync::Arc<gateway_core::engine::extensions::RequestContext>>,
    pub method: String,
    pub path: String,
    pub query: String,
@@ -1,6 +1,6 @@
 //! 插件私有状态的归属、代次隔离与迁移数据合同

-use std::{collections::BTreeMap, fmt};
+use std::{collections::BTreeMap, fmt, sync::Arc};

 use serde::{Deserialize, Serialize};

@@ -173,6 +173,8 @@ pub struct PluginStateTransition {
    pub instance_id: String,
    pub artifact_sha256: String,
    pub namespaces: Vec<PluginStateMigrationNamespace>,
+    /// Store 持有的迁移所有权；最后一个调用持有者释放后允许回收遗留 staging
+    pub guard: Arc<dyn Send + Sync>,
 }

 #[derive(Debug, Clone, PartialEq, Eq)]
@@ -862,7 +862,7 @@ pub struct ProviderSubscription {
 }

 /// 按需汇聚的个人信息；资料查询失败不丢弃可用的订阅结果
-#[derive(Debug, Clone, PartialEq)]
+#[derive(Debug, Clone)]
 pub struct AccountPersonalInfo {
    pub profile: Result<ProviderProfileStatistics, AdminError>,
    pub subscription: Option<ProviderSubscription>,
@@ -69,6 +69,7 @@ pub struct ProxyTestResult {

 #[derive(Debug, Clone)]
 pub struct ProxyRecord {
+    pub enabled: bool,
    pub auto_location: bool,
    pub detected_location: Option<DetectedProxyLocation>,
    pub location: Option<gateway_core::account::RequestLocation>,
@@ -103,6 +104,9 @@ pub struct NewProxy {

 #[derive(Debug, Clone)]
 pub struct UpdateProxy {
+    /// 省略保留配置，零值取消限制
+    pub max_websocket_connections: Option<u32>,
+    pub enabled: Option<bool>,
    pub auto_location: Option<bool>,
    pub test: Option<ProxyTestResult>,
    /// 外层为空保留配置，内层为空恢复全局继承
@@ -119,6 +123,21 @@ pub struct ProxyMutation {
    pub record: ProxyRecord,
 }

+pub const MAX_PROXY_BATCH_SIZE: usize = 100;
+
+#[derive(Debug)]
+pub struct TestProxy {
+    pub id: String,
+    pub revision: Revision,
+    pub detect_location: bool,
+}
+
+#[derive(Debug)]
+pub enum ProxyBatchResult<T> {
+    Completed(Result<T, super::AdminError>),
+    Skipped,
+}
+
 /// 检测失败与连通性分开，双栈冲突不得继续应用旧位置
 #[derive(Debug, Clone, Default, PartialEq, Eq, Deserialize, Serialize)]
 #[serde(tag = "status", rename_all = "camelCase")]
@@ -15,7 +15,7 @@ pub struct QuotaForecastUsage {
    pub tokens: u64,
    pub input_tokens: u64,
    pub output_tokens: u64,
-    pub cached_tokens: u64,
+    pub cached_input_tokens: u64,
    pub missing_token_count: u64,
    pub known_cost_count: u64,
    pub unavailable_cost_count: u64,
@@ -35,7 +35,9 @@ impl QuotaForecastUsage {
            tokens: self.tokens.checked_sub(baseline.tokens)?,
            input_tokens: self.input_tokens.checked_sub(baseline.input_tokens)?,
            output_tokens: self.output_tokens.checked_sub(baseline.output_tokens)?,
-            cached_tokens: self.cached_tokens.checked_sub(baseline.cached_tokens)?,
+            cached_input_tokens: self
+                .cached_input_tokens
+                .checked_sub(baseline.cached_input_tokens)?,
            missing_token_count: self
                .missing_token_count
                .checked_sub(baseline.missing_token_count)?,
@@ -140,7 +142,7 @@ pub fn select_forecast_sample(
    };
    history.push(current);
    // 重置边界不在查询起点时，从首个新观测重新计数，避免把旧周期累计带入总量
-    let mut cycle_baseline = interrupted.then(|| &history[0]);
+    let cycle_baseline = interrupted.then(|| &history[0]);
    let mut anchors: Vec<&QuotaForecastPoint> = Vec::new();
    let mut high_water: Option<&QuotaForecastPoint> = None;
    for point in &history {
@@ -153,9 +155,9 @@ pub fn select_forecast_sample(
                if previous.used_percent - point.used_percent <= 1.0 {
                    continue;
                }
+                // 同窗口回落不能证明周期重置，只重建采样并保留已记录累计
                sample.discontinuous = true;
                anchors.clear();
-                cycle_baseline = Some(point);
            }
        }
        high_water = Some(point);
@@ -0,0 +1,45 @@
+//! 自动重置卡的持久计划与查询投影，不保存上游凭据或完整卡片
+
+use chrono::{DateTime, Utc};
+use serde::{Deserialize, Serialize};
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct PlannedResetCredit {
+    pub id: String,
+    pub expires_at: DateTime<Utc>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct PendingResetCredit {
+    pub credit: PlannedResetCredit,
+    pub redeem_request_id: String,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct ResetCreditAutomationState {
+    pub next_discovery_at: DateTime<Utc>,
+    pub credits: Vec<PlannedResetCredit>,
+    pub pending: Option<PendingResetCredit>,
+    pub retry_at: Option<DateTime<Utc>>,
+    pub failures: u32,
+    pub last_result: Option<String>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ResetCreditAutomation {
+    pub account_id: String,
+    pub enabled: bool,
+    /// 零表示尚未创建；每次持久状态写入都递增版本
+    pub revision: u64,
+    pub next_run_at: DateTime<Utc>,
+    pub state: ResetCreditAutomationState,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ResetCreditAutomationStatus {
+    pub enabled: bool,
+    pub lead_minutes: u32,
+    pub next_discovery_at: Option<DateTime<Utc>>,
+    pub next_consume_at: Option<DateTime<Utc>>,
+    pub last_result: Option<String>,
+}
@@ -17,10 +17,28 @@ pub struct RetentionPolicy {
 }

 impl RetentionPolicy {
+    /// 保留期管理与全量设置保存共用的字段约束
+    pub fn validate_values(
+        usage_days: u32,
+        ops_days: u32,
+        audit_days: u32,
+    ) -> Result<(), &'static str> {
+        for (valid, field) in [
+            ((1..=31).contains(&usage_days), "usage_retention_days"),
+            (ops_days > 0, "ops_event_retention_days"),
+            (audit_days > 0, "audit_retention_days"),
+        ] {
+            if !valid {
+                return Err(field);
+            }
+        }
+        Ok(())
+    }
+
    pub fn try_new(usage_days: u32, ops_days: u32, audit_days: u32) -> Result<Self, AdminError> {
-        if usage_days < 31 || ops_days == 0 || audit_days == 0 {
+        if Self::validate_values(usage_days, ops_days, audit_days).is_err() {
            return Err(AdminError::invalid(
-                "请求保留期至少 31 天，事件与审计保留期必须为正数",
+                "请求保留期必须为 1～31 天，事件与审计保留期必须为正数",
            ));
        }
        Ok(Self {
@@ -11,6 +11,26 @@ use super::Revision;
 /// 客户端模型到上游模型的全局精确映射
 pub type ModelMappings = BTreeMap<PublicModelId, UpstreamModelId>;

+/// 全局模型映射的数量与文本约束；调用方保留各自的键值表示
+pub fn validate_model_mappings<'a>(
+    mappings: impl ExactSizeIterator<Item = (&'a str, &'a str)>,
+) -> Result<(), &'static str> {
+    if mappings.len() > 512 {
+        return Err("model_mappings");
+    }
+    for (requested, upstream) in mappings {
+        for value in [requested, upstream] {
+            if value.is_empty()
+                || value.len() > 256
+                || value.bytes().any(|byte| byte.is_ascii_control())
+            {
+                return Err("model_mappings");
+            }
+        }
+    }
+    Ok(())
+}
+
 /// Provider-owned 请求画像选择；Provider ID 是唯一命名空间
 pub type ProviderRequestProfiles =
    BTreeMap<ProviderKind, gateway_core::account::OpaqueProviderData>;
@@ -22,26 +42,24 @@ pub type ProviderRequestProfileUpdates =
 /// 账号调度策略；由 Core 拥有稳定值与 wire 映射
 pub use gateway_core::account::RotationStrategy;

-/// 完整运行设置事实
+/// 运行设置的共同值；版本、Provider 画像更新和数据库秘密由外层类型拥有
 #[derive(Debug, Clone, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
-#[serde(deny_unknown_fields)]
-pub struct RuntimeSettings {
-    pub request_profiles: ProviderRequestProfiles,
-    pub config_revision: Revision,
+pub struct RuntimeSettingsValues {
+    pub codex_privacy_policy: gateway_core::settings::privacy::CodexPrivacyPolicy,
    pub request_location_enabled: bool,
    pub request_location: gateway_core::account::RequestLocation,
-    pub model_mappings: ModelMappings,
    pub refresh_margin_seconds: u64,
    pub refresh_concurrency: u32,
    pub max_concurrent_per_account: u32,
-    pub request_interval_ms: u64,
    pub max_waiting_per_key: u32,
    pub max_waiting_per_account: u32,
    pub concurrency_wait_timeout_seconds: u32,
    pub openai_guardian_reserved_concurrency: u32,
+    pub openai_account_affinity: gateway_core::account::AccountAffinity,
+    pub max_account_rotations: u32,
+    pub openai_session_affinity_ttl_hours: u32,
    pub responses_max_decompressed_body_bytes: u64,
    pub smart_scheduling: gateway_core::account::SmartSchedulingConfig,
-    pub rotation_strategy: RotationStrategy,
    pub min_codex_desktop_version: Option<String>,
    pub min_codex_cli_version: Option<String>,
    pub usage_retention_days: u32,
@@ -57,6 +75,20 @@ pub struct RuntimeSettings {
    pub account_warmup_enabled: bool,
    pub account_warmup_schedule_time: String,
    pub account_warmup_model: Option<String>,
+    pub reset_credit_lead_minutes: u32,
+    pub reset_credit_max_weekly_remaining_percent: Option<u32>,
+}
+
+/// 完整运行设置事实
+#[derive(Debug, Clone, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct RuntimeSettings {
+    #[serde(flatten)]
+    pub values: RuntimeSettingsValues,
+    pub request_profiles: ProviderRequestProfiles,
+    pub config_revision: Revision,
+    pub model_mappings: ModelMappings,
+    pub rotation_strategy: RotationStrategy,
    pub updated_at: DateTime<Utc>,
 }

@@ -64,39 +96,14 @@ pub struct RuntimeSettings {
 #[derive(Debug, Clone, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
 #[serde(deny_unknown_fields)]
 pub struct ReplaceRuntimeSettings {
+    #[serde(flatten)]
+    pub values: RuntimeSettingsValues,
    /// 读取设置时的版本；与写入在同一事务内比较，防止覆盖并发更新
    pub expected_revision: Revision,
    /// 只覆盖提交的 Provider；未提交项保留当前持久值
    pub request_profile_updates: ProviderRequestProfileUpdates,
-    pub request_location_enabled: bool,
-    pub request_location: gateway_core::account::RequestLocation,
    pub model_mappings: ModelMappings,
-    pub refresh_margin_seconds: u64,
-    pub refresh_concurrency: u32,
-    pub max_concurrent_per_account: u32,
-    pub request_interval_ms: u64,
-    pub max_waiting_per_key: u32,
-    pub max_waiting_per_account: u32,
-    pub concurrency_wait_timeout_seconds: u32,
-    pub openai_guardian_reserved_concurrency: u32,
-    pub responses_max_decompressed_body_bytes: u64,
-    pub smart_scheduling: gateway_core::account::SmartSchedulingConfig,
    pub rotation_strategy: RotationStrategy,
-    pub min_codex_desktop_version: Option<String>,
-    pub min_codex_cli_version: Option<String>,
-    pub usage_retention_days: u32,
-    pub ops_event_retention_days: u32,
-    pub audit_retention_days: u32,
-    pub account_auto_freeze_enabled: bool,
-    pub account_auto_freeze_threshold: u32,
-    pub account_auto_freeze_window_seconds: u64,
-    pub account_auto_freeze_duration_seconds: u64,
-    pub account_auto_freeze_probe_enabled: bool,
-    pub account_auto_freeze_probe_model: Option<String>,
-    pub account_auto_freeze_adaptive_concurrency: bool,
-    pub account_warmup_enabled: bool,
-    pub account_warmup_schedule_time: String,
-    pub account_warmup_model: Option<String>,
 }

 /// 明文管理员 API Key；按产品约束明文落库，但禁止 Debug 泄漏
@@ -174,36 +181,68 @@ impl From<RuntimeSettings> for ReplaceRuntimeSettings {
                .into_iter()
                .map(|(provider, value)| (provider, Some(value)))
                .collect(),
-            request_location_enabled: settings.request_location_enabled,
-            request_location: settings.request_location,
+            values: settings.values,
            model_mappings: settings.model_mappings,
-            refresh_margin_seconds: settings.refresh_margin_seconds,
-            refresh_concurrency: settings.refresh_concurrency,
-            max_concurrent_per_account: settings.max_concurrent_per_account,
-            request_interval_ms: settings.request_interval_ms,
-            max_waiting_per_key: settings.max_waiting_per_key,
-            max_waiting_per_account: settings.max_waiting_per_account,
-            concurrency_wait_timeout_seconds: settings.concurrency_wait_timeout_seconds,
-            openai_guardian_reserved_concurrency: settings.openai_guardian_reserved_concurrency,
-            responses_max_decompressed_body_bytes: settings.responses_max_decompressed_body_bytes,
-            smart_scheduling: settings.smart_scheduling,
            rotation_strategy: settings.rotation_strategy,
-            min_codex_desktop_version: settings.min_codex_desktop_version,
-            min_codex_cli_version: settings.min_codex_cli_version,
-            usage_retention_days: settings.usage_retention_days,
-            ops_event_retention_days: settings.ops_event_retention_days,
-            audit_retention_days: settings.audit_retention_days,
-            account_auto_freeze_enabled: settings.account_auto_freeze_enabled,
-            account_auto_freeze_threshold: settings.account_auto_freeze_threshold,
-            account_auto_freeze_window_seconds: settings.account_auto_freeze_window_seconds,
-            account_auto_freeze_duration_seconds: settings.account_auto_freeze_duration_seconds,
-            account_auto_freeze_probe_enabled: settings.account_auto_freeze_probe_enabled,
-            account_auto_freeze_probe_model: settings.account_auto_freeze_probe_model,
-            account_auto_freeze_adaptive_concurrency: settings
-                .account_auto_freeze_adaptive_concurrency,
-            account_warmup_enabled: settings.account_warmup_enabled,
-            account_warmup_schedule_time: settings.account_warmup_schedule_time,
-            account_warmup_model: settings.account_warmup_model,
        }
    }
 }
+
+impl RuntimeSettingsValues {
+    /// 校验共同事实，返回字段名供边界转换错误；SQL 类型转换仍由 Store 处理
+    pub fn validate(&self) -> Result<(), &'static str> {
+        if !(1..=1440).contains(&self.reset_credit_lead_minutes) {
+            return Err("reset_credit_lead_minutes");
+        }
+        if self
+            .reset_credit_max_weekly_remaining_percent
+            .is_some_and(|percent| percent > 100)
+        {
+            return Err("reset_credit_max_weekly_remaining_percent");
+        }
+        self.request_location
+            .validate()
+            .map_err(|_| "request_location")?;
+        gateway_core::settings::validate_request_limits(
+            self.max_waiting_per_key,
+            self.max_waiting_per_account,
+            self.concurrency_wait_timeout_seconds,
+            self.max_account_rotations,
+            self.openai_session_affinity_ttl_hours,
+        )?;
+        gateway_core::settings::response_body_limit(self.responses_max_decompressed_body_bytes)?;
+        gateway_core::settings::client_min_versions(
+            self.min_codex_desktop_version.as_deref(),
+            self.min_codex_cli_version.as_deref(),
+        )?;
+        for (valid, field) in [
+            (
+                self.refresh_margin_seconds > 0
+                    && i64::try_from(self.refresh_margin_seconds).is_ok(),
+                "refresh_margin_seconds",
+            ),
+            (self.refresh_concurrency > 0, "refresh_concurrency"),
+        ] {
+            if !valid {
+                return Err(field);
+            }
+        }
+        super::retention::RetentionPolicy::validate_values(
+            self.usage_retention_days,
+            self.ops_event_retention_days,
+            self.audit_retention_days,
+        )?;
+        gateway_core::provider_ports::ProviderFreezePolicy::validate_values(
+            self.account_auto_freeze_threshold,
+            self.account_auto_freeze_window_seconds,
+            self.account_auto_freeze_duration_seconds,
+            self.account_auto_freeze_probe_model.as_deref(),
+        )?;
+        gateway_core::provider_ports::ProviderWarmupPolicy::validate_values(
+            self.account_warmup_enabled,
+            &self.account_warmup_schedule_time,
+            self.account_warmup_model.as_deref(),
+        )?;
+        Ok(())
+    }
+}
@@ -0,0 +1,26 @@
+//! 由宿主传入的可信写入主体，不属于插件请求载荷
+
+use serde::{Deserialize, Serialize};
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(tag = "kind", rename_all = "snake_case", deny_unknown_fields)]
+pub enum UsageActor {
+    Admin {
+        subject: String,
+    },
+    Plugin {
+        publisher: String,
+        name: String,
+        instance_id: String,
+    },
+    System,
+}
+
+impl super::UsageRecordChange {
+    #[must_use]
+    pub fn id(&self) -> &str {
+        match self {
+            Self::Put { id, .. } | Self::Update { id, .. } | Self::Delete { id } => id,
+        }
+    }
+}
@@ -0,0 +1,87 @@
+//! 按归属时间和维度维护统计贡献，业务来源与调整历史由调用方保存
+
+use super::{UsageDelta, UsageRecordFilter};
+use serde::{Deserialize, Serialize};
+use std::collections::BTreeMap;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum UsageMetric {
+    RequestCount,
+    SuccessCount,
+    FailureCount,
+    CancelledCount,
+    IncompleteCount,
+    CompletedRequestCount,
+    InputTokens,
+    OutputTokens,
+    CachedInputTokens,
+    CacheWriteInputTokens,
+    ReasoningOutputTokens,
+    ImageInputTokens,
+    ImageOutputTokens,
+    TotalTokens,
+}
+
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct UsageDimensions {
+    pub provider: Option<String>,
+    pub model: Option<String>,
+    pub account_ref: Option<String>,
+    pub client_key_ref: Option<String>,
+    pub operation: Option<String>,
+    pub transport: Option<String>,
+}
+
+/// 整个键决定覆盖目标；调用方可将来源标识编码进 key，重试相同键不会累计
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct UsageAggregateKey {
+    pub bucket_start_ms: i64,
+    pub dimensions: UsageDimensions,
+    pub key: String,
+}
+
+/// 值按 bucket_start_ms 归属，不自动摊分；负值用于相对原生统计的修正
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct UsageAggregate {
+    pub identity: UsageAggregateKey,
+    pub counts: BTreeMap<UsageMetric, UsageDelta>,
+    pub costs: BTreeMap<String, String>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(tag = "kind", rename_all = "snake_case", deny_unknown_fields)]
+pub enum UsageAggregateChange {
+    Put { aggregate: UsageAggregate },
+    Delete { identity: UsageAggregateKey },
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct WriteUsageAggregates {
+    pub changes: Vec<UsageAggregateChange>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct UsageAggregateWriteResult {
+    pub changed: Vec<UsageAggregateKey>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct ListUsageAggregates {
+    pub filter: UsageRecordFilter,
+    pub cursor: Option<String>,
+    pub limit: Option<u16>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct UsageAggregatePage {
+    pub items: Vec<UsageAggregate>,
+    pub next_cursor: Option<String>,
+}
@@ -0,0 +1,44 @@
+//! 用量基础操作的错误分类，不保存失败或重试状态
+
+use serde::{Deserialize, Serialize};
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum UsageErrorKind {
+    InvalidInput,
+    NotFound,
+    Conflict,
+    CapacityExceeded,
+    Unavailable,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct UsageDataError {
+    pub kind: UsageErrorKind,
+    pub message: String,
+}
+impl UsageDataError {
+    #[must_use]
+    pub fn new(kind: UsageErrorKind, message: impl Into<String>) -> Self {
+        Self {
+            kind,
+            message: message.into(),
+        }
+    }
+    #[must_use]
+    pub fn invalid(message: impl Into<String>) -> Self {
+        Self::new(UsageErrorKind::InvalidInput, message)
+    }
+    #[must_use]
+    pub fn unavailable(message: impl Into<String>) -> Self {
+        Self::new(UsageErrorKind::Unavailable, message)
+    }
+}
+impl std::fmt::Display for UsageDataError {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter.write_str(&self.message)
+    }
+}
+impl std::error::Error for UsageDataError {}
+pub type UsageDataResult<T> = Result<T, UsageDataError>;
@@ -0,0 +1,22 @@
+//! 用量明细、聚合维护与纯计价的公开合同
+
+mod value;
+pub use value::*;
+mod record;
+pub use record::*;
+mod query;
+pub use query::*;
+mod pricing;
+pub use pricing::*;
+mod error;
+pub use error::*;
+
+pub const USAGE_DATA_MAX_TARGETS: usize = 500;
+pub const USAGE_DATA_MAX_REQUEST_BYTES: usize = 2 * 1024 * 1024;
+pub const USAGE_DATA_MAX_PAGE_SIZE: u16 = 200;
+
+mod actor;
+pub use actor::*;
+
+mod aggregate;
+pub use aggregate::*;
@@ -0,0 +1,62 @@
+//! 纯 Token 计价合同，费用是否采用与额外费用合并由调用方决定
+
+use super::{UsageCost, UsageTokens};
+use gateway_core::metering::ModelPriceOverride;
+use serde::{Deserialize, Serialize};
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(tag = "kind", rename_all = "snake_case", deny_unknown_fields)]
+pub enum UsagePriceSelection {
+    Current,
+    Override { price: Box<ModelPriceOverride> },
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct UsagePricingInput {
+    pub id: String,
+    pub provider: String,
+    pub model: String,
+    pub tokens: UsageTokens,
+    pub service_tier: Option<String>,
+    pub price: UsagePriceSelection,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct EvaluateUsagePricing {
+    pub items: Vec<UsagePricingInput>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct UsagePricingBreakdown {
+    pub input_amount: String,
+    pub output_amount: String,
+    pub cache_read_amount: String,
+    pub cache_write_amount: String,
+    pub standard_amount: String,
+    pub long_context_billing_applied: bool,
+    pub service_tier: Option<String>,
+    pub custom_multiplier_bps: u32,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(tag = "status", rename_all = "snake_case", deny_unknown_fields)]
+pub enum UsagePricingResult {
+    Estimated {
+        id: String,
+        cost: UsageCost,
+        breakdown: UsagePricingBreakdown,
+    },
+    NotEstimable {
+        id: String,
+        reason: String,
+    },
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct UsagePricingEvaluation {
+    pub items: Vec<UsagePricingResult>,
+}
@@ -0,0 +1,36 @@
+//! 请求明细的有界筛选与稳定顺序分页
+
+use super::UsageRecord;
+use serde::{Deserialize, Serialize};
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct GetUsageRecord {
+    pub id: String,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct UsageRecordFilter {
+    pub start_ms: i64,
+    pub end_ms: i64,
+    pub provider: Option<String>,
+    pub model: Option<String>,
+    pub account_ref: Option<String>,
+    pub client_key_ref: Option<String>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct ListUsageRecords {
+    pub filter: UsageRecordFilter,
+    pub cursor: Option<String>,
+    pub limit: Option<u16>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct UsageRecordPage {
+    pub items: Vec<UsageRecord>,
+    pub next_cursor: Option<String>,
+}
@@ -0,0 +1,106 @@
+//! 既有请求明细的用量读写合同，不承载插件任务或来源状态
+
+use super::UsageCount;
+use serde::{Deserialize, Serialize};
+
+/// Token 使用宿主口径：缓存包含在输入中，推理包含在输出中，未知值为 null
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct UsageTokens {
+    pub input_tokens: Option<UsageCount>,
+    pub output_tokens: Option<UsageCount>,
+    pub cached_input_tokens: Option<UsageCount>,
+    pub cache_write_input_tokens: Option<UsageCount>,
+    pub reasoning_output_tokens: Option<UsageCount>,
+    pub image_input_tokens: Option<UsageCount>,
+    pub image_output_tokens: Option<UsageCount>,
+    pub total_tokens: Option<UsageCount>,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum UsageCostSource {
+    ProviderReported,
+    Calculated,
+}
+
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(tag = "kind", rename_all = "snake_case", deny_unknown_fields)]
+pub enum UsageCost {
+    #[default]
+    Unavailable,
+    Known {
+        source: UsageCostSource,
+        amount: String,
+        currency: String,
+    },
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum UsageOutcome {
+    Running,
+    Succeeded,
+    Failed,
+    Cancelled,
+    Incomplete,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct UsageRecordData {
+    pub client_key_ref: String,
+    pub provider: Option<String>,
+    pub account_ref: Option<String>,
+    pub requested_model: Option<String>,
+    pub model: Option<String>,
+    pub protocol: String,
+    pub operation: String,
+    pub endpoint: String,
+    pub client_transport: String,
+    pub service_tier: Option<String>,
+    pub started_at_ms: i64,
+    pub completed_at_ms: Option<i64>,
+    pub outcome: UsageOutcome,
+    pub tokens: UsageTokens,
+    pub cost: UsageCost,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct UsageRecord {
+    pub id: String,
+    pub data: UsageRecordData,
+    pub billing_snapshot: Option<serde_json::Value>,
+    pub provider_observation: Option<serde_json::Value>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(tag = "kind", rename_all = "snake_case", deny_unknown_fields)]
+pub enum UsageRecordChange {
+    Put {
+        id: String,
+        data: Box<UsageRecordData>,
+    },
+    /// tokens 替换全部 Token 字段；cost 的 unavailable 明确清空费用
+    Update {
+        id: String,
+        tokens: Option<UsageTokens>,
+        cost: Option<UsageCost>,
+    },
+    Delete {
+        id: String,
+    },
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct WriteUsageRecords {
+    pub changes: Vec<UsageRecordChange>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct UsageWriteResult {
+    pub changed_ids: Vec<String>,
+}
@@ -0,0 +1,63 @@
+//! 用量计数使用十进制字符串，避免插件前端丢失整数精度
+
+use serde::{Deserialize, Deserializer, Serialize, Serializer, de::Error};
+use std::fmt;
+
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub struct UsageCount(pub u64);
+impl UsageCount {
+    pub const ZERO: Self = Self(0);
+    #[must_use]
+    pub const fn get(self) -> u64 {
+        self.0
+    }
+}
+impl From<u64> for UsageCount {
+    fn from(value: u64) -> Self {
+        Self(value)
+    }
+}
+impl fmt::Display for UsageCount {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        self.0.fmt(formatter)
+    }
+}
+impl Serialize for UsageCount {
+    fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        serializer.serialize_str(&self.0.to_string())
+    }
+}
+impl<'de> Deserialize<'de> for UsageCount {
+    fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+        let value = String::deserialize(deserializer)?;
+        if value.is_empty() || !value.bytes().all(|byte| byte.is_ascii_digit()) {
+            return Err(D::Error::custom("count must be an unsigned decimal string"));
+        }
+        value.parse().map(Self).map_err(D::Error::custom)
+    }
+}
+
+/// 有符号统计贡献受 PostgreSQL bigint 范围限制，JSON 使用十进制字符串
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub struct UsageDelta(pub i64);
+impl UsageDelta {
+    #[must_use]
+    pub const fn get(self) -> i64 {
+        self.0
+    }
+}
+impl Serialize for UsageDelta {
+    fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        serializer.serialize_str(&self.0.to_string())
+    }
+}
+impl<'de> Deserialize<'de> for UsageDelta {
+    fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+        let value = String::deserialize(deserializer)?;
+        let digits = value.strip_prefix('-').unwrap_or(&value);
+        if digits.is_empty() || !digits.bytes().all(|byte| byte.is_ascii_digit()) {
+            return Err(D::Error::custom("delta must be a signed decimal string"));
+        }
+        value.parse().map(Self).map_err(D::Error::custom)
+    }
+}
@@ -11,6 +11,8 @@ pub mod plugins;
 pub mod pricing;
 pub mod provider;
 pub mod proxy;
+pub mod reset_credit_automation;
 pub mod retention;
 pub mod store;
 pub mod system;
+pub mod usage_data;
@@ -1,7 +1,7 @@
 //! 插件管理页面、资源访问与授权回调的运行时端口

 use async_trait::async_trait;
-use gateway_core::runtime::extensions::ExtensionSetReference;
+use gateway_core::routing::extensions::ExtensionSetReference;

 use crate::model::{
    AdminError,
@@ -26,7 +26,7 @@ use crate::model::{
        PluginCompatibilityRequirements, PluginSource,
    },
 };
-use gateway_core::runtime::extensions::ExtensionSetReference;
+use gateway_core::routing::extensions::ExtensionSetReference;

 /// Admin 准备完整候选并保活到提交后的发布结束；进程状态不能代替持久启用状态
 #[async_trait]
@@ -175,12 +175,13 @@ pub trait PluginDistribution: Send + Sync {
 /// Runtime 只解释插件包格式；安装事务与来源选择归 Admin
 #[async_trait]
 pub trait PluginPackageInspector: Send + Sync {
-    /// 可解析但版本范围未经宿主承诺的诊断，不决定启动资格
+    /// 完整校验包并返回版本范围诊断；校验失败与可加载但未经宿主承诺的提醒分开
    async fn compatibility_warning(
        &self,
-        _archive: Arc<[u8]>,
-        _expected_sha256: String,
+        archive: Arc<[u8]>,
+        expected_sha256: String,
    ) -> Result<Option<String>, AdminError> {
+        self.inspect(archive, Some(expected_sha256)).await?;
        Ok(None)
    }

@@ -26,6 +26,14 @@ use crate::model::{
    quota_forecast_sampling::QuotaForecastObservation,
 };

+/// 按原生 Token 口径计算的报价输入，额外费用由调用方处理
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ProviderUsagePricingInput {
+    pub upstream_model_id: String,
+    pub service_tier: Option<String>,
+    pub usage: gateway_core::metering::Usage,
+}
+
 /// Provider 管理失败的稳定分类
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum ProviderAdminErrorKind {
@@ -46,11 +54,12 @@ pub enum ProviderAdminErrorKind {
 /// `message` 是 Provider 局部诊断，可能包含原始上游正文；通用管理用例不得自动把它作为公开文案
 /// 只有明确拥有原始诊断合同的调用方才能读取，`Debug` 始终只记录是否存在
 /// `public_message` 则是明确标记为可公开的静态提示，不允许携带动态上游材料
-#[derive(Clone, PartialEq, Eq, thiserror::Error)]
+#[derive(Clone, thiserror::Error)]
 #[error("provider admin operation failed: {kind:?}")]
 pub struct ProviderAdminError {
    kind: ProviderAdminErrorKind,
-    message: Option<String>,
+    #[source]
+    diagnostic: Option<Arc<ProviderAdminDiagnostic>>,
    public_message: Option<&'static str>,
 }

@@ -59,7 +68,7 @@ impl std::fmt::Debug for ProviderAdminError {
        formatter
            .debug_struct("ProviderAdminError")
            .field("kind", &self.kind)
-            .field("message", &self.message.as_ref().map(|_| "<redacted>"))
+            .field("message", &self.message().map(|_| "<redacted>"))
            .field("public_message", &self.public_message)
            .finish()
    }
@@ -70,14 +79,22 @@ impl ProviderAdminError {
    pub const fn new(kind: ProviderAdminErrorKind) -> Self {
        Self {
            kind,
-            message: None,
+            diagnostic: None,
            public_message: None,
        }
    }

+    #[must_use]
+    pub fn with_source(mut self, source: impl Into<gateway_core::error::ErrorSource>) -> Self {
+        Arc::make_mut(self.diagnostic.get_or_insert_with(Default::default)).source =
+            Some(source.into());
+        self
+    }
+
    #[must_use]
    pub fn with_message(mut self, message: impl Into<String>) -> Self {
-        self.message = Some(message.into());
+        Arc::make_mut(self.diagnostic.get_or_insert_with(Default::default)).message =
+            Some(message.into());
        self
    }

@@ -100,10 +117,20 @@ impl ProviderAdminError {

    #[must_use]
    pub fn message(&self) -> Option<&str> {
-        self.message.as_deref()
+        self.diagnostic
+            .as_ref()
+            .and_then(|diagnostic| diagnostic.message.as_deref())
    }
 }

+// Provider 局部消息与 typed 来源共用一个不公开的上下文，避免跨用例转换后丢失
+#[derive(Debug, Clone, Default, thiserror::Error)]
+#[error("{}", message.as_deref().unwrap_or("provider admin dependency failed"))]
+struct ProviderAdminDiagnostic {
+    message: Option<String>,
+    source: Option<gateway_core::error::ErrorSource>,
+}
+
 /// 一个具体 Provider 对管理控制面提供的解析、验证、上游交互与运行时资源回收能力
 ///
 /// 数据变更由 Provider 返回 prepared facts；config revision、审计与 PostgreSQL 事务
@@ -111,11 +138,45 @@ impl ProviderAdminError {
 /// 运行时资源通知只在事务成功后发生
 #[async_trait]
 pub trait ProviderAdmin: Send + Sync {
+    fn compile_privacy_policy(
+        &self,
+        _policy: &gateway_core::settings::privacy::CodexPrivacyPolicy,
+    ) -> Result<
+        Arc<dyn gateway_core::settings::privacy::CompiledPrivacyPolicy>,
+        gateway_core::settings::privacy::PrivacyError,
+    > {
+        Err(gateway_core::settings::privacy::PrivacyError {
+            rule_index: 0,
+            reason: "Provider 不支持隐私策略",
+        })
+    }
+
+    fn preview_privacy_policy(
+        &self,
+        _request: gateway_core::settings::privacy::PrivacyPreviewRequest,
+    ) -> Result<
+        gateway_core::settings::privacy::PrivacyPreviewResult,
+        gateway_core::settings::privacy::PrivacyError,
+    > {
+        Err(gateway_core::settings::privacy::PrivacyError {
+            rule_index: 0,
+            reason: "Provider 不支持隐私策略",
+        })
+    }
+
    /// 只读内置价目；没有本地计价能力的 Provider 返回空目录
    fn pricing_catalog(&self) -> crate::model::pricing::ProviderPricingCatalog {
        Default::default()
    }

+    fn evaluate_usage_pricing(
+        &self,
+        _input: &ProviderUsagePricingInput,
+        _pricing: Option<&gateway_core::metering::ModelPriceOverride>,
+    ) -> Result<Option<gateway_core::metering::CalculatedCostBreakdown>, ProviderAdminError> {
+        Err(ProviderAdminError::new(ProviderAdminErrorKind::Unsupported))
+    }
+
    fn provider_kind(&self) -> &ProviderKind;

    /// 只读取原生 Provider 能力及账号类型，不执行网络或数据库查询
@@ -64,5 +64,6 @@ pub struct ProxyImportReservation {

 #[async_trait]
 pub trait ProxyProbe: Send + Sync {
-    async fn test(&self, proxy: &OutboundProxy, detect_location: bool) -> ProxyTestResult;
+    /// 未指定代理时探测服务器直连出口，不继承进程代理环境变量
+    async fn test(&self, proxy: Option<&OutboundProxy>, detect_location: bool) -> ProxyTestResult;
 }
@@ -0,0 +1,29 @@
+//! 自动重置卡计划的持久化端口，配置变更沿用管理事务与审计
+
+use async_trait::async_trait;
+use chrono::{DateTime, Utc};
+
+use super::store::AdminStoreResult;
+use crate::model::{MutationContext, reset_credit_automation::ResetCreditAutomation};
+
+#[async_trait]
+pub trait ResetCreditAutomationStore: Send + Sync {
+    async fn reset_credit_automation(
+        &self,
+        account_id: &str,
+    ) -> AdminStoreResult<Option<ResetCreditAutomation>>;
+
+    /// 只读取到期的本地计划，按到期时间稳定排序
+    async fn due_reset_credit_automations(
+        &self,
+        now: DateTime<Utc>,
+        limit: u32,
+    ) -> AdminStoreResult<Vec<String>>;
+
+    /// 按 record.revision 比较写入，成功返回新版本；配置变更传入审计上下文
+    async fn save_reset_credit_automation(
+        &self,
+        record: &ResetCreditAutomation,
+        context: Option<&MutationContext>,
+    ) -> AdminStoreResult<u64>;
+}
@@ -6,14 +6,14 @@ use std::{collections::BTreeMap, net::IpAddr, sync::Arc, time::Duration};

 use async_trait::async_trait;
 use chrono::{DateTime, Utc};
-use futures::stream::BoxStream;

 use super::backup::BackupStorePorts;
 use crate::model::{
    MutationContext, Revision,
    account_groups::{
-        AccountGroupListQuery, AccountGroupMemberFact, AccountGroupMutation, AccountGroupPage,
-        DeleteAccountGroup, NewAccountGroup, SetAccountGroupEnabled, UpdateAccountGroup,
+        AccountGroupListQuery, AccountGroupMemberFact, AccountGroupMutation,
+        AccountGroupOptionsPage, AccountGroupPage, DeleteAccountGroup, NewAccountGroup,
+        SetAccountGroupEnabled, UpdateAccountGroup,
    },
    accounts::{
        AccountListQuery, AccountPage, AccountPageItem, AccountRuntimeSnapshot,
@@ -27,9 +27,10 @@ use crate::model::{
        UpdateClientKey, UpdateClientKeyBudgetLimits,
    },
    observability::{
-        DashboardObservation, DashboardRuntimeSlots, DiagnosticDimension, DiagnosticsObservation,
-        OpsErrorPage, OpsErrorQuery, RequestMetricPoint, TimeRange, UsageCalculatedBillingFact,
-        UsageDetail, UsageFilter, UsageOverview, UsagePage, UsageQuery,
+        DashboardObservation, DashboardQuery, DiagnosticDimension, DiagnosticsObservation,
+        Granularity, OpsErrorPage, OpsErrorQuery, RequestMetricPoint, TimeRange,
+        UsageBillingProjection, UsageCalculatedBillingFact, UsageDetail, UsageFilter,
+        UsageInsightsObservation, UsageOverview, UsagePage, UsageQuery,
    },
    provider_credentials::{
        AuthorizationCommit, CredentialDetails, CredentialImportCommit, CredentialImportResult,
@@ -52,12 +53,13 @@ pub enum AdminStoreErrorKind {
 }

 /// 隐藏数据库实现细节的持久化错误
-#[derive(Debug, Clone, PartialEq, Eq, thiserror::Error)]
+#[derive(Debug, Clone, thiserror::Error)]
 #[error("{resource} store operation failed: {message}")]
 pub struct AdminStoreError {
    kind: AdminStoreErrorKind,
    resource: &'static str,
    message: String,
+    source: Option<gateway_core::error::ErrorSource>,
 }

 impl AdminStoreError {
@@ -71,9 +73,27 @@ impl AdminStoreError {
            kind,
            resource,
            message: message.into(),
+            source: None,
        }
    }

+    /// 来源留在内部诊断链，公开消息不展开基础设施错误
+    #[must_use]
+    pub fn with_source(mut self, source: impl Into<gateway_core::error::ErrorSource>) -> Self {
+        self.source = Some(source.into());
+        self
+    }
+
+    /// 清理失败不覆盖最初操作的分类与原因
+    #[must_use]
+    pub fn with_cleanup(mut self, cleanup: impl Into<gateway_core::error::ErrorSource>) -> Self {
+        self.source = Some(gateway_core::error::ErrorSource::cleanup(
+            self.source.take(),
+            cleanup,
+        ));
+        self
+    }
+
    #[must_use]
    pub const fn kind(&self) -> AdminStoreErrorKind {
        self.kind
@@ -89,7 +109,9 @@ pub type AdminStoreResult<T> = Result<T, AdminStoreError>;

 /// 账号目录与公共账号写操作
 #[async_trait]
-pub trait AccountStore: Send + Sync {
+pub trait AccountStore:
+    super::reset_credit_automation::ResetCreditAutomationStore + Send + Sync
+{
    /// 插件回调按授权 Provider/账号在数据库过滤后做稳定 cursor 分页
    async fn list_plugin_accounts(
        &self,
@@ -108,6 +130,8 @@ pub trait AccountStore: Send + Sync {
        runtime: AccountRuntimeSnapshot,
    ) -> AdminStoreResult<Option<AccountPageItem>>;

+    async fn account_exists(&self, account_id: &str) -> AdminStoreResult<bool>;
+
    async fn load_account_usage(
        &self,
        range: TimeRange,
@@ -221,6 +245,13 @@ pub trait AccountStore: Send + Sync {
 /// 可丢失账号运行态的管理读端口；跨存储编排由 Admin application service 拥有
 #[async_trait]
 pub trait AccountRuntimeStore: Send + Sync {
+    async fn account_concurrency(
+        &self,
+        account_id: &str,
+        offset: u64,
+        limit: u32,
+    ) -> AdminStoreResult<crate::model::accounts::AccountConcurrencyPage>;
+
    async fn active_rate_limits(&self) -> AdminStoreResult<AccountRuntimeSnapshot>;

    async fn account_runtime(
@@ -274,6 +305,14 @@ pub trait AuthStore: Send + Sync {

    async fn store_session(&self, session_id: &str, session: &AuthSession) -> AdminStoreResult<()>;

+    /// 原子替换或撤销仍匹配的会话并返回当前值；过期或退出后不重新创建
+    async fn compare_exchange_session(
+        &self,
+        session_id: &str,
+        expected: &AuthSession,
+        replacement: Option<&AuthSession>,
+    ) -> AdminStoreResult<Option<AuthSession>>;
+
    async fn delete_session(&self, session_id: &str) -> AdminStoreResult<Option<AuthSession>>;

    async fn client_key_enabled(
@@ -358,6 +397,11 @@ pub trait AccountGroupStore: Send + Sync {
        query: AccountGroupListQuery,
    ) -> AdminStoreResult<AccountGroupPage>;

+    async fn list_account_group_options(
+        &self,
+        query: AccountGroupListQuery,
+    ) -> AdminStoreResult<AccountGroupOptionsPage>;
+
    async fn load_account_group_members(
        &self,
        group_ids: &[gateway_core::routing::AccountGroupId],
@@ -388,46 +432,50 @@ pub trait AccountGroupStore: Send + Sync {
    ) -> AdminStoreResult<AccountGroupMutation>;
 }

-/// 逐条读取的已计算费用事实；消费结束或丢弃时释放查询资源
-pub type UsageCalculatedBillingStream<'a> =
-    BoxStream<'a, AdminStoreResult<UsageCalculatedBillingFact>>;
+/// 后台投影复用 Admin 与 Provider 的费用规则，Store 不重新解释价格
+pub trait UsageBillingProjector: Send + Sync {
+    fn project(
+        &self,
+        fact: &UsageCalculatedBillingFact,
+    ) -> Result<UsageBillingProjection, crate::model::AdminError>;
+}

 /// 用量、趋势、诊断与运维错误的只读能力
 #[async_trait]
 pub trait ObservabilityStore: Send + Sync {
+    /// 读取实现声明的总预算，缓存等待沿用同一配置，避免外层提前截断
+    fn query_timeout(&self) -> std::time::Duration;
+
+    /// 缓存必须与删除和后台投影提交的版本一致
+    async fn analytics_cache_generation(&self) -> AdminStoreResult<u64>;
+
    /// 返回历史统计区间和指定观测时刻下的实时账号状态
    async fn dashboard_summary(
        &self,
-        range: TimeRange,
+        query: DashboardQuery,
        observed_at: DateTime<Utc>,
    ) -> AdminStoreResult<DashboardObservation>;

-    /// 返回 Dashboard 可选的实时槽位事实
-    ///
-    /// 该状态来自可丢失的运行时存储；无实现或运行时存储不可用时返回 `None`，不影响
-    /// 持久观测数据的读取
-    async fn dashboard_runtime_slots(
+    async fn dashboard_trend(
        &self,
-        _observed_at: DateTime<Utc>,
-    ) -> AdminStoreResult<Option<DashboardRuntimeSlots>> {
-        Ok(None)
-    }
-
-    async fn dashboard_trend(&self, range: TimeRange) -> AdminStoreResult<Vec<RequestMetricPoint>>;
+        range: TimeRange,
+        granularity: Granularity,
+    ) -> AdminStoreResult<Vec<RequestMetricPoint>>;

    async fn usage_trend(
        &self,
        range: TimeRange,
        filter: UsageFilter,
+        granularity: Granularity,
    ) -> AdminStoreResult<Vec<RequestMetricPoint>>;

-    /// 流式返回可由 Provider 重新校验的已计算费用事实，不保证顺序
-    /// 查询及解码错误由流返回；调用方应逐条聚合，避免收集整个区间
-    fn usage_calculated_billing_facts(
+    /// 同一读取快照中的汇总、趋势和已投影情景费用
+    async fn usage_insights_observation(
        &self,
        range: TimeRange,
        filter: UsageFilter,
-    ) -> UsageCalculatedBillingStream<'_>;
+        granularity: Granularity,
+    ) -> AdminStoreResult<UsageInsightsObservation>;

    async fn list_usage_records(&self, query: UsageQuery) -> AdminStoreResult<UsagePage>;

@@ -444,9 +492,17 @@ pub trait ObservabilityStore: Send + Sync {
        range: TimeRange,
        filter: UsageFilter,
        dimension: DiagnosticDimension,
+        limit: u16,
    ) -> AdminStoreResult<DiagnosticsObservation>;

    async fn list_ops_errors(&self, query: OpsErrorQuery) -> AdminStoreResult<OpsErrorPage>;
+
+    /// 按精确目标读取受控错误，不受列表时间窗口与当前页面影响
+    async fn diagnostic_errors(
+        &self,
+        target: &crate::model::diagnostics::DiagnosticTarget,
+        limit: u16,
+    ) -> AdminStoreResult<Vec<crate::model::observability::OpsError>>;
 }

 /// Runtime settings 与管理员 API Key 写入
@@ -527,9 +583,15 @@ pub struct AdminStorePorts {
    plugins: Arc<dyn super::plugins::PluginStore>,
    plugin_state: Arc<dyn super::plugins::PluginStateStore>,
    plugin_resources: Arc<dyn super::plugin_resources::PluginResourceStore>,
+    usage_data: Arc<dyn super::usage_data::UsageDataStore>,
 }

 impl AdminStorePorts {
+    #[must_use]
+    pub fn usage_data(&self) -> Arc<dyn super::usage_data::UsageDataStore> {
+        self.usage_data.clone()
+    }
+
    #[must_use]
    pub fn plugin_resources(&self) -> Arc<dyn super::plugin_resources::PluginResourceStore> {
        self.plugin_resources.clone()
@@ -560,6 +622,7 @@ impl AdminStorePorts {
        plugins: Arc<dyn super::plugins::PluginStore>,
        plugin_state: Arc<dyn super::plugins::PluginStateStore>,
        plugin_resources: Arc<dyn super::plugin_resources::PluginResourceStore>,
+        usage_data: Arc<dyn super::usage_data::UsageDataStore>,
    ) -> Self {
        Self {
            accounts,
@@ -571,6 +634,7 @@ impl AdminStorePorts {
            plugins,
            plugin_state,
            plugin_resources,
+            usage_data,
        }
    }

@@ -0,0 +1,27 @@
+//! 原生请求用量的有界读取和事务写入端口
+
+use crate::model::{auth::AdminAuditEvent, usage_data::*};
+use async_trait::async_trait;
+
+pub struct StoredUsageWrite {
+    pub changes: Vec<(UsageRecordChange, AdminAuditEvent)>,
+}
+
+pub struct StoredAggregateWrite {
+    pub changes: Vec<(UsageAggregateChange, AdminAuditEvent)>,
+}
+
+#[async_trait]
+pub trait UsageDataStore: Send + Sync {
+    async fn list_aggregates(
+        &self,
+        request: ListUsageAggregates,
+    ) -> UsageDataResult<UsageAggregatePage>;
+    async fn write_aggregates(
+        &self,
+        command: StoredAggregateWrite,
+    ) -> UsageDataResult<UsageAggregateWriteResult>;
+    async fn get_record(&self, request: GetUsageRecord) -> UsageDataResult<UsageRecord>;
+    async fn list_records(&self, request: ListUsageRecords) -> UsageDataResult<UsageRecordPage>;
+    async fn write_records(&self, command: StoredUsageWrite) -> UsageDataResult<UsageWriteResult>;
+}
@@ -0,0 +1,37 @@
+//! 账号自动重置的公开操作声明，复用账号用例及宿主签发的审计上下文
+
+use crate::{AccountsService, model::AdminError};
+use gateway_core::account::ProviderAccountId;
+use std::sync::Arc;
+
+pub(super) fn register(
+    registry: &mut super::Registry,
+    service: &Arc<dyn AccountsService>,
+) -> Result<(), AdminError> {
+    macro_rules! register {
+        ($sdk:ident, $method:ident, $input:ty, $pattern:pat $(, $argument:expr)* $(,)?) => {{
+            let service = service.clone();
+            registry.register(concat!("accounts.", stringify!($method)), move |$pattern: $input| {
+                let service = service.clone();
+                Box::pin(async move { service.$method($($argument),*).await })
+            })?;
+        }};
+    }
+    register!(
+        GetResetCreditAutomation,
+        reset_credit_automation_status,
+        String,
+        account_id,
+        ProviderAccountId::new(account_id).map_err(|_| AdminError::invalid("账号 ID 无效"))?
+    );
+    register!(
+        SetResetCreditAutomation,
+        set_reset_credit_automation,
+        (String, bool),
+        (account_id, enabled),
+        &super::actor::mutation_context()?,
+        ProviderAccountId::new(account_id).map_err(|_| AdminError::invalid("账号 ID 无效"))?,
+        enabled
+    );
+    Ok(())
+}
@@ -0,0 +1,55 @@
+//! 公开服务写入主体由受信宿主边界设置，插件输入不能覆盖
+
+use crate::model::usage_data::UsageActor;
+use crate::model::{AdminError, MutationActor, MutationContext};
+use std::future::Future;
+
+tokio::task_local! {
+    static ACTOR: Option<UsageActor>;
+}
+
+/// 与 middleware Origin 独立传递，嵌套服务不会丢失真实调用主体
+pub async fn scope_actor<F: Future>(actor: UsageActor, future: F) -> F::Output {
+    scope_captured(Some(actor), future).await
+}
+
+pub(super) async fn scope_captured<F: Future>(actor: Option<UsageActor>, future: F) -> F::Output {
+    ACTOR.scope(actor, future).await
+}
+
+pub(super) fn current_actor() -> Result<UsageActor, crate::model::usage_data::UsageDataError> {
+    ACTOR.try_with(Clone::clone).ok().flatten().ok_or_else(|| {
+        crate::model::usage_data::UsageDataError::invalid(
+            "usage mutation requires a trusted caller identity",
+        )
+    })
+}
+
+pub(super) fn mutation_context() -> Result<MutationContext, AdminError> {
+    let actor = ACTOR
+        .try_with(Clone::clone)
+        .ok()
+        .flatten()
+        .ok_or_else(|| AdminError::invalid("服务写入缺少可信调用主体"))?;
+    super::CURRENT
+        .try_with(|origin| {
+            let (actor, request_id) = match actor {
+                UsageActor::Plugin { instance_id, .. } => (
+                    MutationActor::System,
+                    format!(
+                        "plugin:{instance_id}:request:{}:call:{}",
+                        origin.request_id, origin.call_id
+                    ),
+                ),
+                UsageActor::Admin { subject } => (
+                    MutationActor::AdminSession {
+                        admin_user_id: subject,
+                    },
+                    origin.request_id.clone(),
+                ),
+                UsageActor::System => (MutationActor::System, origin.request_id.clone()),
+            };
+            MutationContext { actor, request_id }
+        })
+        .map_err(|_| AdminError::invalid("服务写入缺少调用上下文"))
+}
@@ -1,18 +1,22 @@
 //! 主动服务调用的统一组合入口；普通业务方法由所属 HTTP 或执行边界包裹

+mod accounts;
+mod actor;
 mod registry;
 mod settings;
+mod usage_data;
+pub use actor::scope_actor;
 pub use registry::Registry;

 use std::{future::Future, sync::Arc};

 use futures::future::BoxFuture;
 use gateway_core::{
-    engine::middleware::FrozenMiddlewarePlan,
-    middleware::{
-        compose,
+    engine::middleware::{
+        FrozenMiddlewarePlan,
        service::{Context, Error, Value},
    },
+    middleware::compose,
 };

 use crate::model::{AdminError, AdminErrorKind};
@@ -98,8 +102,10 @@ pub(crate) async fn invoke(
        plan: plan.clone(),
    };
    let inner = context.clone();
+    // next 可在另一回调任务中执行，终端必须保留发起主体及其缺席状态
+    let actor = actor::current_actor().ok();
    let next = compose(Vec::new(), move |input| {
-        Box::pin(scope(inner, terminal(input)))
+        Box::pin(actor::scope_captured(actor, scope(inner, terminal(input))))
    });
    tokio::select! {
        biased;
@@ -2,7 +2,7 @@

 use crate::model::AdminError;
 use futures::future::BoxFuture;
-use gateway_core::middleware::service::{Error, Value};
+use gateway_core::engine::middleware::service::{Error, Value};
 use serde::{Serialize, de::DeserializeOwned};
 use std::{collections::BTreeMap, sync::Arc};

@@ -29,6 +29,13 @@ impl Registry {
        super::settings::register(self, service)
    }

+    pub fn register_accounts(
+        &mut self,
+        service: &Arc<dyn crate::AccountsService>,
+    ) -> Result<(), AdminError> {
+        super::accounts::register(self, service)
+    }
+
    pub(crate) fn register<I, O>(
        &mut self,
        name: &'static str,
@@ -54,6 +61,57 @@ impl Registry {
        Ok(())
    }

+    pub fn register_usage_data(
+        &mut self,
+        service: &Arc<dyn crate::UsageDataService>,
+    ) -> Result<(), AdminError> {
+        super::usage_data::register(self, service)
+    }
+
+    pub(crate) fn register_usage<I, O>(
+        &mut self,
+        name: &'static str,
+        handler: impl Fn(I) -> BoxFuture<'static, crate::model::usage_data::UsageDataResult<O>>
+        + Send
+        + Sync
+        + 'static,
+    ) -> Result<(), AdminError>
+    where
+        I: DeserializeOwned + Send + 'static,
+        O: Serialize + Send + 'static,
+    {
+        let std::collections::btree_map::Entry::Vacant(entry) = self.operations.entry(name) else {
+            return Err(AdminError::internal(format!("公开服务重复登记：{name}")));
+        };
+        let handler = Arc::new(handler);
+        entry.insert(Arc::new(move |input| {
+            let handler = handler.clone();
+            Box::pin(async move {
+                // 在反序列化之前限制编码后的完整请求，避免单条记录绕过批量行数约束
+                let bytes =
+                    serde_json::to_vec(&input).map_err(|_| Error::invalid("服务输入编码无效"))?;
+                if bytes.len() > crate::model::usage_data::USAGE_DATA_MAX_REQUEST_BYTES {
+                    return Err(super::usage_data::encode_error(
+                        crate::model::usage_data::UsageDataError::new(
+                            crate::model::usage_data::UsageErrorKind::CapacityExceeded,
+                            "usage input exceeds 2 MiB",
+                        ),
+                    ));
+                }
+                let input = serde_json::from_value(input).map_err(|_| {
+                    super::usage_data::encode_error(
+                        crate::model::usage_data::UsageDataError::invalid("服务输入类型无效"),
+                    )
+                })?;
+                let output = handler(input)
+                    .await
+                    .map_err(super::usage_data::encode_error)?;
+                serde_json::to_value(output).map_err(|_| Error::unavailable("服务结果编码失败"))
+            })
+        }));
+        Ok(())
+    }
+
    pub async fn call(&self, operation: &str, input: Value) -> Result<Value, Error> {
        let (operation, handler) =
            self.operations
@@ -25,6 +25,13 @@ pub(super) fn register(
        }};
    }
    register!(Load, load, (), ());
+    register!(
+        PreviewPrivacyPolicy,
+        preview_privacy_policy,
+        gateway_core::settings::privacy::PrivacyPreviewRequest,
+        request,
+        request
+    );
    register!(
        Replace,
        replace,
@@ -0,0 +1,63 @@
+//! 原生用量能力的公开服务登记
+
+use crate::{
+    UsageDataService,
+    model::{AdminError, usage_data::*},
+};
+use std::sync::Arc;
+
+pub(super) fn register(
+    registry: &mut super::Registry,
+    service: &Arc<dyn UsageDataService>,
+) -> Result<(), AdminError> {
+    macro_rules! read {
+        ($name:literal, $method:ident, $input:ty) => {{
+            let service = service.clone();
+            registry.register_usage($name, move |request: $input| {
+                let service = service.clone();
+                Box::pin(async move { service.$method(request).await })
+            })?;
+        }};
+    }
+    read!("usage.records.get", get_record, GetUsageRecord);
+    read!("usage.records.list", list_records, ListUsageRecords);
+    read!(
+        "usage.aggregates.list",
+        list_aggregates,
+        ListUsageAggregates
+    );
+    read!("pricing.evaluate", evaluate_pricing, EvaluateUsagePricing);
+    let aggregates = service.clone();
+    registry.register_usage(
+        "usage.aggregates.write",
+        move |request: WriteUsageAggregates| {
+            let service = aggregates.clone();
+            Box::pin(async move {
+                let actor = super::actor::current_actor()?;
+                service.write_aggregates(&actor, request).await
+            })
+        },
+    )?;
+    let service = service.clone();
+    registry.register_usage("usage.records.write", move |request: WriteUsageRecords| {
+        let service = service.clone();
+        Box::pin(async move {
+            let actor = super::actor::current_actor()?;
+            service.write_records(&actor, request).await
+        })
+    })?;
+    Ok(())
+}
+
+pub(super) fn encode_error(
+    error: UsageDataError,
+) -> gateway_core::engine::middleware::service::Error {
+    gateway_core::engine::middleware::service::Error {
+        kind: serde_json::to_value(error.kind)
+            .ok()
+            .and_then(|v| v.as_str().map(str::to_owned))
+            .unwrap_or_else(|| "unavailable".into()),
+        message: error.message.clone(),
+        details: serde_json::to_value(error).ok(),
+    }
+}
@@ -0,0 +1,125 @@
+//! 每日错峰发现与已知卡片的临期执行，周期只读取本地到期计划
+
+use crate::{
+    model::reset_credit_automation::{PlannedResetCredit, ResetCreditAutomation},
+    ports::store::{AccountStore, SettingsStore},
+    use_case::accounts::AccountsService,
+};
+use chrono::{DateTime, Utc};
+use futures::StreamExt as _;
+use gateway_core::{
+    account::ProviderAccountId,
+    task::{ScheduledTask, WorkerCycleContext, WorkerTaskError},
+    time::DeploymentTimeZone,
+};
+use sha2::{Digest as _, Sha256};
+use std::{sync::Arc, time::Duration};
+
+/// 当地次日随机发现时间；随机数由调用者提供，结果持久化后不会因重启重抽
+pub(crate) fn next_discovery(
+    now: DateTime<Utc>,
+    timezone: DeploymentTimeZone,
+    random: u64,
+) -> Option<DateTime<Utc>> {
+    let start = timezone.days_after(now, 1)?;
+    let end = timezone.days_after(now, 2)?;
+    let seconds = u64::try_from((end - start).num_seconds()).ok()?;
+    if seconds == 0 {
+        return None;
+    }
+    start.checked_add_signed(chrono::Duration::seconds(
+        i64::try_from(random % seconds).ok()?,
+    ))
+}
+
+/// 提前窗口的前 10% 用于账号错峰，最多一分钟，其余时间保留给网络失败恢复
+pub(crate) fn consume_at(
+    account_id: &str,
+    credit: &PlannedResetCredit,
+    lead_minutes: u32,
+) -> DateTime<Utc> {
+    let lead_seconds = i64::from(lead_minutes) * 60;
+    let mut hash = Sha256::new();
+    hash.update(account_id.as_bytes());
+    hash.update([0]);
+    hash.update(credit.id.as_bytes());
+    let digest = hash.finalize();
+    let offset =
+        i64::from(u16::from_be_bytes([digest[0], digest[1]])) % (lead_seconds / 10).clamp(1, 60);
+    credit.expires_at - chrono::Duration::seconds(lead_seconds - offset)
+}
+
+pub(crate) fn next_consumption(
+    record: &ResetCreditAutomation,
+    lead_minutes: u32,
+) -> Option<DateTime<Utc>> {
+    record
+        .state
+        .credits
+        .iter()
+        .map(|credit| consume_at(&record.account_id, credit, lead_minutes))
+        .min()
+}
+
+pub(crate) fn reschedule(
+    record: &mut ResetCreditAutomation,
+    lead_minutes: u32,
+    now: DateTime<Utc>,
+) {
+    record.next_run_at = if let Some(retry) = record.state.retry_at {
+        retry
+    } else if record.state.pending.is_some() {
+        now
+    } else {
+        next_consumption(record, lead_minutes).map_or(record.state.next_discovery_at, |due| {
+            due.min(record.state.next_discovery_at)
+        })
+    };
+}
+
+pub(crate) struct ResetCreditAutomationTask {
+    pub(crate) accounts: Arc<dyn AccountsService>,
+    pub(crate) store: Arc<dyn AccountStore>,
+    pub(crate) settings: Arc<dyn SettingsStore>,
+}
+
+impl ScheduledTask for ResetCreditAutomationTask {
+    fn run_cycle(
+        &self,
+        context: WorkerCycleContext,
+    ) -> futures::future::BoxFuture<'_, Result<(), WorkerTaskError>> {
+        Box::pin(async move {
+            let settings = self
+                .settings
+                .load_runtime_settings()
+                .await
+                .map_err(|_| WorkerTaskError::safe("重置卡设置读取失败"))?;
+            // 单轮有界，积压沿到期顺序继续；并发复用已有账号刷新配置
+            let due = self
+                .store
+                .due_reset_credit_automations(Utc::now(), 100)
+                .await
+                .map_err(|_| WorkerTaskError::safe("重置卡计划读取失败"))?;
+            let work = futures::stream::iter(due)
+                .map(|account_id| async move {
+                    let id = ProviderAccountId::new(account_id.clone())
+                        .map_err(|_| WorkerTaskError::safe("重置卡账号 ID 不合法"))?;
+                    if let Err(error) = self.accounts.reconcile_reset_credit_automation(id).await {
+                        tracing::warn!(
+                            account_id,
+                            error_kind = error.kind().as_str(),
+                            "自动重置卡任务失败"
+                        );
+                    }
+                    Ok::<_, WorkerTaskError>(())
+                })
+                .buffer_unordered(settings.values.refresh_concurrency.max(1) as usize)
+                .collect::<Vec<_>>();
+            tokio::select! {
+                () = context.cancellation().cancelled() => {},
+                _ = tokio::time::timeout(Duration::from_secs(30), work) => {},
+            }
+            Ok(())
+        })
+    }
+}
@@ -19,9 +19,9 @@ use crate::{
        AdminError, MutationContext,
        account_groups::{
            AccountGroupAccountSummary, AccountGroupCapacity, AccountGroupListQuery,
-            AccountGroupMemberFact, AccountGroupMutation, AccountGroupPage, AccountGroupRecord,
-            CreateAccountGroup, DeleteAccountGroup, NewAccountGroup, SetAccountGroupEnabled,
-            UpdateAccountGroup,
+            AccountGroupMemberFact, AccountGroupMutation, AccountGroupOptionsPage,
+            AccountGroupPage, AccountGroupRecord, CreateAccountGroup, DeleteAccountGroup,
+            NewAccountGroup, SetAccountGroupEnabled, UpdateAccountGroup,
        },
    },
    ports::store::{AccountGroupStore, AccountRuntimeStore},
@@ -33,6 +33,10 @@ use super::{map_store_error, publish_committed};
 #[async_trait]
 pub trait AccountGroupService: Send + Sync {
    async fn list(&self, query: AccountGroupListQuery) -> Result<AccountGroupPage, AdminError>;
+    async fn list_options(
+        &self,
+        query: AccountGroupListQuery,
+    ) -> Result<AccountGroupOptionsPage, AdminError>;
    async fn create(
        &self,
        context: &MutationContext,
@@ -130,17 +134,33 @@ impl AccountGroupService for DefaultAccountGroupService {
        Ok(page)
    }

+    async fn list_options(
+        &self,
+        query: AccountGroupListQuery,
+    ) -> Result<AccountGroupOptionsPage, AdminError> {
+        self.store
+            .list_account_group_options(query)
+            .await
+            .map_err(|error| map_store_error(error, "account group options"))
+    }
+
    async fn create(
        &self,
        context: &MutationContext,
        command: CreateAccountGroup,
    ) -> Result<AccountGroupMutation, AdminError> {
+        crate::model::account_groups::validate_group_fields(
+            &command.name,
+            command.description.as_deref(),
+        )
+        .map_err(|_| AdminError::invalid("账号组请求不合法"))?;
        let id = AccountGroupId::new(format!("grp_{}", Uuid::now_v7().simple()))
            .map_err(|_| AdminError::internal("创建账号组 ID 失败"))?;
        self.publish(
            self.store
                .create_account_group(
                    NewAccountGroup {
+                        allow_image_generation: command.allow_image_generation,
                        id,
                        name: command.name,
                        description: command.description,
@@ -159,6 +179,11 @@ impl AccountGroupService for DefaultAccountGroupService {
        context: &MutationContext,
        command: UpdateAccountGroup,
    ) -> Result<AccountGroupMutation, AdminError> {
+        crate::model::account_groups::validate_group_fields(
+            &command.name,
+            command.description.as_deref(),
+        )
+        .map_err(|_| AdminError::invalid("账号组请求不合法"))?;
        self.publish(self.store.update_account_group(command, context).await)
            .await
    }
@@ -1,5 +1,7 @@
 //! 统一账号目录与原生 Provider 分派

+mod reset_credit_automation;
+
 use std::{
    collections::{BTreeMap, BTreeSet},
    sync::Arc,
@@ -52,6 +54,13 @@ const CONNECTION_TEST_INPUT: &str = "Reply with exactly OK.";
 /// 统一账号页消费的服务
 #[async_trait]
 pub trait AccountsService: Send + Sync {
+    async fn concurrency(
+        &self,
+        account_id: ProviderAccountId,
+        page: u32,
+        page_size: u32,
+    ) -> Result<crate::model::accounts::AccountConcurrencyPage, AdminError>;
+
    async fn list(&self, query: AccountListQuery) -> Result<AccountDirectoryPage, AdminError>;

    async fn export(
@@ -123,6 +132,29 @@ pub trait AccountsService: Send + Sync {
        Err(AdminError::invalid("当前 Provider 不支持账号头像"))
    }

+    async fn reset_credit_automation_status(
+        &self,
+        _account_id: ProviderAccountId,
+    ) -> Result<crate::model::reset_credit_automation::ResetCreditAutomationStatus, AdminError>
+    {
+        Err(AdminError::invalid("账号不支持自动重置卡"))
+    }
+    async fn set_reset_credit_automation(
+        &self,
+        _context: &MutationContext,
+        _account_id: ProviderAccountId,
+        _enabled: bool,
+    ) -> Result<crate::model::reset_credit_automation::ResetCreditAutomationStatus, AdminError>
+    {
+        Err(AdminError::invalid("账号不支持自动重置卡"))
+    }
+    async fn reconcile_reset_credit_automation(
+        &self,
+        _account_id: ProviderAccountId,
+    ) -> Result<(), AdminError> {
+        Err(AdminError::invalid("账号不支持自动重置卡"))
+    }
+
    async fn reset_credits(
        &self,
        _context: &MutationContext,
@@ -160,6 +192,8 @@ pub trait AccountsService: Send + Sync {
 pub(crate) struct DefaultAccountsService {
    accounts: Arc<dyn AccountStore>,
    account_runtime: Arc<dyn AccountRuntimeStore>,
+    settings: Arc<dyn crate::ports::store::SettingsStore>,
+    timezone: gateway_core::time::DeploymentTimeZone,
    providers: ProviderAdminRegistry,
    snapshot: Arc<dyn SnapshotControl>,
    probe: Arc<dyn AccountProbe>,
@@ -172,6 +206,8 @@ impl DefaultAccountsService {
    pub(crate) fn new(
        accounts: Arc<dyn AccountStore>,
        account_runtime: Arc<dyn AccountRuntimeStore>,
+        settings: Arc<dyn crate::ports::store::SettingsStore>,
+        timezone: gateway_core::time::DeploymentTimeZone,
        providers: ProviderAdminRegistry,
        snapshot: Arc<dyn SnapshotControl>,
        probe: Arc<dyn AccountProbe>,
@@ -179,6 +215,8 @@ impl DefaultAccountsService {
        Self {
            accounts,
            account_runtime,
+            settings,
+            timezone,
            providers,
            snapshot,
            probe,
@@ -381,6 +419,31 @@ impl DefaultAccountsService {

 #[async_trait]
 impl AccountsService for DefaultAccountsService {
+    async fn concurrency(
+        &self,
+        account_id: ProviderAccountId,
+        page: u32,
+        page_size: u32,
+    ) -> Result<crate::model::accounts::AccountConcurrencyPage, AdminError> {
+        let offset = page
+            .checked_sub(1)
+            .and_then(|page| page.checked_mul(page_size))
+            .filter(|_| (1..=100).contains(&page_size))
+            .ok_or_else(|| AdminError::invalid("并发明细分页参数无效"))?;
+        if !self
+            .accounts
+            .account_exists(account_id.as_str())
+            .await
+            .map_err(|error| map_store_error(error, "account concurrency"))?
+        {
+            return Err(AdminError::not_found("账号不存在"));
+        }
+        self.account_runtime
+            .account_concurrency(account_id.as_str(), u64::from(offset), page_size)
+            .await
+            .map_err(|error| map_store_error(error, "account concurrency"))
+    }
+
    async fn list(&self, query: AccountListQuery) -> Result<AccountDirectoryPage, AdminError> {
        let providers = &self.providers;
        let runtime = self
@@ -891,27 +954,48 @@ impl AccountsService for DefaultAccountsService {
            .map_err(|error| map_provider_error(error, "provider profile avatar"))
    }

+    async fn reset_credit_automation_status(
+        &self,
+        account_id: ProviderAccountId,
+    ) -> Result<crate::model::reset_credit_automation::ResetCreditAutomationStatus, AdminError>
+    {
+        self.automation_status(&account_id).await
+    }
+    async fn set_reset_credit_automation(
+        &self,
+        context: &MutationContext,
+        account_id: ProviderAccountId,
+        enabled: bool,
+    ) -> Result<crate::model::reset_credit_automation::ResetCreditAutomationStatus, AdminError>
+    {
+        self.configure_automation(context, &account_id, enabled)
+            .await
+    }
+    async fn reconcile_reset_credit_automation(
+        &self,
+        account_id: ProviderAccountId,
+    ) -> Result<(), AdminError> {
+        self.reconcile_automation(&account_id).await
+    }
+
    async fn reset_credits(
        &self,
        context: &MutationContext,
        account_id: ProviderAccountId,
    ) -> Result<ProviderResetCredits, AdminError> {
-        let (_, provider) = self.provider_for_account(&account_id).await?;
-        match provider.reset_credits(&account_id).await {
-            Ok(credits) => Ok(credits),
-            Err(error)
-                if error.kind()
-                    == crate::ports::provider::ProviderAdminErrorKind::CredentialRefreshRequired =>
-            {
-                self.refresh(context, account_id.clone()).await?;
-                let (_, provider) = self.provider_for_account(&account_id).await?;
-                provider
-                    .reset_credits(&account_id)
-                    .await
-                    .map_err(map_reset_credits_error_after_refresh)
-            }
-            Err(error) => Err(map_provider_error(error, "provider reset credits")),
+        let lock = self.reset_credit_lock(&account_id).await;
+        let _guard = lock.lock().await;
+        let credits = self
+            .reset_credits_upstream(context, account_id.clone())
+            .await?;
+        if let Err(error) = self.remember_reset_credits(&account_id, &credits).await {
+            tracing::warn!(
+                account_id = account_id.as_str(),
+                error_kind = error.kind().as_str(),
+                "保存重置卡计划失败"
+            );
        }
+        Ok(credits)
    }

    async fn consume_reset_credit(
@@ -919,27 +1003,26 @@ impl AccountsService for DefaultAccountsService {
        context: &MutationContext,
        command: ConsumeProviderResetCredit,
    ) -> Result<ProviderResetCreditResult, AdminError> {
-        let account_id = command.account_id.clone();
-        // 覆盖 credential refresh + 同键重试的完整账号级临界区，避免 401 两次调用
-        // 之间插入另一笔不可逆消费
-        let lock = self.reset_credit_lock(&account_id).await;
+        let lock = self.reset_credit_lock(&command.account_id).await;
        let _guard = lock.lock().await;
-        let (_, provider) = self.provider_for_account(&account_id).await?;
-        match provider.consume_reset_credit(command.clone()).await {
-            Ok(result) => Ok(result),
-            Err(error)
-                if error.kind()
-                    == crate::ports::provider::ProviderAdminErrorKind::CredentialRefreshRequired =>
-            {
-                self.refresh(context, account_id.clone()).await?;
-                let (_, provider) = self.provider_for_account(&account_id).await?;
-                provider
-                    .consume_reset_credit(command)
-                    .await
-                    .map_err(map_reset_credits_error_after_refresh)
-            }
-            Err(error) => Err(map_provider_error(error, "provider reset-credit consume")),
+        if self
+            .accounts
+            .reset_credit_automation(command.account_id.as_str())
+            .await
+            .map_err(|e| map_store_error(e, "reset-credit automation"))?
+            .is_some_and(|record| {
+                record
+                    .state
+                    .pending
+                    .is_some_and(|pending| pending.credit.expires_at > Utc::now())
+            })
+        {
+            return Err(AdminError::new(
+                crate::model::AdminErrorKind::Conflict,
+                "自动重置结果待确认，请稍后刷新",
+            ));
        }
+        self.consume_reset_credit_upstream(context, command).await
    }

    async fn models(
@@ -0,0 +1,513 @@
+//! 重置卡自动使用的账号锁、持久幂等键、查询缓存与重试编排
+
+use super::*;
+
+impl DefaultAccountsService {
+    pub(super) async fn reset_credits_upstream(
+        &self,
+        context: &MutationContext,
+        account_id: ProviderAccountId,
+    ) -> Result<ProviderResetCredits, AdminError> {
+        let (_, provider) = self.provider_for_account(&account_id).await?;
+        match provider.reset_credits(&account_id).await {
+            Ok(credits) => Ok(credits),
+            Err(error)
+                if error.kind()
+                    == crate::ports::provider::ProviderAdminErrorKind::CredentialRefreshRequired =>
+            {
+                self.refresh(context, account_id.clone()).await?;
+                let (_, provider) = self.provider_for_account(&account_id).await?;
+                provider
+                    .reset_credits(&account_id)
+                    .await
+                    .map_err(map_reset_credits_error_after_refresh)
+            }
+            Err(error) => Err(map_provider_error(error, "provider reset credits")),
+        }
+    }
+
+    pub(super) async fn consume_reset_credit_upstream(
+        &self,
+        context: &MutationContext,
+        command: ConsumeProviderResetCredit,
+    ) -> Result<ProviderResetCreditResult, AdminError> {
+        let account_id = command.account_id.clone();
+        let (_, provider) = self.provider_for_account(&account_id).await?;
+        match provider.consume_reset_credit(command.clone()).await {
+            Ok(result) => Ok(result),
+            Err(error)
+                if error.kind()
+                    == crate::ports::provider::ProviderAdminErrorKind::CredentialRefreshRequired =>
+            {
+                self.refresh(context, account_id.clone()).await?;
+                let (_, provider) = self.provider_for_account(&account_id).await?;
+                provider
+                    .consume_reset_credit(command)
+                    .await
+                    .map_err(map_reset_credits_error_after_refresh)
+            }
+            Err(error) => Err(map_provider_error(error, "provider reset-credit consume")),
+        }
+    }
+}
+
+use crate::{
+    model::{MutationActor, reset_credit_automation::*},
+    reset_credit_automation::{consume_at, next_consumption, next_discovery, reschedule},
+};
+use chrono::{DateTime, Utc};
+use rand_core::{OsRng, RngCore as _};
+
+impl DefaultAccountsService {
+    async fn automation_settings(
+        &self,
+    ) -> Result<crate::model::settings::RuntimeSettingsValues, AdminError> {
+        Ok(self
+            .settings
+            .load_runtime_settings()
+            .await
+            .map_err(|e| map_store_error(e, "runtime settings"))?
+            .values)
+    }
+
+    pub(super) async fn automation_status(
+        &self,
+        account_id: &ProviderAccountId,
+    ) -> Result<ResetCreditAutomationStatus, AdminError> {
+        self.require_reset_credit_automation(account_id).await?;
+        let lead_minutes = self.automation_settings().await?.reset_credit_lead_minutes;
+        let record = self
+            .accounts
+            .reset_credit_automation(account_id.as_str())
+            .await
+            .map_err(|e| map_store_error(e, "reset-credit automation"))?;
+        Ok(ResetCreditAutomationStatus {
+            enabled: record.as_ref().is_some_and(|r| r.enabled),
+            lead_minutes,
+            next_discovery_at: record
+                .as_ref()
+                .filter(|r| r.enabled)
+                .map(|r| r.state.next_discovery_at),
+            next_consume_at: record.as_ref().filter(|r| r.enabled).and_then(|r| {
+                next_consumption(r, lead_minutes)
+                    .or_else(|| {
+                        r.state
+                            .pending
+                            .as_ref()
+                            .map(|pending| consume_at(&r.account_id, &pending.credit, lead_minutes))
+                    })
+                    .map(|due| r.state.retry_at.map_or(due, |retry| due.max(retry)))
+            }),
+            last_result: record.and_then(|r| {
+                if r.state
+                    .pending
+                    .as_ref()
+                    .is_some_and(|pending| pending.credit.expires_at <= Utc::now())
+                {
+                    Some("expired_unknown".to_owned())
+                } else {
+                    r.state.last_result
+                }
+            }),
+        })
+    }
+
+    async fn require_reset_credit_automation(
+        &self,
+        account_id: &ProviderAccountId,
+    ) -> Result<bool, AdminError> {
+        let (stored, provider) = self.provider_for_account(account_id).await?;
+        let capabilities =
+            provider.account_capabilities(account_id, &stored.account.authentication_kind);
+        if !capabilities.reset_credits || !capabilities.consume_reset_credit {
+            return Err(AdminError::invalid("当前账号不支持自动重置卡"));
+        }
+        Ok(stored.account.enabled)
+    }
+
+    pub(super) async fn configure_automation(
+        &self,
+        context: &MutationContext,
+        account_id: &ProviderAccountId,
+        enabled: bool,
+    ) -> Result<ResetCreditAutomationStatus, AdminError> {
+        let lock = self.reset_credit_lock(account_id).await;
+        let _guard = lock.lock().await;
+        self.require_reset_credit_automation(account_id).await?;
+        let now = Utc::now();
+        let mut record = self
+            .accounts
+            .reset_credit_automation(account_id.as_str())
+            .await
+            .map_err(|e| map_store_error(e, "reset-credit automation"))?
+            .unwrap_or_else(|| ResetCreditAutomation {
+                account_id: account_id.as_str().to_owned(),
+                enabled: false,
+                revision: 0,
+                next_run_at: now,
+                state: ResetCreditAutomationState {
+                    next_discovery_at: now,
+                    credits: vec![],
+                    pending: None,
+                    retry_at: None,
+                    failures: 0,
+                    last_result: None,
+                },
+            });
+        if record.enabled != enabled {
+            record.enabled = enabled;
+            // 首次开启错开一分钟；重新开启保留已知到期时间及未决幂等键
+            if enabled && record.revision == 0 {
+                record.state.next_discovery_at =
+                    now + chrono::Duration::seconds(i64::from(OsRng.next_u32() % 60));
+            }
+            let lead = self.automation_settings().await?.reset_credit_lead_minutes;
+            reschedule(&mut record, lead, now);
+            self.save_automation(&mut record, Some(context)).await?;
+            let settings = self
+                .settings
+                .load_runtime_settings()
+                .await
+                .map_err(|e| map_store_error(e, "runtime settings"))?;
+            publish_committed(self.snapshot.as_ref(), settings.config_revision).await?;
+        }
+        self.automation_status(account_id).await
+    }
+
+    async fn save_automation(
+        &self,
+        record: &mut ResetCreditAutomation,
+        context: Option<&MutationContext>,
+    ) -> Result<(), AdminError> {
+        record.revision = self
+            .accounts
+            .save_reset_credit_automation(record, context)
+            .await
+            .map_err(|e| map_store_error(e, "reset-credit automation"))?;
+        Ok(())
+    }
+
+    fn observe_reset_credits(
+        &self,
+        record: &mut ResetCreditAutomation,
+        credits: &ProviderResetCredits,
+        now: DateTime<Utc>,
+    ) -> Result<(), AdminError> {
+        record.state.credits = credits
+            .credits
+            .iter()
+            .filter(|credit| credit.status.as_deref() == Some("available"))
+            .filter_map(|credit| {
+                credit
+                    .expires_at
+                    .filter(|expiry| *expiry > now)
+                    .map(|expires_at| PlannedResetCredit {
+                        id: credit.id.clone(),
+                        expires_at,
+                    })
+            })
+            .collect();
+        record.state.credits.sort_by_key(|credit| credit.expires_at);
+        record.state.credits.dedup_by(|a, b| a.id == b.id);
+        if record.state.next_discovery_at <= now
+            || self
+                .timezone
+                .local(record.state.next_discovery_at)
+                .date_naive()
+                == self.timezone.local(now).date_naive()
+        {
+            record.state.next_discovery_at =
+                next_discovery(now, self.timezone, OsRng.next_u64())
+                    .ok_or_else(|| AdminError::internal("无法计算重置卡发现时间"))?;
+        }
+        if record.state.pending.is_none() {
+            record.state.retry_at = None;
+            record.state.failures = 0;
+        }
+        Ok(())
+    }
+
+    pub(super) async fn remember_reset_credits(
+        &self,
+        account_id: &ProviderAccountId,
+        credits: &ProviderResetCredits,
+    ) -> Result<(), AdminError> {
+        let Some(mut record) = self
+            .accounts
+            .reset_credit_automation(account_id.as_str())
+            .await
+            .map_err(|e| map_store_error(e, "reset-credit automation"))?
+        else {
+            return Ok(());
+        };
+        if !record.enabled {
+            return Ok(());
+        }
+        let now = Utc::now();
+        self.observe_reset_credits(&mut record, credits, now)?;
+        reschedule(
+            &mut record,
+            self.automation_settings().await?.reset_credit_lead_minutes,
+            now,
+        );
+        self.save_automation(&mut record, None).await
+    }
+
+    async fn automation_failed(
+        &self,
+        record: &mut ResetCreditAutomation,
+        lead: u32,
+        now: DateTime<Utc>,
+    ) -> Result<(), AdminError> {
+        if record.state.pending.is_none()
+            && !next_consumption(record, lead).is_some_and(|due| due <= now)
+        {
+            record.state.next_discovery_at =
+                next_discovery(now, self.timezone, OsRng.next_u64())
+                    .ok_or_else(|| AdminError::internal("无法计算重置卡发现时间"))?;
+            record.state.retry_at = None;
+            record.state.last_result = Some("discovery_failed".to_owned());
+            reschedule(record, lead, now);
+            return self.save_automation(record, None).await;
+        }
+        record.state.failures = record.state.failures.saturating_add(1);
+        let delay = (30_i64 * 2_i64.pow(record.state.failures.min(4) - 1)).min(300)
+            + i64::from(OsRng.next_u32() % 30);
+        record.state.retry_at = Some(now + chrono::Duration::seconds(delay));
+        record.state.last_result = Some(
+            if record.state.pending.is_some() {
+                "pending"
+            } else {
+                "discovery_failed"
+            }
+            .to_owned(),
+        );
+        reschedule(record, lead, now);
+        self.save_automation(record, None).await
+    }
+
+    /// 暂不满足条件不丢弃卡片，也不创建未决消费，允许到期前再次判断
+    async fn defer_automation(
+        &self,
+        record: &mut ResetCreditAutomation,
+        lead: u32,
+        reason: &str,
+    ) -> Result<(), AdminError> {
+        let now = Utc::now();
+        let retry = now + chrono::Duration::seconds(30 + i64::from(OsRng.next_u32() % 30));
+        record.state.retry_at = Some(
+            record
+                .state
+                .credits
+                .iter()
+                .map(|credit| credit.expires_at)
+                .min()
+                .map_or(retry, |expiry| retry.min(expiry)),
+        );
+        record.state.last_result = Some(reason.to_owned());
+        record.state.failures = 0;
+        reschedule(record, lead, now);
+        self.save_automation(record, None).await
+    }
+
+    async fn weekly_reset_credit_gate(
+        &self,
+        account_id: &ProviderAccountId,
+        max_remaining: u32,
+    ) -> Result<Option<&'static str>, AdminError> {
+        let (_, provider) = self.provider_for_account(account_id).await?;
+        let quota = provider
+            .quota(ProviderQuotaRequest {
+                account_id: account_id.clone(),
+                refresh: true,
+                rolling_usage: None,
+            })
+            .await
+            .map_err(|error| map_provider_error(error, "reset-credit weekly quota"))?;
+        // 复用账号周窗口归属，不把短期、月度或模型专属桶当作剩余周额度
+        let remaining = quota
+            .usage_windows()
+            .find(|(_, period)| *period == AccountUsagePeriod::Weekly)
+            .and_then(|(window, _)| window.used_percent)
+            .filter(|used| used.is_finite())
+            .map(|used| 100.0 - used.clamp(0.0, 100.0));
+        Ok(match remaining {
+            Some(remaining) if remaining > f64::from(max_remaining) => {
+                Some("weekly_quota_above_threshold")
+            }
+            Some(_) => None,
+            None => Some("weekly_quota_unavailable"),
+        })
+    }
+
+    pub(super) async fn reconcile_automation(
+        &self,
+        account_id: &ProviderAccountId,
+    ) -> Result<(), AdminError> {
+        let lock = self.reset_credit_lock(account_id).await;
+        let _guard = lock.lock().await;
+        let Some(mut record) = self
+            .accounts
+            .reset_credit_automation(account_id.as_str())
+            .await
+            .map_err(|e| map_store_error(e, "reset-credit automation"))?
+        else {
+            return Ok(());
+        };
+        if !record.enabled {
+            return Ok(());
+        }
+        match self.require_reset_credit_automation(account_id).await {
+            Ok(true) => {}
+            Ok(false) => return Ok(()),
+            Err(error) => {
+                record.next_run_at = next_discovery(Utc::now(), self.timezone, OsRng.next_u64())
+                    .ok_or_else(|| AdminError::internal("无法计算重置卡发现时间"))?;
+                self.save_automation(&mut record, None).await?;
+                return Err(error);
+            }
+        }
+        let now = Utc::now();
+        let settings = self.automation_settings().await?;
+        let lead = settings.reset_credit_lead_minutes;
+        record
+            .state
+            .credits
+            .retain(|credit| credit.expires_at > now);
+        if record
+            .state
+            .pending
+            .as_ref()
+            .is_some_and(|pending| pending.credit.expires_at <= now)
+        {
+            record.state.pending = None;
+            record.state.retry_at = None;
+            record.state.last_result = Some("expired_unknown".to_owned());
+        }
+        if record.state.retry_at.is_some_and(|retry| retry > now) {
+            reschedule(&mut record, lead, now);
+            return self.save_automation(&mut record, None).await;
+        }
+        let context = MutationContext {
+            actor: MutationActor::System,
+            request_id: "reset-credit-automation".to_owned(),
+        };
+        let due_credit = next_consumption(&record, lead).is_some_and(|due| due <= now);
+        if record.state.pending.is_none()
+            && (due_credit
+                || record.state.next_discovery_at <= now
+                || record.state.retry_at.is_some())
+        {
+            // 先保存下一次发现，查询被取消或进程重启也不会重复刷普通发现接口
+            if record.state.next_discovery_at <= now {
+                record.state.next_discovery_at =
+                    next_discovery(now, self.timezone, OsRng.next_u64())
+                        .ok_or_else(|| AdminError::internal("无法计算重置卡发现时间"))?;
+            }
+            if due_credit || record.state.retry_at.is_some() {
+                record.state.retry_at = Some(now + chrono::Duration::seconds(30));
+            }
+            reschedule(&mut record, lead, now);
+            self.save_automation(&mut record, None).await?;
+            // 真正消费前重新核对卡片；每日发现结果也可直接承担本次核对
+            match self
+                .reset_credits_upstream(&context, account_id.clone())
+                .await
+            {
+                Ok(credits) => self.observe_reset_credits(&mut record, &credits, Utc::now())?,
+                Err(error) => {
+                    self.automation_failed(&mut record, lead, Utc::now())
+                        .await?;
+                    return Err(error);
+                }
+            }
+            if let Some(credit) = record
+                .state
+                .credits
+                .iter()
+                .find(|credit| consume_at(account_id.as_str(), credit, lead) <= Utc::now())
+                .cloned()
+            {
+                if let Some(max_remaining) = settings.reset_credit_max_weekly_remaining_percent {
+                    // 已发出的未决请求跳过此检查，继续沿原幂等键确认结果
+                    match self
+                        .weekly_reset_credit_gate(account_id, max_remaining)
+                        .await
+                    {
+                        Ok(Some(reason)) => {
+                            return self.defer_automation(&mut record, lead, reason).await;
+                        }
+                        Ok(None) => {}
+                        Err(error) => {
+                            self.defer_automation(&mut record, lead, "weekly_quota_unavailable")
+                                .await?;
+                            return Err(error);
+                        }
+                    }
+                }
+                // 刷新额度期间卡片可能到期，不能把已过期卡片持久化为待消费
+                if credit.expires_at <= Utc::now() {
+                    record
+                        .state
+                        .credits
+                        .retain(|credit| credit.expires_at > Utc::now());
+                    reschedule(&mut record, lead, Utc::now());
+                    return self.save_automation(&mut record, None).await;
+                }
+                record.state.pending = Some(PendingResetCredit {
+                    credit,
+                    redeem_request_id: uuid::Uuid::new_v4().to_string(),
+                });
+                record.state.last_result = Some("pending".to_owned());
+                record.state.retry_at = Some(Utc::now() + chrono::Duration::seconds(30));
+                reschedule(&mut record, lead, Utc::now());
+                // 必须在发送消费请求前落盘，进程退出或响应丢失继续使用相同幂等键
+                self.save_automation(&mut record, None).await?;
+            }
+        }
+        let Some(pending) = record.state.pending.clone() else {
+            reschedule(&mut record, lead, Utc::now());
+            return self.save_automation(&mut record, None).await;
+        };
+        let command = ConsumeProviderResetCredit {
+            account_id: account_id.clone(),
+            credit_id: Some(pending.credit.id.clone()),
+            redeem_request_id: uuid::Uuid::parse_str(&pending.redeem_request_id)
+                .map_err(|_| AdminError::internal("重置卡幂等键不合法"))?,
+        };
+        match self.consume_reset_credit_upstream(&context, command).await {
+            Ok(result) => {
+                let confirmed = matches!(result.code.as_str(), "reset" | "already_redeemed");
+                record.state.pending = None;
+                if result.code == "nothing_to_reset" {
+                    return self
+                        .defer_automation(&mut record, lead, "nothing_to_reset")
+                        .await;
+                }
+                record
+                    .state
+                    .credits
+                    .retain(|credit| credit.id != pending.credit.id);
+                record.state.retry_at = None;
+                record.state.failures = 0;
+                record.state.last_result = Some(if confirmed {
+                    result.code
+                } else {
+                    "not_redeemed".to_owned()
+                });
+                reschedule(&mut record, lead, Utc::now());
+                // 已确认的结果先落盘，再刷新额度；观测失败不能重放已完成的消费
+                self.save_automation(&mut record, None).await?;
+                if confirmed {
+                    let _ = self.quota(account_id, true).await;
+                }
+            }
+            Err(error) => {
+                self.automation_failed(&mut record, lead, Utc::now())
+                    .await?;
+                return Err(error);
+            }
+        }
+        Ok(())
+    }
+}
@@ -0,0 +1,139 @@
+//! 控制面认证端口、会话策略与访问和续期共用的身份校验
+
+use std::{net::IpAddr, sync::Arc};
+
+use async_trait::async_trait;
+use base64::{Engine as _, engine::general_purpose::URL_SAFE_NO_PAD};
+use chrono::{Duration, Utc};
+use gateway_core::engine::execution::ClientKeyVerifier;
+use sha2::{Digest as _, Sha256};
+
+use super::map_store_error;
+use crate::{
+    model::{
+        AdminError,
+        auth::{
+            AuthSession, ChangePassword, LoginCommand, LoginError, SessionGrant, SessionSubject,
+        },
+    },
+    ports::store::AuthStore,
+};
+
+mod service;
+mod session;
+
+/// 所有控制面接口消费同一个会话服务，权限由服务端身份决定
+#[async_trait]
+pub trait AuthService: Send + Sync {
+    async fn change_password(
+        &self,
+        session_id: Option<&str>,
+        command: ChangePassword,
+        source_ip: IpAddr,
+    ) -> Result<(), AdminError>;
+    async fn ensure_default_admin(&self, password: &str) -> Result<bool, AdminError>;
+    async fn session(&self, session_id: Option<&str>) -> Result<Option<AuthSession>, AdminError>;
+    async fn renew_session(
+        &self,
+        refresh_token: Option<&str>,
+        access_token: Option<&str>,
+    ) -> Result<Option<SessionGrant>, AdminError>;
+    async fn resolve_admin_user_id(
+        &self,
+        session_id: Option<&str>,
+    ) -> Result<Option<String>, AdminError>;
+    async fn verify_admin_api_key(&self, key: &str) -> Result<bool, AdminError>;
+    async fn login(
+        &self,
+        command: LoginCommand,
+        source_ip: IpAddr,
+        previous_session_id: Option<&str>,
+    ) -> Result<SessionGrant, LoginError>;
+    async fn logout(&self, session_id: &str) -> Result<(), AdminError>;
+}
+
+const MAX_SESSION_TTL_MINUTES: i64 = 366 * 24 * 60;
+
+pub(crate) struct DefaultAuthService {
+    default_admin_user_id: String,
+    admin_access_ttl: Duration,
+    admin_session_ttl: Duration,
+    admin_session_absolute_ttl: Duration,
+    key_session_ttl: Duration,
+    store: Arc<dyn AuthStore>,
+    verifier: Arc<dyn ClientKeyVerifier>,
+}
+
+impl DefaultAuthService {
+    #[must_use]
+    pub(crate) fn new(
+        config: &crate::AdminConfig,
+        key_session_ttl_minutes: u64,
+        store: Arc<dyn AuthStore>,
+        verifier: Arc<dyn ClientKeyVerifier>,
+    ) -> Self {
+        let admin_session_ttl = session_ttl(config.session_ttl_minutes);
+        Self {
+            default_admin_user_id: config.default_username.clone(),
+            // 访问凭据最多有效 24 小时，较短的不活动期限也要留出续期窗口
+            admin_access_ttl: Duration::hours(24).min(admin_session_ttl / 4),
+            admin_session_ttl,
+            admin_session_absolute_ttl: session_ttl(config.session_absolute_ttl_minutes),
+            key_session_ttl: session_ttl(key_session_ttl_minutes),
+            store,
+            verifier,
+        }
+    }
+
+    async fn load_live_session(&self, id: &str) -> Result<Option<AuthSession>, AdminError> {
+        let Some(session) = self
+            .store
+            .load_session(id)
+            .await
+            .map_err(|error| map_store_error(error, "authentication session"))?
+        else {
+            return Ok(None);
+        };
+        if session.retained_until() <= Utc::now()
+            || session
+                .absolute_expires_at
+                .is_some_and(|expiry| expiry <= Utc::now())
+        {
+            return Ok(None);
+        }
+        let valid = match &session.subject {
+            SessionSubject::Admin {
+                admin_user_id,
+                credential_fingerprint,
+            } => self
+                .store
+                .load_password_hash(admin_user_id)
+                .await
+                .map_err(|error| map_store_error(error, "administrator session"))?
+                .is_some_and(|hash| password_fingerprint(&hash) == *credential_fingerprint),
+            SessionSubject::Key { client_key_id } => self
+                .store
+                .client_key_enabled(client_key_id)
+                .await
+                .map_err(|error| map_store_error(error, "session key"))?,
+        };
+        if !valid {
+            let _ = self.store.delete_session(id).await;
+            return Ok(None);
+        }
+        Ok(Some(session))
+    }
+}
+
+fn session_ttl(minutes: u64) -> Duration {
+    Duration::minutes(
+        i64::try_from(minutes)
+            .unwrap_or(MAX_SESSION_TTL_MINUTES)
+            .clamp(1, MAX_SESSION_TTL_MINUTES),
+    )
+}
+
+// 指纹只绑定已加盐的密码哈希，不把密码或原始哈希复制到 Redis 会话
+fn password_fingerprint(password_hash: &str) -> String {
+    URL_SAFE_NO_PAD.encode(Sha256::digest(password_hash.as_bytes()))
+}
@@ -1,86 +1,35 @@
-//! 控制面登录、会话恢复与身份校验的唯一 owner
+//! 管理员和 Key 的登录、退出、密码策略与会话访问

-use std::{net::IpAddr, sync::Arc, time::Duration as StdDuration};
+use std::{net::IpAddr, time::Duration as StdDuration};

 use argon2::{Argon2, PasswordHash, PasswordHasher, PasswordVerifier};
 use async_trait::async_trait;
 use base64::{Engine as _, engine::general_purpose::URL_SAFE_NO_PAD};
-use chrono::{Duration, Utc};
-use gateway_core::engine::execution::ClientKeyVerifier;
+use chrono::Utc;
 use rand_core::{OsRng, RngCore as _};
-use sha2::{Digest, Sha256};
 use subtle::ConstantTimeEq as _;
 use uuid::Uuid;

+use super::{
+    AuthService, DefaultAuthService, password_fingerprint,
+    session::{self, Credential, storage_id},
+};
 use crate::{
    model::{
        AdminError, AdminErrorKind,
        auth::{
            AdminAuditEvent, AuditActorKind, AuthSession, ChangePassword, LoginCommand, LoginError,
-            LoginResult, SessionSubject,
+            SessionGrant, SessionSubject,
        },
    },
-    ports::store::AuthStore,
+    use_case::map_store_error,
 };

-use super::map_store_error;
-
-/// 所有控制面接口消费同一个会话服务，权限由服务端身份决定
-#[async_trait]
-pub trait AuthService: Send + Sync {
-    async fn change_password(
-        &self,
-        session_id: Option<&str>,
-        command: ChangePassword,
-        source_ip: IpAddr,
-    ) -> Result<(), AdminError>;
-    async fn ensure_default_admin(&self, password: &str) -> Result<bool, AdminError>;
-    async fn session(&self, session_id: Option<&str>) -> Result<Option<AuthSession>, AdminError>;
-    async fn resolve_admin_user_id(
-        &self,
-        session_id: Option<&str>,
-    ) -> Result<Option<String>, AdminError>;
-    async fn verify_admin_api_key(&self, key: &str) -> Result<bool, AdminError>;
-    async fn login(
-        &self,
-        command: LoginCommand,
-        source_ip: IpAddr,
-        previous_session_id: Option<&str>,
-    ) -> Result<LoginResult, LoginError>;
-    async fn logout(&self, session_id: &str) -> Result<(), AdminError>;
-}
-
-const MAX_SESSION_TTL_MINUTES: i64 = 366 * 24 * 60;
 const LOGIN_WINDOW: StdDuration = StdDuration::from_secs(60);
 const LOGIN_ATTEMPTS_PER_SOURCE: u32 = 10;
 const LOGIN_ATTEMPTS_GLOBAL: u32 = 200;

-pub(crate) struct DefaultAuthService {
-    default_admin_user_id: String,
-    admin_session_ttl: Duration,
-    key_session_ttl: Duration,
-    store: Arc<dyn AuthStore>,
-    verifier: Arc<dyn ClientKeyVerifier>,
-}
-
 impl DefaultAuthService {
-    #[must_use]
-    pub(crate) fn new(
-        default_admin_user_id: impl Into<String>,
-        admin_session_ttl_minutes: u64,
-        key_session_ttl_minutes: u64,
-        store: Arc<dyn AuthStore>,
-        verifier: Arc<dyn ClientKeyVerifier>,
-    ) -> Self {
-        Self {
-            default_admin_user_id: default_admin_user_id.into(),
-            admin_session_ttl: session_ttl(admin_session_ttl_minutes),
-            key_session_ttl: session_ttl(key_session_ttl_minutes),
-            store,
-            verifier,
-        }
-    }
-
    fn auth_audit(&self, action: &str, admin_user_id: &str) -> AdminAuditEvent {
        AdminAuditEvent {
            id: format!("audit_{}", Uuid::now_v7().simple()),
@@ -221,51 +170,51 @@ impl AuthService for DefaultAuthService {
    }

    async fn session(&self, session_id: Option<&str>) -> Result<Option<AuthSession>, AdminError> {
-        let Some(session_id) = session_id.filter(|value| !value.is_empty()) else {
+        let Some(raw) = session_id.filter(|value| !value.is_empty()) else {
            return Ok(None);
        };
-        let Some(session) = self
-            .store
-            .load_session(session_id)
-            .await
-            .map_err(|error| map_store_error(error, "authentication session"))?
-        else {
+        let Some(session) = self.load_live_session(storage_id(raw)).await? else {
            return Ok(None);
        };
        if session.expires_at <= Utc::now() {
-            let _ = self.store.delete_session(session_id).await;
            return Ok(None);
        }
-        if let SessionSubject::Admin {
-            admin_user_id,
-            credential_fingerprint,
-        } = &session.subject
-        {
-            let password_hash = self
-                .store
-                .load_password_hash(admin_user_id)
-                .await
-                .map_err(|error| map_store_error(error, "administrator session"))?;
-            if password_hash
-                .is_none_or(|hash| password_fingerprint(&hash) != *credential_fingerprint)
-            {
-                let _ = self.store.delete_session(session_id).await;
+        if let Some(renewal) = &session.renewal {
+            let Some(credential) = Credential::parse(raw).filter(|value| !value.refresh) else {
+                return Ok(None);
+            };
+            if !credential.owns(renewal) {
                return Ok(None);
            }
-        }
-        if let SessionSubject::Key { client_key_id } = &session.subject
-            && !self
-                .store
-                .client_key_enabled(client_key_id)
-                .await
-                .map_err(|error| map_store_error(error, "session key"))?
-        {
-            let _ = self.store.delete_session(session_id).await;
+        } else if Credential::parse(raw).is_some() {
            return Ok(None);
        }
        Ok(Some(session))
    }

+    async fn renew_session(
+        &self,
+        refresh_token: Option<&str>,
+        access_token: Option<&str>,
+    ) -> Result<Option<SessionGrant>, AdminError> {
+        if let Some(refresh) = refresh_token {
+            return self.refresh(refresh).await;
+        }
+        // Key 与升级前的单凭据仅返回仍有效的原会话，不授予新的续期能力
+        let Some(session) = self
+            .session(access_token)
+            .await?
+            .filter(|session| session.renewal.is_none())
+        else {
+            return Ok(None);
+        };
+        Ok(Some(SessionGrant {
+            session_id: access_token.unwrap_or_default().to_owned(),
+            refresh_token: None,
+            session,
+        }))
+    }
+
    async fn resolve_admin_user_id(
        &self,
        session_id: Option<&str>,
@@ -304,7 +253,7 @@ impl AuthService for DefaultAuthService {
        command: LoginCommand,
        source_ip: IpAddr,
        previous_session_id: Option<&str>,
-    ) -> Result<LoginResult, LoginError> {
+    ) -> Result<SessionGrant, LoginError> {
        if let Some(retry_after) = self
            .store
            .consume_login_attempt(
@@ -325,13 +274,34 @@ impl AuthService for DefaultAuthService {
            SessionSubject::Admin { .. } => self.admin_session_ttl,
            SessionSubject::Key { .. } => self.key_session_ttl,
        };
-        let session = AuthSession {
-            subject,
-            expires_at: Utc::now() + ttl,
+        let now = Utc::now();
+        let absolute_expires_at = matches!(subject, SessionSubject::Admin { .. })
+            .then_some(now + self.admin_session_absolute_ttl);
+        let refresh_expiry = (now + ttl).min(absolute_expires_at.unwrap_or(now + ttl));
+        let grant = if let Some(absolute) = absolute_expires_at {
+            session::issue(
+                subject,
+                (now + self.admin_access_ttl).min(refresh_expiry),
+                refresh_expiry,
+                absolute,
+            )
+            .map_err(|_| LoginError::Unavailable)?
+        } else {
+            SessionGrant {
+                session_id: random_session_token(),
+                refresh_token: None,
+                session: AuthSession {
+                    subject,
+                    expires_at: refresh_expiry,
+                    absolute_expires_at: None,
+                    renewal: None,
+                },
+            }
        };
-        let session_id = random_session_token();
+        let session_id = storage_id(&grant.session_id);
+        let session = &grant.session;
        self.store
-            .store_session(&session_id, &session)
+            .store_session(session_id, session)
            .await
            .map_err(|_| LoginError::Unavailable)?;
        if let SessionSubject::Admin { admin_user_id, .. } = &session.subject
@@ -341,26 +311,39 @@ impl AuthService for DefaultAuthService {
                .await
                .is_err()
        {
-            let _ = self.store.delete_session(&session_id).await;
+            let _ = self.store.delete_session(session_id).await;
            return Err(LoginError::Unavailable);
        }
        // 新身份验证成功后才撤销旧会话；撤销失败时不向浏览器提交新会话
        if let Some(previous) = previous_session_id.filter(|value| !value.is_empty())
            && self.logout(previous).await.is_err()
        {
-            let _ = self.store.delete_session(&session_id).await;
+            let _ = self.store.delete_session(session_id).await;
            return Err(LoginError::Unavailable);
        }
-        Ok(LoginResult {
-            session_id,
-            session,
-        })
+        Ok(grant)
    }

    async fn logout(&self, session_id: &str) -> Result<(), AdminError> {
+        let id = storage_id(session_id);
+        let Some(stored) = self
+            .store
+            .load_session(id)
+            .await
+            .map_err(|error| map_store_error(error, "authentication session"))?
+        else {
+            return Ok(());
+        };
+        if let Some(renewal) = &stored.renewal {
+            if !Credential::parse(session_id).is_some_and(|credential| credential.owns(renewal)) {
+                return Ok(());
+            }
+        } else if Credential::parse(session_id).is_some() {
+            return Ok(());
+        }
        let session = self
            .store
-            .delete_session(session_id)
+            .delete_session(id)
            .await
            .map_err(|error| map_store_error(error, "authentication session"))?;
        if let Some(AuthSession {
@@ -377,14 +360,6 @@ impl AuthService for DefaultAuthService {
    }
 }

-fn session_ttl(minutes: u64) -> Duration {
-    Duration::minutes(
-        i64::try_from(minutes)
-            .unwrap_or(MAX_SESSION_TTL_MINUTES)
-            .clamp(1, MAX_SESSION_TTL_MINUTES),
-    )
-}
-
 fn validate_new_password(password: &str) -> Result<(), AdminError> {
    if password.trim().chars().count() < 12
        || password.len() > 1024
@@ -424,8 +399,3 @@ fn valid_admin_api_key_shape(value: &str) -> bool {
        && value.starts_with("admin-")
        && value[6..].bytes().all(|byte| byte.is_ascii_hexdigit())
 }
-
-// 指纹只绑定已加盐的密码哈希，不把密码或原始哈希复制到 Redis 会话
-fn password_fingerprint(password_hash: &str) -> String {
-    URL_SAFE_NO_PAD.encode(Sha256::digest(password_hash.as_bytes()))
-}
@@ -0,0 +1,214 @@
+//! 双凭据会话的签发、摘要校验与短窗口重试，不持久化可直接使用的凭据
+
+use base64::{Engine as _, engine::general_purpose::URL_SAFE_NO_PAD};
+use chrono::{DateTime, Duration, Utc};
+use rand_core::{OsRng, RngCore as _};
+use sha2::{Digest as _, Sha256};
+use subtle::ConstantTimeEq as _;
+
+use super::DefaultAuthService;
+use crate::{
+    model::{
+        AdminError, AdminErrorKind,
+        auth::{AuthSession, SessionGrant, SessionRefreshReplay, SessionRenewal, SessionSubject},
+    },
+    use_case::map_store_error,
+};
+
+const REPLAY_WINDOW: Duration = Duration::seconds(30);
+
+pub(super) struct Credential<'a> {
+    pub id: &'a str,
+    pub secret: &'a str,
+    pub refresh: bool,
+}
+
+impl<'a> Credential<'a> {
+    pub fn parse(value: &'a str) -> Option<Self> {
+        let mut parts = value.split('.');
+        let refresh = match parts.next()? {
+            "a2" => false,
+            "r2" => true,
+            _ => return None,
+        };
+        let id = parts.next()?;
+        let secret = parts.next()?;
+        if parts.next().is_some() || !valid_secret(id) || !valid_secret(secret) {
+            return None;
+        }
+        Some(Self {
+            id,
+            secret,
+            refresh,
+        })
+    }
+
+    pub fn digest(&self) -> [u8; 32] {
+        digest(self.secret)
+    }
+
+    pub fn owns(&self, renewal: &SessionRenewal) -> bool {
+        if self.refresh {
+            matches_digest(&renewal.refresh_digest, &self.digest())
+                || renewal
+                    .previous
+                    .as_ref()
+                    .is_some_and(|previous| matches_digest(&previous.digest, &self.digest()))
+        } else {
+            matches_digest(&renewal.access_digest, &self.digest())
+        }
+    }
+}
+
+fn valid_secret(value: &str) -> bool {
+    value.len() == 43
+        && URL_SAFE_NO_PAD
+            .decode(value)
+            .is_ok_and(|bytes| bytes.len() == 32)
+}
+
+pub(super) fn storage_id(value: &str) -> &str {
+    Credential::parse(value).map_or(value, |credential| credential.id)
+}
+
+fn matches_digest(left: &[u8; 32], right: &[u8; 32]) -> bool {
+    bool::from(left.ct_eq(right))
+}
+
+fn digest(secret: &str) -> [u8; 32] {
+    Sha256::digest(secret.as_bytes()).into()
+}
+
+fn random_bytes() -> [u8; 32] {
+    let mut bytes = [0; 32];
+    OsRng.fill_bytes(&mut bytes);
+    bytes
+}
+
+// 使用标准 HKDF 的独立用途标签；只有盐和摘要留在 Store，重试仍须持有原始凭据
+fn derive(secret: &str, salt: Option<&[u8]>, purpose: &[u8]) -> Result<String, AdminError> {
+    let mut output = [0; 32];
+    hkdf::Hkdf::<Sha256>::new(salt, secret.as_bytes())
+        .expand(purpose, &mut output)
+        .map_err(|_| AdminError::internal("会话凭据派生失败"))?;
+    Ok(URL_SAFE_NO_PAD.encode(output))
+}
+
+fn access_secret(refresh: &str) -> Result<String, AdminError> {
+    derive(refresh, None, b"cpr-session-v2/access")
+}
+
+pub(super) fn issue(
+    subject: SessionSubject,
+    access_expiry: DateTime<Utc>,
+    refresh_expiry: DateTime<Utc>,
+    absolute: DateTime<Utc>,
+) -> Result<SessionGrant, AdminError> {
+    let id = URL_SAFE_NO_PAD.encode(random_bytes());
+    let secret = URL_SAFE_NO_PAD.encode(random_bytes());
+    let session = AuthSession {
+        subject,
+        expires_at: access_expiry,
+        absolute_expires_at: Some(absolute),
+        renewal: Some(SessionRenewal {
+            expires_at: refresh_expiry,
+            access_digest: digest(&access_secret(&secret)?),
+            refresh_digest: digest(&secret),
+            previous: None,
+        }),
+    };
+    grant(&id, &secret, session)
+}
+
+fn grant(id: &str, refresh: &str, session: AuthSession) -> Result<SessionGrant, AdminError> {
+    Ok(SessionGrant {
+        session_id: format!("a2.{id}.{}", access_secret(refresh)?),
+        refresh_token: Some(format!("r2.{id}.{refresh}")),
+        session,
+    })
+}
+
+impl DefaultAuthService {
+    pub(super) async fn refresh(&self, raw: &str) -> Result<Option<SessionGrant>, AdminError> {
+        let Some(credential) = Credential::parse(raw).filter(|value| value.refresh) else {
+            return Ok(None);
+        };
+        let mut current = self.load_live_session(credential.id).await?;
+        // CAS 冲突只重新解释同一请求的凭据，不对并发退出进行补建
+        for _ in 0..3 {
+            let Some(session) = current else {
+                return Ok(None);
+            };
+            let Some(renewal) = &session.renewal else {
+                return Ok(None);
+            };
+            let now = Utc::now();
+            if session.retained_until() <= now
+                || session.absolute_expires_at.is_none_or(|limit| limit <= now)
+            {
+                return Ok(None);
+            }
+            if matches_digest(&renewal.refresh_digest, &credential.digest()) {
+                // 其他标签页已经刷新或客户端重试时复用当前代，避免 Cookie 响应相互覆盖
+                if session.expires_at > now {
+                    return grant(credential.id, credential.secret, session).map(Some);
+                }
+                let absolute = session
+                    .absolute_expires_at
+                    .ok_or_else(|| AdminError::internal("缺少会话最长有效期"))?;
+                let salt = random_bytes();
+                let next_secret =
+                    derive(credential.secret, Some(&salt), b"cpr-session-v2/refresh")?;
+                let refresh_expiry = (now + self.admin_session_ttl).min(absolute);
+                let access_expiry = (now + self.admin_access_ttl).min(refresh_expiry);
+                let replacement = AuthSession {
+                    expires_at: access_expiry,
+                    renewal: Some(SessionRenewal {
+                        expires_at: refresh_expiry,
+                        access_digest: digest(&access_secret(&next_secret)?),
+                        refresh_digest: digest(&next_secret),
+                        previous: Some(SessionRefreshReplay {
+                            digest: credential.digest(),
+                            salt,
+                            expires_at: (now + REPLAY_WINDOW).min(access_expiry),
+                        }),
+                    }),
+                    ..session.clone()
+                };
+                current = self
+                    .store
+                    .compare_exchange_session(credential.id, &session, Some(&replacement))
+                    .await
+                    .map_err(|error| map_store_error(error, "authentication session rotation"))?;
+                if current.as_ref() == Some(&replacement) {
+                    return grant(credential.id, &next_secret, replacement).map(Some);
+                }
+            } else if let Some(previous) = renewal
+                .previous
+                .as_ref()
+                .filter(|previous| matches_digest(&previous.digest, &credential.digest()))
+            {
+                if previous.expires_at > now {
+                    let secret = derive(
+                        credential.secret,
+                        Some(&previous.salt),
+                        b"cpr-session-v2/refresh",
+                    )?;
+                    return grant(credential.id, &secret, session).map(Some);
+                }
+                // 已知上一代在重试窗口外再次使用，原子撤销整个会话
+                current = self
+                    .store
+                    .compare_exchange_session(credential.id, &session, None)
+                    .await
+                    .map_err(|error| map_store_error(error, "authentication session revocation"))?;
+            } else {
+                return Ok(None);
+            }
+        }
+        Err(AdminError::new(
+            AdminErrorKind::Unavailable,
+            "会话正在变更，请重试",
+        ))
+    }
+}
@@ -157,6 +157,8 @@ impl ClientKeyService for DefaultClientKeyService {
        context: &MutationContext,
        command: CreateClientKey,
    ) -> Result<CreatedClientKey, AdminError> {
+        crate::model::client_keys::validate_group_ids(&command.group_ids)
+            .map_err(|_| AdminError::invalid("Client API Key 分组不合法"))?;
        for (provider, profile) in &command.request_profile_overrides {
            self.providers
                .require(provider)
@@ -199,6 +201,8 @@ impl ClientKeyService for DefaultClientKeyService {
        context: &MutationContext,
        command: UpdateClientKey,
    ) -> Result<ClientKeyMutation, AdminError> {
+        crate::model::client_keys::validate_group_ids(&command.group_ids)
+            .map_err(|_| AdminError::invalid("Client API Key 分组不合法"))?;
        for (provider, profile) in &command.request_profile_override_updates {
            if let Some(profile) = profile {
                self.providers
@@ -0,0 +1,375 @@
+//! 凭据变更共享的绑定校验、事务结算、失效与提交后观察
+
+use crate::{
+    model::{
+        AdminError, MutationContext,
+        accounts::DeleteAccounts,
+        provider_credentials::{
+            AuthorizationMutationTarget, CredentialDeletion, CredentialDeletionResult,
+            CredentialDetails, CredentialMutationResult, CredentialRotationCommit,
+            PendingAuthorizationMutation, PreparedAuthorizationCommit,
+            PreparedAuthorizationCredential, PreparedCredentialImport, PreparedCredentialRotation,
+            ProviderQuotaRequest, StartAuthorization,
+        },
+    },
+    ports::{provider::ProviderAdmin, store::AccountStore},
+};
+use gateway_core::{account::ProviderAccountId, routing::ProviderKind, runtime::SnapshotControl};
+
+use super::{map_store_error, publish_committed};
+
+pub(super) async fn publish_credentials_and_observe_quota(
+    provider: &std::sync::Arc<dyn crate::ports::provider::ProviderAdmin>,
+    snapshot: &dyn SnapshotControl,
+    revision: crate::model::Revision,
+    account_ids: &[ProviderAccountId],
+    request_id: &str,
+) -> Result<(), AdminError> {
+    provider.account_facts_changed(account_ids).await;
+    publish_committed(snapshot, revision).await?;
+
+    // 凭据已经提交；额度只是可重建的观察，不能拖住管理请求或回滚提交结果
+    let provider = provider.clone();
+    let account_ids = account_ids.to_vec();
+    let request_id = request_id.to_owned();
+    tokio::spawn(async move {
+        for account_id in account_ids {
+            if let Err(error) = provider
+                .quota(ProviderQuotaRequest {
+                    account_id: account_id.clone(),
+                    refresh: true,
+                    rolling_usage: None,
+                })
+                .await
+            {
+                tracing::warn!(
+                    request_id,
+                    provider = %provider.provider_kind().as_str(),
+                    account_id = %account_id.as_str(),
+                    quota_error = ?error.kind(),
+                    "initial quota observation failed"
+                );
+            }
+        }
+    });
+    Ok(())
+}
+
+pub(super) async fn required_credential(
+    accounts: &dyn AccountStore,
+    provider_kind: &ProviderKind,
+    account_id: &ProviderAccountId,
+    resource: &'static str,
+) -> Result<CredentialDetails, AdminError> {
+    accounts
+        .credential_details(provider_kind, account_id)
+        .await
+        .map_err(|error| map_store_error(error, resource))?
+        .ok_or_else(|| AdminError::not_found("Provider 凭据不存在"))
+}
+
+pub(super) async fn required_plugin_credential(
+    accounts: &dyn AccountStore,
+    account_id: &ProviderAccountId,
+    resource: &'static str,
+) -> Result<CredentialDetails, AdminError> {
+    accounts
+        .credential_details_by_id(account_id)
+        .await
+        .map_err(|error| map_store_error(error, resource))?
+        .ok_or_else(|| AdminError::not_found("Provider 凭据不存在"))
+}
+
+pub(super) async fn import_proxy_binding(
+    proxies: &dyn crate::ports::proxy::ProxyStore,
+    id: Option<&str>,
+) -> Result<Option<crate::ports::proxy::ProxyImportReservation>, AdminError> {
+    let Some(id) = id else { return Ok(None) };
+    let reservation = proxies
+        .reserve_import(id)
+        .await
+        .map_err(|error| map_store_error(error, "proxy"))?;
+    Ok(Some(reservation))
+}
+
+pub(super) async fn pending_authorization(
+    accounts: &dyn AccountStore,
+    proxies: &dyn crate::ports::proxy::ProxyStore,
+    provider_kind: &ProviderKind,
+    command: &StartAuthorization,
+    resource: &'static str,
+) -> Result<PendingAuthorizationMutation, AdminError> {
+    let proxy;
+    let mut proxy_id = None;
+    let target = match &command.reauthorization {
+        Some(account_id) => {
+            proxy = required_credential(accounts, provider_kind, account_id, resource)
+                .await?
+                .credential
+                .effective_outbound_proxy()
+                .cloned();
+            AuthorizationMutationTarget::Reauthorize {
+                account_id: account_id.clone(),
+            }
+        }
+        None => {
+            use crate::model::proxies::AccountProxySelection;
+            proxy = match &command.outbound_proxy {
+                Some(AccountProxySelection::Url(value)) => Some(value.clone()),
+                Some(AccountProxySelection::Saved(id)) => {
+                    let record = proxies
+                        .get(id)
+                        .await
+                        .map_err(|error| map_store_error(error, "proxy"))?;
+                    proxy_id = Some(record.id);
+                    if !record.enabled {
+                        return Err(AdminError::invalid("代理已禁用，请启用后再选择"));
+                    }
+                    Some(record.proxy)
+                }
+                Some(AccountProxySelection::Direct) | None => None,
+            };
+            AuthorizationMutationTarget::Create {
+                name: command.name.clone(),
+            }
+        }
+    };
+    Ok(PendingAuthorizationMutation::new(
+        provider_kind.clone(),
+        target,
+        crate::model::provider_credentials::AuthorizationOwnerBinding::from_context(
+            &command.context,
+        ),
+    )
+    .with_outbound_proxy(proxy)
+    .with_outbound_proxy_id(proxy_id))
+}
+
+pub(super) fn validate_prepared_import(
+    provider_kind: &ProviderKind,
+    prepared: &PreparedCredentialImport,
+    _resource: &'static str,
+) -> Result<(), AdminError> {
+    if prepared.provider_kind != *provider_kind
+        || prepared
+            .credentials
+            .iter()
+            .any(|credential| credential.provider_kind != *provider_kind)
+    {
+        return Err(AdminError::conflict("Provider 准备结果与请求范围不一致"));
+    }
+    Ok(())
+}
+
+pub(super) fn validate_prepared_rotation(
+    account: &crate::model::accounts::AccountRecord,
+    prepared: &PreparedCredentialRotation,
+    _resource: &'static str,
+) -> Result<(), AdminError> {
+    validate_prepared_rotation_facts(account, prepared.facts())
+}
+
+pub(super) fn validate_prepared_rotation_facts(
+    account: &crate::model::accounts::AccountRecord,
+    facts: &crate::model::provider_credentials::PreparedCredentialRotationFacts,
+) -> Result<(), AdminError> {
+    if facts.account_id.as_str() != account.id.as_str()
+        || facts.provider_kind != account.provider_kind
+    {
+        return Err(AdminError::conflict("Provider 准备结果与当前凭据不一致"));
+    }
+    Ok(())
+}
+
+pub(super) async fn validate_authorization_commit(
+    provider_kind: &ProviderKind,
+    context: &MutationContext,
+    prepared: PreparedAuthorizationCommit,
+    resource: &'static str,
+) -> Result<PreparedAuthorizationCommit, AdminError> {
+    if prepared.pending.provider_kind() != provider_kind
+        || !prepared.pending.owner_binding().matches_context(context)
+    {
+        let validation_error = AdminError::conflict("OAuth 授权绑定已失效，请重新发起授权");
+        if let Err(error) = prepared.abort().await {
+            tracing::warn!(
+                resource,
+                settlement_error = %error,
+                "OAuth authorization claim release failed after preparation validation"
+            );
+            return Err(error);
+        }
+        return Err(validation_error);
+    }
+    let matches_target = match (prepared.pending.target(), &prepared.credential) {
+        (
+            AuthorizationMutationTarget::Create { .. },
+            PreparedAuthorizationCredential::Create(credential),
+        ) => credential.provider_kind == *provider_kind,
+        (
+            AuthorizationMutationTarget::Reauthorize { account_id },
+            PreparedAuthorizationCredential::Reauthorize(credential),
+        ) => {
+            let facts = credential.facts();
+            facts.provider_kind == *provider_kind && facts.account_id == *account_id
+        }
+        _ => false,
+    };
+    if !matches_target {
+        let validation_error = AdminError::conflict("OAuth 凭据与待提交目标不一致");
+        if let Err(error) = prepared.abort().await {
+            tracing::warn!(
+                resource,
+                settlement_error = %error,
+                "OAuth authorization claim release failed after preparation validation"
+            );
+            return Err(error);
+        }
+        return Err(validation_error);
+    }
+    Ok(prepared)
+}
+
+pub(super) async fn commit_authorization(
+    accounts: &dyn AccountStore,
+    prepared: PreparedAuthorizationCommit,
+    key: crate::model::provider_credentials::AuthorizationReceiptKey,
+    settings: Option<crate::model::accounts::AccountImportSettings>,
+    context: &MutationContext,
+    resource: &'static str,
+) -> Result<crate::model::provider_credentials::AuthorizationCommitResult, AdminError> {
+    if settings.is_some()
+        && matches!(
+            &prepared.credential,
+            PreparedAuthorizationCredential::Reauthorize(_)
+        )
+    {
+        prepared.abort().await?;
+        return Err(AdminError::invalid("重新授权不能修改账号设置"));
+    }
+    let crate::model::provider_credentials::AuthorizationCommitSettlement {
+        command,
+        credential_guard,
+        authorization_guard,
+    } = prepared.into_commit(settings, key);
+    match accounts.commit_authorization(command, context).await {
+        Ok(result) => {
+            if let Some(guard) = credential_guard
+                && result.newly_committed
+            {
+                guard.finish();
+            }
+            if let Some(guard) = authorization_guard
+                && let Err(error) = guard.commit().await
+            {
+                // 账号与回执已经原子提交，Redis 清理失败不能把确定的成功改写为失败
+                tracing::warn!(resource, settlement_error = %error, "authorization committed but pending cleanup failed");
+            }
+            Ok(result)
+        }
+        Err(error) => {
+            drop(credential_guard);
+            if let Some(guard) = authorization_guard
+                && let Err(settlement_error) = guard.abort().await
+            {
+                tracing::warn!(
+                    resource,
+                    store_error = %error,
+                    settlement_error = %settlement_error,
+                    "OAuth authorization claim release failed after Store commit failure"
+                );
+                return Err(settlement_error);
+            }
+            Err(map_store_error(error, resource))
+        }
+    }
+}
+
+pub(super) async fn commit_credential_rotation(
+    accounts: &dyn AccountStore,
+    prepared: PreparedCredentialRotation,
+    settings: Option<crate::model::accounts::UpdateAccount>,
+    context: &MutationContext,
+    resource: &'static str,
+) -> Result<CredentialMutationResult, AdminError> {
+    let (facts, guard) = prepared.into_parts();
+    match accounts
+        .commit_credential_rotation(
+            CredentialRotationCommit {
+                prepared: facts,
+                settings,
+            },
+            context,
+        )
+        .await
+    {
+        Ok(result) => {
+            guard.finish();
+            Ok(result)
+        }
+        Err(error) => {
+            drop(guard);
+            Err(map_store_error(error, resource))
+        }
+    }
+}
+
+pub(super) async fn commit_credential_refresh(
+    accounts: &dyn AccountStore,
+    prepared: PreparedCredentialRotation,
+    context: &MutationContext,
+    resource: &'static str,
+) -> Result<CredentialMutationResult, AdminError> {
+    let (facts, guard) = prepared.into_parts();
+    match accounts
+        .commit_credential_refresh(
+            CredentialRotationCommit {
+                prepared: facts,
+                settings: None,
+            },
+            context,
+        )
+        .await
+    {
+        Ok(result) => {
+            guard.finish();
+            Ok(result)
+        }
+        Err(error) => {
+            drop(guard);
+            Err(map_store_error(error, resource))
+        }
+    }
+}
+
+pub(super) async fn delete_credentials(
+    accounts: &dyn AccountStore,
+    provider: &dyn ProviderAdmin,
+    command: CredentialDeletion,
+    resource: &'static str,
+) -> Result<CredentialDeletionResult, AdminError> {
+    for account_id in &command.account_ids {
+        required_credential(accounts, provider.provider_kind(), account_id, resource).await?;
+    }
+    let account_ids = command.account_ids;
+    let revision = accounts
+        .delete_accounts(
+            DeleteAccounts {
+                account_ids: account_ids
+                    .iter()
+                    .map(|account_id| account_id.as_str().to_owned())
+                    .collect(),
+            },
+            &command.context,
+        )
+        .await
+        .map_err(|error| map_store_error(error, resource))?;
+    for account_id in &account_ids {
+        provider.account_unavailable(account_id).await;
+    }
+    provider.account_facts_changed(&account_ids).await;
+    Ok(CredentialDeletionResult {
+        config_revision: revision,
+        account_ids,
+    })
+}
@@ -0,0 +1,67 @@
+//! 管理端口错误到用例错误的统一分类与来源保留
+
+use crate::model::{AdminError, AdminErrorKind};
+use crate::ports::store::{AdminStoreError, AdminStoreErrorKind};
+
+pub(super) fn map_store_error(error: AdminStoreError, resource: &'static str) -> AdminError {
+    let kind = match error.kind() {
+        AdminStoreErrorKind::Invalid => AdminErrorKind::Invalid,
+        AdminStoreErrorKind::NotFound => AdminErrorKind::NotFound,
+        AdminStoreErrorKind::StaleRevision
+        | AdminStoreErrorKind::DuplicateName
+        | AdminStoreErrorKind::Conflict => AdminErrorKind::Conflict,
+        AdminStoreErrorKind::Unavailable => AdminErrorKind::Unavailable,
+    };
+    let message = match kind {
+        AdminErrorKind::Invalid => "请求参数不合法",
+        AdminErrorKind::NotFound => "请求的资源不存在",
+        AdminErrorKind::Conflict => "当前资源状态冲突，请刷新后重试",
+        AdminErrorKind::Unavailable => "依赖服务暂不可用",
+        _ => "服务内部错误",
+    };
+    AdminError::new(kind, message).with_source(OperationFailure {
+        operation: resource,
+        source: error.into(),
+    })
+}
+
+pub(super) fn map_provider_error(
+    error: crate::ports::provider::ProviderAdminError,
+    resource: &'static str,
+) -> AdminError {
+    use crate::ports::provider::ProviderAdminErrorKind;
+
+    let kind = match error.kind() {
+        ProviderAdminErrorKind::Invalid => AdminErrorKind::Invalid,
+        ProviderAdminErrorKind::Unsupported => AdminErrorKind::Invalid,
+        ProviderAdminErrorKind::NotFound => AdminErrorKind::NotFound,
+        ProviderAdminErrorKind::Conflict => AdminErrorKind::Conflict,
+        ProviderAdminErrorKind::Ambiguous => AdminErrorKind::UpstreamResultUnknown,
+        ProviderAdminErrorKind::Unavailable => AdminErrorKind::Unavailable,
+        ProviderAdminErrorKind::CredentialRefreshRequired => AdminErrorKind::Unavailable,
+        ProviderAdminErrorKind::BadGateway => AdminErrorKind::BadGateway,
+        ProviderAdminErrorKind::Internal => AdminErrorKind::Internal,
+    };
+    let message = match kind {
+        AdminErrorKind::Invalid => "Provider 请求不合法",
+        AdminErrorKind::NotFound => "Provider 资源不存在",
+        AdminErrorKind::Conflict => "Provider 资源状态冲突，请刷新后重试",
+        AdminErrorKind::BadGateway => "上游服务请求失败",
+        AdminErrorKind::UpstreamResultUnknown => "上游执行结果未知，请刷新状态后再决定是否重试",
+        AdminErrorKind::Unavailable => "Provider 服务暂不可用",
+        AdminErrorKind::Internal => "服务内部错误",
+        _ => "Provider 操作失败",
+    };
+    AdminError::new(kind, error.public_message().unwrap_or(message)).with_source(OperationFailure {
+        operation: resource,
+        source: error.into(),
+    })
+}
+
+// 用例的操作名补充端口资源上下文，底层分类与原始原因仍由来源持有
+#[derive(Debug, thiserror::Error)]
+#[error("admin operation failed: {operation}")]
+struct OperationFailure {
+    operation: &'static str,
+    source: gateway_core::error::ErrorSource,
+}
@@ -14,7 +14,9 @@ use crate::{
            KeyUsageOverview, KeyUsageQuery, KeyUsageRecordKind, KeyUsageRecords,
            KeyUsageRecordsQuery,
        },
-        observability::{OpsErrorFilter, OpsErrorQuery, TimeRange, UsageFilter, UsageQuery},
+        observability::{
+            Granularity, OpsErrorFilter, OpsErrorQuery, TimeRange, UsageFilter, UsageQuery,
+        },
        system::SystemVersion,
    },
    ports::store::{ClientKeyStore, ObservabilityStore},
@@ -190,17 +192,23 @@ impl KeyUsageService for DefaultKeyUsageService {
                .ok_or_else(|| AdminError::internal("时间超出支持范围"))?,
            end: now,
        };
-        let (overview, trend, health_points) = futures::try_join!(
-            self.observations.usage_summary(query.range, filter.clone()),
-            self.observations.usage_trend(query.range, filter),
-            self.observations
-                .usage_trend(today, usage_filter(&id, None)),
+        let (observation, health_points) = futures::try_join!(
+            self.observations.usage_insights_observation(
+                query.range,
+                filter,
+                Granularity::for_range(query.range)
+            ),
+            self.observations.usage_trend(
+                today,
+                usage_filter(&id, None),
+                Granularity::for_range(today)
+            ),
        )
        .map_err(|error| map_store_error(error, "key usage overview"))?;
        Ok(Some(KeyUsageOverview {
            key,
-            overview,
-            trend,
+            overview: observation.overview,
+            trend: observation.trend,
            health_timeline: health_timeline_at(&health_points, now, self.timezone)?,
        }))
    }
@@ -217,6 +225,7 @@ impl KeyUsageService for DefaultKeyUsageService {
            KeyUsageRecordKind::Success => KeyUsageRecords::Success(
                self.observations
                    .list_usage_records(UsageQuery {
+                        status: Default::default(),
                        range: query.usage.range,
                        filter: usage_filter(&id, query.usage.model),
                        current_page: query.current_page,
@@ -18,439 +18,18 @@ pub mod plugins;
 pub mod proxies;
 pub mod settings;
 pub mod system;
+pub mod usage_data;

-use crate::{
-    model::{
-        AdminError, AdminErrorKind, MutationContext,
-        accounts::DeleteAccounts,
-        provider_credentials::{
-            AuthorizationMutationTarget, CredentialDeletion, CredentialDeletionResult,
-            CredentialDetails, CredentialMutationResult, CredentialRotationCommit,
-            PendingAuthorizationMutation, PreparedAuthorizationCommit,
-            PreparedAuthorizationCredential, PreparedCredentialImport, PreparedCredentialRotation,
-            ProviderQuotaRequest, StartAuthorization,
-        },
-    },
-    ports::{
-        provider::ProviderAdmin,
-        store::{AccountStore, AdminStoreError, AdminStoreErrorKind},
-    },
+mod credential_mutation;
+mod error;
+mod publication;
+
+use credential_mutation::{
+    commit_authorization, commit_credential_refresh, commit_credential_rotation,
+    delete_credentials, import_proxy_binding, pending_authorization,
+    publish_credentials_and_observe_quota, required_credential, required_plugin_credential,
+    validate_authorization_commit, validate_prepared_import, validate_prepared_rotation,
+    validate_prepared_rotation_facts,
 };
-use gateway_core::{
-    account::ProviderAccountId,
-    routing::{ConfigRevision, ProviderKind},
-    runtime::SnapshotControl,
-};
-
-fn map_store_error(error: AdminStoreError, resource: &'static str) -> AdminError {
-    let kind = match error.kind() {
-        AdminStoreErrorKind::Invalid => AdminErrorKind::Invalid,
-        AdminStoreErrorKind::NotFound => AdminErrorKind::NotFound,
-        AdminStoreErrorKind::StaleRevision
-        | AdminStoreErrorKind::DuplicateName
-        | AdminStoreErrorKind::Conflict => AdminErrorKind::Conflict,
-        AdminStoreErrorKind::Unavailable => AdminErrorKind::Unavailable,
-    };
-    tracing::warn!(resource, error_kind = ?error.kind(), "admin store operation failed");
-    let message = match kind {
-        AdminErrorKind::Invalid => "请求参数不合法",
-        AdminErrorKind::NotFound => "请求的资源不存在",
-        AdminErrorKind::Conflict => "当前资源状态冲突，请刷新后重试",
-        AdminErrorKind::Unavailable => "依赖服务暂不可用",
-        _ => "服务内部错误",
-    };
-    AdminError::new(kind, message)
-}
-
-fn map_provider_error(
-    error: crate::ports::provider::ProviderAdminError,
-    resource: &'static str,
-) -> AdminError {
-    use crate::ports::provider::ProviderAdminErrorKind;
-
-    let kind = match error.kind() {
-        ProviderAdminErrorKind::Invalid => AdminErrorKind::Invalid,
-        ProviderAdminErrorKind::Unsupported => AdminErrorKind::Invalid,
-        ProviderAdminErrorKind::NotFound => AdminErrorKind::NotFound,
-        ProviderAdminErrorKind::Conflict => AdminErrorKind::Conflict,
-        ProviderAdminErrorKind::Ambiguous => AdminErrorKind::UpstreamResultUnknown,
-        ProviderAdminErrorKind::Unavailable => AdminErrorKind::Unavailable,
-        ProviderAdminErrorKind::CredentialRefreshRequired => AdminErrorKind::Unavailable,
-        ProviderAdminErrorKind::BadGateway => AdminErrorKind::BadGateway,
-        ProviderAdminErrorKind::Internal => AdminErrorKind::Internal,
-    };
-    tracing::warn!(resource, error_kind = ?error.kind(), "admin provider operation failed");
-    let message = match kind {
-        AdminErrorKind::Invalid => "Provider 请求不合法",
-        AdminErrorKind::NotFound => "Provider 资源不存在",
-        AdminErrorKind::Conflict => "Provider 资源状态冲突，请刷新后重试",
-        AdminErrorKind::BadGateway => "上游服务请求失败",
-        AdminErrorKind::UpstreamResultUnknown => "上游执行结果未知，请刷新状态后再决定是否重试",
-        AdminErrorKind::Unavailable => "Provider 服务暂不可用",
-        AdminErrorKind::Internal => "服务内部错误",
-        _ => "Provider 操作失败",
-    };
-    AdminError::new(kind, error.public_message().unwrap_or(message))
-}
-
-async fn publish_committed(
-    snapshot: &dyn SnapshotControl,
-    revision: crate::model::Revision,
-) -> Result<(), AdminError> {
-    let revision = ConfigRevision::new(revision.get())
-        .map_err(|_| AdminError::internal("已提交的配置版本不合法"))?;
-    snapshot.publish_committed(revision).await;
-    Ok(())
-}
-
-async fn publish_credentials_and_observe_quota(
-    provider: &std::sync::Arc<dyn crate::ports::provider::ProviderAdmin>,
-    snapshot: &dyn SnapshotControl,
-    revision: crate::model::Revision,
-    account_ids: &[ProviderAccountId],
-    request_id: &str,
-) -> Result<(), AdminError> {
-    provider.account_facts_changed(account_ids).await;
-    publish_committed(snapshot, revision).await?;
-
-    // 凭据已经提交；额度只是可重建的观察，不能拖住管理请求或回滚提交结果
-    let provider = provider.clone();
-    let account_ids = account_ids.to_vec();
-    let request_id = request_id.to_owned();
-    tokio::spawn(async move {
-        for account_id in account_ids {
-            if let Err(error) = provider
-                .quota(ProviderQuotaRequest {
-                    account_id: account_id.clone(),
-                    refresh: true,
-                    rolling_usage: None,
-                })
-                .await
-            {
-                tracing::warn!(
-                    request_id,
-                    provider = %provider.provider_kind().as_str(),
-                    account_id = %account_id.as_str(),
-                    quota_error = ?error.kind(),
-                    "initial quota observation failed"
-                );
-            }
-        }
-    });
-    Ok(())
-}
-
-async fn required_credential(
-    accounts: &dyn AccountStore,
-    provider_kind: &ProviderKind,
-    account_id: &ProviderAccountId,
-    resource: &'static str,
-) -> Result<CredentialDetails, AdminError> {
-    accounts
-        .credential_details(provider_kind, account_id)
-        .await
-        .map_err(|error| map_store_error(error, resource))?
-        .ok_or_else(|| AdminError::not_found("Provider 凭据不存在"))
-}
-
-async fn required_plugin_credential(
-    accounts: &dyn AccountStore,
-    account_id: &ProviderAccountId,
-    resource: &'static str,
-) -> Result<CredentialDetails, AdminError> {
-    accounts
-        .credential_details_by_id(account_id)
-        .await
-        .map_err(|error| map_store_error(error, resource))?
-        .ok_or_else(|| AdminError::not_found("Provider 凭据不存在"))
-}
-
-async fn import_proxy_binding(
-    proxies: &dyn crate::ports::proxy::ProxyStore,
-    id: Option<&str>,
-) -> Result<Option<crate::ports::proxy::ProxyImportReservation>, AdminError> {
-    let Some(id) = id else { return Ok(None) };
-    let reservation = proxies
-        .reserve_import(id)
-        .await
-        .map_err(|error| map_store_error(error, "proxy"))?;
-    Ok(Some(reservation))
-}
-
-async fn pending_authorization(
-    accounts: &dyn AccountStore,
-    proxies: &dyn crate::ports::proxy::ProxyStore,
-    provider_kind: &ProviderKind,
-    command: &StartAuthorization,
-    resource: &'static str,
-) -> Result<PendingAuthorizationMutation, AdminError> {
-    let proxy;
-    let mut proxy_id = None;
-    let target = match &command.reauthorization {
-        Some(account_id) => {
-            proxy = required_credential(accounts, provider_kind, account_id, resource)
-                .await?
-                .credential
-                .outbound_proxy;
-            AuthorizationMutationTarget::Reauthorize {
-                account_id: account_id.clone(),
-            }
-        }
-        None => {
-            use crate::model::proxies::AccountProxySelection;
-            proxy = match &command.outbound_proxy {
-                Some(AccountProxySelection::Url(value)) => Some(value.clone()),
-                Some(AccountProxySelection::Saved(id)) => {
-                    let record = proxies
-                        .get(id)
-                        .await
-                        .map_err(|error| map_store_error(error, "proxy"))?;
-                    proxy_id = Some(record.id);
-                    Some(record.proxy)
-                }
-                Some(AccountProxySelection::Direct) | None => None,
-            };
-            AuthorizationMutationTarget::Create {
-                name: command.name.clone(),
-            }
-        }
-    };
-    Ok(PendingAuthorizationMutation::new(
-        provider_kind.clone(),
-        target,
-        crate::model::provider_credentials::AuthorizationOwnerBinding::from_context(
-            &command.context,
-        ),
-    )
-    .with_outbound_proxy(proxy)
-    .with_outbound_proxy_id(proxy_id))
-}
-
-fn validate_prepared_import(
-    provider_kind: &ProviderKind,
-    prepared: &PreparedCredentialImport,
-    _resource: &'static str,
-) -> Result<(), AdminError> {
-    if prepared.provider_kind != *provider_kind
-        || prepared
-            .credentials
-            .iter()
-            .any(|credential| credential.provider_kind != *provider_kind)
-    {
-        return Err(AdminError::conflict("Provider 准备结果与请求范围不一致"));
-    }
-    Ok(())
-}
-
-fn validate_prepared_rotation(
-    account: &crate::model::accounts::AccountRecord,
-    prepared: &PreparedCredentialRotation,
-    _resource: &'static str,
-) -> Result<(), AdminError> {
-    validate_prepared_rotation_facts(account, prepared.facts())
-}
-
-fn validate_prepared_rotation_facts(
-    account: &crate::model::accounts::AccountRecord,
-    facts: &crate::model::provider_credentials::PreparedCredentialRotationFacts,
-) -> Result<(), AdminError> {
-    if facts.account_id.as_str() != account.id.as_str()
-        || facts.provider_kind != account.provider_kind
-    {
-        return Err(AdminError::conflict("Provider 准备结果与当前凭据不一致"));
-    }
-    Ok(())
-}
-
-async fn validate_authorization_commit(
-    provider_kind: &ProviderKind,
-    context: &MutationContext,
-    prepared: PreparedAuthorizationCommit,
-    resource: &'static str,
-) -> Result<PreparedAuthorizationCommit, AdminError> {
-    if prepared.pending.provider_kind() != provider_kind
-        || !prepared.pending.owner_binding().matches_context(context)
-    {
-        let validation_error = AdminError::conflict("OAuth 授权绑定已失效，请重新发起授权");
-        if let Err(error) = prepared.abort().await {
-            tracing::warn!(
-                resource,
-                settlement_error = %error,
-                "OAuth authorization claim release failed after preparation validation"
-            );
-            return Err(error);
-        }
-        return Err(validation_error);
-    }
-    let matches_target = match (prepared.pending.target(), &prepared.credential) {
-        (
-            AuthorizationMutationTarget::Create { .. },
-            PreparedAuthorizationCredential::Create(credential),
-        ) => credential.provider_kind == *provider_kind,
-        (
-            AuthorizationMutationTarget::Reauthorize { account_id },
-            PreparedAuthorizationCredential::Reauthorize(credential),
-        ) => {
-            let facts = credential.facts();
-            facts.provider_kind == *provider_kind && facts.account_id == *account_id
-        }
-        _ => false,
-    };
-    if !matches_target {
-        let validation_error = AdminError::conflict("OAuth 凭据与待提交目标不一致");
-        if let Err(error) = prepared.abort().await {
-            tracing::warn!(
-                resource,
-                settlement_error = %error,
-                "OAuth authorization claim release failed after preparation validation"
-            );
-            return Err(error);
-        }
-        return Err(validation_error);
-    }
-    Ok(prepared)
-}
-
-async fn commit_authorization(
-    accounts: &dyn AccountStore,
-    prepared: PreparedAuthorizationCommit,
-    key: crate::model::provider_credentials::AuthorizationReceiptKey,
-    settings: Option<crate::model::accounts::AccountImportSettings>,
-    context: &MutationContext,
-    resource: &'static str,
-) -> Result<crate::model::provider_credentials::AuthorizationCommitResult, AdminError> {
-    if settings.is_some()
-        && matches!(
-            &prepared.credential,
-            PreparedAuthorizationCredential::Reauthorize(_)
-        )
-    {
-        prepared.abort().await?;
-        return Err(AdminError::invalid("重新授权不能修改账号设置"));
-    }
-    let crate::model::provider_credentials::AuthorizationCommitSettlement {
-        command,
-        credential_guard,
-        authorization_guard,
-    } = prepared.into_commit(settings, key);
-    match accounts.commit_authorization(command, context).await {
-        Ok(result) => {
-            if let Some(guard) = credential_guard
-                && result.newly_committed
-            {
-                guard.finish();
-            }
-            if let Some(guard) = authorization_guard
-                && let Err(error) = guard.commit().await
-            {
-                // 账号与回执已经原子提交，Redis 清理失败不能把确定的成功改写为失败
-                tracing::warn!(resource, settlement_error = %error, "authorization committed but pending cleanup failed");
-            }
-            Ok(result)
-        }
-        Err(error) => {
-            drop(credential_guard);
-            if let Some(guard) = authorization_guard
-                && let Err(settlement_error) = guard.abort().await
-            {
-                tracing::warn!(
-                    resource,
-                    store_error = %error,
-                    settlement_error = %settlement_error,
-                    "OAuth authorization claim release failed after Store commit failure"
-                );
-                return Err(settlement_error);
-            }
-            Err(map_store_error(error, resource))
-        }
-    }
-}
-
-async fn commit_credential_rotation(
-    accounts: &dyn AccountStore,
-    prepared: PreparedCredentialRotation,
-    settings: Option<crate::model::accounts::UpdateAccount>,
-    context: &MutationContext,
-    resource: &'static str,
-) -> Result<CredentialMutationResult, AdminError> {
-    let (facts, guard) = prepared.into_parts();
-    match accounts
-        .commit_credential_rotation(
-            CredentialRotationCommit {
-                prepared: facts,
-                settings,
-            },
-            context,
-        )
-        .await
-    {
-        Ok(result) => {
-            guard.finish();
-            Ok(result)
-        }
-        Err(error) => {
-            drop(guard);
-            Err(map_store_error(error, resource))
-        }
-    }
-}
-
-async fn commit_credential_refresh(
-    accounts: &dyn AccountStore,
-    prepared: PreparedCredentialRotation,
-    context: &MutationContext,
-    resource: &'static str,
-) -> Result<CredentialMutationResult, AdminError> {
-    let (facts, guard) = prepared.into_parts();
-    match accounts
-        .commit_credential_refresh(
-            CredentialRotationCommit {
-                prepared: facts,
-                settings: None,
-            },
-            context,
-        )
-        .await
-    {
-        Ok(result) => {
-            guard.finish();
-            Ok(result)
-        }
-        Err(error) => {
-            drop(guard);
-            Err(map_store_error(error, resource))
-        }
-    }
-}
-
-async fn delete_credentials(
-    accounts: &dyn AccountStore,
-    provider: &dyn ProviderAdmin,
-    command: CredentialDeletion,
-    resource: &'static str,
-) -> Result<CredentialDeletionResult, AdminError> {
-    for account_id in &command.account_ids {
-        required_credential(accounts, provider.provider_kind(), account_id, resource).await?;
-    }
-    let account_ids = command.account_ids;
-    let revision = accounts
-        .delete_accounts(
-            DeleteAccounts {
-                account_ids: account_ids
-                    .iter()
-                    .map(|account_id| account_id.as_str().to_owned())
-                    .collect(),
-            },
-            &command.context,
-        )
-        .await
-        .map_err(|error| map_store_error(error, resource))?;
-    for account_id in &account_ids {
-        provider.account_unavailable(account_id).await;
-    }
-    provider.account_facts_changed(&account_ids).await;
-    Ok(CredentialDeletionResult {
-        config_revision: revision,
-        account_ids,
-    })
-}
+use error::{map_provider_error, map_store_error};
+use publication::publish_committed;
@@ -0,0 +1,227 @@
+//! 按故障目标收集诊断证据，补充读取失败不丢弃已取得的记录
+
+use std::{
+    collections::{HashSet, VecDeque},
+    time::Duration,
+};
+
+use tokio::time::{Instant, timeout_at};
+
+use super::{DefaultObservabilityService, map_store_error};
+use crate::model::{
+    AdminError, AdminErrorKind,
+    diagnostics::{DiagnosticBundle, DiagnosticGap, DiagnosticRequest, DiagnosticTarget},
+    observability::OpsError,
+};
+
+const MAX_REQUESTS: usize = 8;
+const MAX_ERRORS: u16 = 128;
+
+impl DefaultObservabilityService {
+    pub(super) async fn collect_diagnostics(
+        &self,
+        target: DiagnosticTarget,
+    ) -> Result<DiagnosticBundle, AdminError> {
+        if target.id().trim().is_empty() || target.id().len() > 256 {
+            return Err(AdminError::invalid("诊断目标 ID 不合法"));
+        }
+        let deadline = Instant::now() + Duration::from_secs(20);
+        let (collected, environment) = tokio::join!(
+            self.collect_records(target, deadline),
+            timeout_at(deadline, self.system.version()),
+        );
+        let mut bundle = collected?;
+        match environment {
+            Ok(Ok(version)) => bundle.environment = Some(version),
+            _ => gap(&mut bundle, "environment", "collection_failed"),
+        }
+        Ok(bundle)
+    }
+
+    async fn collect_records(
+        &self,
+        target: DiagnosticTarget,
+        deadline: Instant,
+    ) -> Result<DiagnosticBundle, AdminError> {
+        let mut bundle = DiagnosticBundle {
+            target,
+            collected_at: chrono::Utc::now(),
+            environment: None,
+            error: None,
+            requests: Vec::new(),
+            gaps: Vec::new(),
+        };
+        let mut remaining_errors = MAX_ERRORS;
+        let first_id = match &bundle.target {
+            DiagnosticTarget::Request(id) => Some(id.clone()),
+            DiagnosticTarget::Operation(_) => {
+                let mut errors = self.export_errors(&bundle.target, 1, deadline).await?;
+                let error = errors
+                    .pop()
+                    .ok_or_else(|| AdminError::not_found("错误记录不存在或已过期"))?;
+                let id = error.request_id.clone();
+                bundle.error = Some(error);
+                remaining_errors -= 1;
+                id
+            }
+        };
+        let mut pending = VecDeque::from_iter(first_id);
+        let mut seen = HashSet::new();
+        while let Some(id) = pending.pop_front() {
+            if !seen.insert(id.clone()) {
+                continue;
+            }
+            if bundle.requests.len() >= MAX_REQUESTS {
+                gap(&mut bundle, "requests", "related_request_limit");
+                break;
+            }
+            let section = format!("requests.{id}");
+            let target = DiagnosticTarget::Request(id.clone());
+            let selected = bundle
+                .error
+                .as_ref()
+                .filter(|error| error.request_id.as_deref() == Some(id.as_str()));
+            // 事件导出已经持有选中记录，额外读取一个槽位用于去重后判断是否超限
+            let read_limit = remaining_errors + 1 + u16::from(selected.is_some());
+            let (detail, errors) = tokio::join!(
+                timeout_at(deadline, self.store.usage_record_detail(&id)),
+                self.export_errors(&target, read_limit, deadline),
+            );
+            let (detail, detail_error) = match detail {
+                Ok(Ok(detail)) => (Some(detail), None),
+                Ok(Err(error)) => (None, Some(map_store_error(error, "diagnostic request"))),
+                Err(_) => (
+                    None,
+                    Some(AdminError::new(AdminErrorKind::Unavailable, "诊断采集超时")),
+                ),
+            };
+            let mut errors = match errors {
+                Ok(mut errors) => {
+                    if let Some(selected) = selected {
+                        errors.retain(|error| {
+                            error.source != selected.source || error.event_id != selected.event_id
+                        });
+                    }
+                    errors
+                }
+                Err(error) => {
+                    if detail.is_none() && bundle.requests.is_empty() && bundle.error.is_none() {
+                        return Err(error);
+                    }
+                    gap(
+                        &mut bundle,
+                        &format!("{section}.errors"),
+                        "collection_failed",
+                    );
+                    Vec::new()
+                }
+            };
+            if detail.is_none()
+                && errors.is_empty()
+                && bundle.requests.is_empty()
+                && bundle.error.is_none()
+            {
+                return Err(
+                    detail_error.unwrap_or_else(|| AdminError::not_found("请求记录不存在或已过期"))
+                );
+            }
+            if errors.len() > usize::from(remaining_errors) {
+                gap(
+                    &mut bundle,
+                    &format!("{section}.errors"),
+                    "error_record_limit",
+                );
+                errors.truncate(usize::from(remaining_errors));
+            }
+            remaining_errors =
+                remaining_errors.saturating_sub(u16::try_from(errors.len()).unwrap_or(MAX_ERRORS));
+            if let Some(record) = &detail {
+                for related in &record.related_requests {
+                    if let Some(id) = related.get("requestId").and_then(serde_json::Value::as_str) {
+                        pending.push_back(id.to_owned());
+                    }
+                }
+                if record.request.outcome == crate::model::observability::RequestOutcome::Running {
+                    gap(&mut bundle, &section, "request_not_finalized");
+                }
+                match &record.trace {
+                    None => gap(
+                        &mut bundle,
+                        &format!("{section}.trace"),
+                        "not_recorded_or_retained",
+                    ),
+                    Some(trace) => {
+                        if trace["droppedEvents"].as_u64().unwrap_or(0) > 0 {
+                            gap(&mut bundle, &format!("{section}.trace"), "events_evicted");
+                        }
+                        let events = trace["events"].as_array();
+                        if !events.is_some_and(|events| {
+                            events.iter().any(|event| {
+                                event["stage"] == "request.routed"
+                                    && event["data"]["accountPolicy"].is_object()
+                            })
+                        }) {
+                            gap(&mut bundle, &section, "incident_policy_not_recorded");
+                        }
+                        for event in events.into_iter().flatten() {
+                            if event["stage"] == "capture.gap" || event["data"]["truncated"] == true
+                            {
+                                gap(
+                                    &mut bundle,
+                                    &format!("{section}.trace"),
+                                    "capture_gap_or_truncation",
+                                );
+                            }
+                            if event["stage"] == "retry.decided" && event["data"]["phase"].is_null()
+                            {
+                                gap(
+                                    &mut bundle,
+                                    &format!("{section}.trace"),
+                                    "legacy_retry_facts_not_recorded",
+                                );
+                            }
+                        }
+                    }
+                }
+                gap(
+                    &mut bundle,
+                    &format!("{section}.attempts"),
+                    "best_effort_persistence",
+                );
+            } else {
+                gap(&mut bundle, &section, "request_detail_unavailable");
+            }
+            bundle.requests.push(DiagnosticRequest {
+                request_id: id,
+                detail,
+                errors,
+            });
+        }
+        Ok(bundle)
+    }
+
+    async fn export_errors(
+        &self,
+        target: &DiagnosticTarget,
+        limit: u16,
+        deadline: Instant,
+    ) -> Result<Vec<OpsError>, AdminError> {
+        timeout_at(deadline, self.store.diagnostic_errors(target, limit))
+            .await
+            .map_err(|_| AdminError::new(AdminErrorKind::Unavailable, "诊断采集超时"))?
+            .map_err(|error| map_store_error(error, "diagnostic errors"))
+    }
+}
+
+fn gap(bundle: &mut DiagnosticBundle, section: &str, reason: &'static str) {
+    if !bundle
+        .gaps
+        .iter()
+        .any(|gap| gap.section == section && gap.reason == reason)
+    {
+        bundle.gaps.push(DiagnosticGap {
+            section: section.to_owned(),
+            reason,
+        });
+    }
+}
@@ -4,12 +4,10 @@ use std::{
    collections::{BTreeMap, HashMap, btree_map::Entry},
    str::FromStr,
    sync::Arc,
-    time::{Duration as StdDuration, Instant},
 };

 use async_trait::async_trait;
 use chrono::{DateTime, Duration, Utc};
-use futures::TryStreamExt;
 use gateway_core::{account::ProviderAccountId, routing::ProviderKind};

 use crate::{
@@ -17,20 +15,20 @@ use crate::{
        AdminError,
        observability::{
            CostCoverage, CurrencyCost, DashboardAccountUsage, DashboardCapacity,
-            DashboardPeriodMetrics, DashboardResult, DecimalAmount, DiagnosticDimension,
-            DiagnosticsItem, DiagnosticsResult, HealthStatus, HealthTimeline, HealthTimelinePoint,
-            OpsErrorPage, OpsErrorQuery, ProviderBillingInput, RequestMetricPoint, RequestMetrics,
-            TimeRange, Trend, TrendKind, TrendPoint, TrendSummary, UsageBilling,
-            UsageCalculatedBillingFact, UsageDetail, UsageFilter, UsageInsights, UsageInsightsCost,
-            UsageInsightsCostPoint, UsageInsightsHealth, UsageInsightsHealthPoint,
-            UsageInsightsPerformance, UsageInsightsPerformancePoint, UsageOverview, UsagePage,
-            UsageQuery, UsageSummary,
+            DashboardPeriodMetrics, DashboardQuery, DashboardResult, DecimalAmount,
+            DiagnosticDimension, DiagnosticsItem, DiagnosticsResult, Granularity, HealthStatus,
+            HealthTimeline, HealthTimelinePoint, OpsErrorPage, OpsErrorQuery, ProviderBillingInput,
+            RequestMetricPoint, RequestMetrics, TimeRange, Trend, TrendKind, TrendPoint,
+            TrendSummary, UsageBilling, UsageBillingProjection, UsageCalculatedBillingFact,
+            UsageDetail, UsageFilter, UsageInsights, UsageInsightsCost, UsageInsightsCostPoint,
+            UsageInsightsHealth, UsageInsightsHealthPoint, UsageInsightsPerformance,
+            UsageInsightsPerformancePoint, UsageOverview, UsagePage, UsageQuery, UsageSummary,
        },
        provider_credentials::ProviderQuotaRequest,
    },
    ports::{
        provider::{ProviderAdminErrorKind, ProviderAdminRegistry},
-        store::{AccountStore, ObservabilityStore, SettingsStore, UsageCalculatedBillingStream},
+        store::{AccountStore, ObservabilityStore, SettingsStore, UsageBillingProjector},
    },
 };

@@ -39,59 +37,10 @@ use super::{map_provider_error, map_store_error};
 const HEALTH_TIMELINE_SLOT_MINUTES: i64 = 15;
 const HEALTH_TIMELINE_MIN_SAMPLE_SIZE: u64 = 10;
 const HEALTH_TIMELINE_UNAVAILABLE_FAILURE_THRESHOLD: u64 = 3;
-const HEALTH_TIMELINE_STABLE_RELIABILITY: f64 = 99.0;
-const DASHBOARD_QUERY_BUCKET_SECONDS: i64 = 2;
-const DASHBOARD_QUERY_CACHE_RETENTION: StdDuration = StdDuration::from_secs(2);
-
-#[derive(Clone, Copy, PartialEq, Eq, Hash)]
-struct DashboardQueryKey {
-    start: DateTime<Utc>,
-    end_bucket: i64,
-}
-
-impl DashboardQueryKey {
-    fn new(range: TimeRange) -> Self {
-        Self {
-            start: range.start,
-            end_bucket: range
-                .end
-                .timestamp()
-                .div_euclid(DASHBOARD_QUERY_BUCKET_SECONDS),
-        }
-    }
-}
-
-struct DashboardQueryEntry {
-    created_at: Instant,
-    result: Arc<tokio::sync::OnceCell<Result<DashboardResult, AdminError>>>,
-}
-
-#[derive(Default)]
-struct DashboardQueryCache {
-    entries: tokio::sync::Mutex<HashMap<DashboardQueryKey, DashboardQueryEntry>>,
-}
-
-impl DashboardQueryCache {
-    async fn result_cell(
-        &self,
-        key: DashboardQueryKey,
-    ) -> Arc<tokio::sync::OnceCell<Result<DashboardResult, AdminError>>> {
-        let now = Instant::now();
-        let mut entries = self.entries.lock().await;
-        entries.retain(|_, entry| {
-            now.duration_since(entry.created_at) < DASHBOARD_QUERY_CACHE_RETENTION
-        });
-        Arc::clone(
-            &entries
-                .entry(key)
-                .or_insert_with(|| DashboardQueryEntry {
-                    created_at: now,
-                    result: Arc::new(tokio::sync::OnceCell::new()),
-                })
-                .result,
-        )
-    }
-}
+const HEALTH_TIMELINE_STABLE_RELIABILITY: f64 = 95.0;
+mod export;
+mod store_cache;
+pub(crate) use store_cache::CachedObservabilityStore;

 /// API 消费的观测控制面服务
 #[async_trait]
@@ -122,6 +71,10 @@ pub trait ObservabilityService: Send + Sync {
        dimension: DiagnosticDimension,
    ) -> Result<DiagnosticsResult, AdminError>;
    async fn ops_errors(&self, query: OpsErrorQuery) -> Result<OpsErrorPage, AdminError>;
+    async fn export_diagnostics(
+        &self,
+        target: crate::model::diagnostics::DiagnosticTarget,
+    ) -> Result<crate::model::diagnostics::DiagnosticBundle, AdminError>;
 }

 pub(crate) struct DefaultObservabilityService {
@@ -130,7 +83,7 @@ pub(crate) struct DefaultObservabilityService {
    accounts: Arc<dyn AccountStore>,
    settings: Arc<dyn SettingsStore>,
    providers: ProviderAdminRegistry,
-    dashboard_queries: DashboardQueryCache,
+    system: Arc<dyn super::system::SystemService>,
 }

 impl DefaultObservabilityService {
@@ -141,6 +94,7 @@ impl DefaultObservabilityService {
        settings: Arc<dyn SettingsStore>,
        providers: ProviderAdminRegistry,
        timezone: gateway_core::time::DeploymentTimeZone,
+        system: Arc<dyn super::system::SystemService>,
    ) -> Self {
        Self {
            timezone,
@@ -148,7 +102,7 @@ impl DefaultObservabilityService {
            accounts,
            settings,
            providers,
-            dashboard_queries: DashboardQueryCache::default(),
+            system,
        }
    }

@@ -157,12 +111,13 @@ impl DefaultObservabilityService {
        range: TimeRange,
    ) -> Result<DashboardResult, AdminError> {
        let observed_at = Utc::now();
-        let (mut observation, settings, runtime_slots) = futures::try_join!(
-            self.store.dashboard_summary(range, observed_at),
+        let (mut observation, settings) = futures::try_join!(
+            self.store
+                .dashboard_summary(DashboardQuery::new(range), observed_at),
            self.settings.load_runtime_settings(),
-            self.store.dashboard_runtime_slots(observed_at),
        )
        .map_err(|error| map_store_error(error, "dashboard"))?;
+        let runtime_slots = observation.runtime_slots;
        self.enrich_list_records(&mut observation.recent_requests);
        self.enrich_dashboard_quotas(&mut observation.account_usage)
            .await;
@@ -184,7 +139,7 @@ impl DefaultObservabilityService {
        let yesterday = dashboard_period_metrics(&observation.trend, yesterday_start, today_start);
        let total_billing_usd = observation.totals.billing_usd.clone();
        let total_cached_token_rate = rate_or_zero(
-            observation.totals.cached_tokens,
+            observation.totals.cached_input_tokens,
            observation.totals.input_tokens,
        );
        let (first_token_latency_sum_ms, first_token_latency_count) = observation
@@ -198,13 +153,17 @@ impl DefaultObservabilityService {
            });
        let average_first_token_latency_ms =
            average(first_token_latency_sum_ms, first_token_latency_count);
-        let trend = trend(TrendKind::Usage, observation.trend.clone())?;
+        let trend = trend(
+            TrendKind::Usage,
+            observation.trend.clone(),
+            observation.analytics.clone(),
+        )?;
        let health_timeline =
            health_timeline_at(&observation.trend, observation.range.end, self.timezone)?;
        let wire_profiles = self
            .providers
            .dashboard_wire_profiles(&settings.request_profiles);
-        let max_concurrent_per_account = u64::from(settings.max_concurrent_per_account);
+        let max_concurrent_per_account = u64::from(settings.values.max_concurrent_per_account);
        let (inherited_accounts, overridden_slots) = runtime_slots
            .as_ref()
            .map_or((observation.provider_accounts.normal, 0), |slots| {
@@ -241,20 +200,24 @@ impl DefaultObservabilityService {

 #[async_trait]
 impl ObservabilityService for DefaultObservabilityService {
+    async fn export_diagnostics(
+        &self,
+        target: crate::model::diagnostics::DiagnosticTarget,
+    ) -> Result<crate::model::diagnostics::DiagnosticBundle, AdminError> {
+        self.collect_diagnostics(target).await
+    }
+
    async fn dashboard_summary(
        &self,
        range: TimeRange,
        kind: TrendKind,
    ) -> Result<DashboardResult, AdminError> {
-        let cell = self
-            .dashboard_queries
-            .result_cell(DashboardQueryKey::new(range))
-            .await;
-        let mut result = cell
-            .get_or_init(|| self.load_dashboard_summary(range))
-            .await
-            .clone()?;
-        result.trend = trend(kind, result.observation.trend.clone())?;
+        let mut result = self.load_dashboard_summary(range).await?;
+        result.trend = trend(
+            kind,
+            result.observation.trend.clone(),
+            result.observation.analytics.clone(),
+        )?;
        Ok(result)
    }

@@ -263,12 +226,16 @@ impl ObservabilityService for DefaultObservabilityService {
        range: TimeRange,
        kind: TrendKind,
    ) -> Result<Trend, AdminError> {
-        let points = self
+        let observation = self
            .store
-            .dashboard_trend(range)
+            .usage_insights_observation(
+                range,
+                UsageFilter::default(),
+                Granularity::for_range(range),
+            )
            .await
            .map_err(|error| map_store_error(error, "dashboard trend"))?;
-        trend(kind, points)
+        trend(kind, observation.trend, observation.overview.analytics)
    }

    async fn usage_records(&self, query: UsageQuery) -> Result<UsagePage, AdminError> {
@@ -319,21 +286,23 @@ impl ObservabilityService for DefaultObservabilityService {
        range: TimeRange,
        filter: UsageFilter,
    ) -> Result<UsageInsights, AdminError> {
-        let aggregates = async {
-            futures::try_join!(
-                self.store.usage_summary(range, filter.clone()),
-                self.store.usage_trend(range, filter.clone()),
-            )
-            .map_err(|error| map_store_error(error, "usage insights"))
-        };
-        let ((overview, trend), standard_costs) = futures::try_join!(
-            aggregates,
-            recover_standard_costs(
-                &self.providers,
-                self.store
-                    .usage_calculated_billing_facts(range, filter.clone()),
-            ),
-        )?;
+        let granularity = Granularity::for_range(range);
+        let observation = self
+            .store
+            .usage_insights_observation(range, filter, granularity)
+            .await
+            .map_err(|error| map_store_error(error, "usage insights"))?;
+        let mut standard_costs = UsageCostScenarios::default();
+        for point in observation.costs {
+            if let Some(amount) = point.standard_amount {
+                standard_costs.standard.add(point.bucket_start, amount)?;
+            }
+            if let Some(amount) = point.no_cache_amount {
+                standard_costs.no_cache.add(point.bucket_start, amount)?;
+            }
+        }
+        let overview = observation.overview;
+        let trend = observation.trend;
        build_usage_insights(overview, trend, standard_costs)
    }

@@ -345,7 +314,7 @@ impl ObservabilityService for DefaultObservabilityService {
    ) -> Result<DiagnosticsResult, AdminError> {
        let observation = self
            .store
-            .usage_diagnostics(range, filter, dimension)
+            .usage_diagnostics(range, filter, dimension, 100)
            .await
            .map_err(|error| map_store_error(error, "usage diagnostics"))?;
        let items = observation
@@ -387,7 +356,11 @@ impl ObservabilityService for DefaultObservabilityService {
                }
            })
            .collect::<Vec<_>>();
-        Ok(DiagnosticsResult { dimension, items })
+        Ok(DiagnosticsResult {
+            analytics: observation.analytics,
+            dimension,
+            items,
+        })
    }

    async fn ops_errors(&self, query: OpsErrorQuery) -> Result<OpsErrorPage, AdminError> {
@@ -421,8 +394,9 @@ fn build_usage_insights(
    }

    let requests = &overview.requests;
-    let failed_requests = service_failure_count(requests);
-    let health_requests = requests.success_count.saturating_add(failed_requests);
+    let health_window = HealthWindow::from_metrics(requests);
+    let failed_requests = health_window.failed_requests;
+    let health_requests = health_window.eligible_requests();
    let health = UsageInsightsHealth {
        total_requests: requests.request_count,
        success_requests: requests.success_count,
@@ -440,17 +414,19 @@ fn build_usage_insights(
        points: trend
            .iter()
            .map(|point| {
-                let failed_requests = service_failure_count(&point.metrics);
-                let health_requests = point.metrics.success_count.saturating_add(failed_requests);
+                let health_window = HealthWindow::from_metrics(&point.metrics);
                UsageInsightsHealthPoint {
                    total_requests: point.metrics.request_count,
                    bucket_start: point.bucket_start,
                    success_requests: point.metrics.success_count,
-                    failed_requests,
+                    failed_requests: health_window.failed_requests,
                    cancelled_requests: point.metrics.cancelled_count,
                    incomplete_requests: point.metrics.incomplete_count,
                    caller_error_requests: point.metrics.caller_error_count,
-                    error_rate: rate_or_zero(failed_requests, health_requests),
+                    error_rate: rate_or_zero(
+                        health_window.non_success_requests(),
+                        health_window.eligible_requests(),
+                    ),
                }
            })
            .collect(),
@@ -531,14 +507,14 @@ fn build_usage_insights(
        tier_premium,
        tokens_per_request: rate_or_zero(requests.total_tokens, requests.request_count),
        cost_per_successful_request,
-        cached_token_rate: rate_or_zero(requests.cached_tokens, requests.input_tokens),
+        cached_token_rate: rate_or_zero(requests.cached_input_tokens, requests.input_tokens),
        cache_hit_request_rate: ratio(
            requests.cache_hit_request_count,
            requests.cache_eligible_request_count,
        ),
        input_tokens: requests.input_tokens,
        output_tokens: requests.output_tokens,
-        cached_tokens: requests.cached_tokens,
+        cached_input_tokens: requests.cached_input_tokens,
        total_tokens: requests.total_tokens,
        points: trend
            .iter()
@@ -546,7 +522,7 @@ fn build_usage_insights(
                bucket_start: point.bucket_start,
                input_tokens: point.metrics.input_tokens,
                output_tokens: point.metrics.output_tokens,
-                cached_tokens: point.metrics.cached_tokens,
+                cached_input_tokens: point.metrics.cached_input_tokens,
                total_tokens: point.metrics.total_tokens,
                estimated_cost: usd_cost(&point.costs),
                standard_cost: standard_costs_by_bucket.get(&point.bucket_start).cloned(),
@@ -556,7 +532,7 @@ fn build_usage_insights(
                    usd_cost(&point.costs).as_ref(),
                ),
                cached_token_rate: rate_or_zero(
-                    point.metrics.cached_tokens,
+                    point.metrics.cached_input_tokens,
                    point.metrics.input_tokens,
                ),
                cache_hit_request_rate: ratio(
@@ -569,6 +545,7 @@ fn build_usage_insights(
        coverage: overview.attempts.cost_coverage.clone(),
    };
    Ok(UsageInsights {
+        analytics: overview.analytics,
        granularity,
        health,
        performance,
@@ -618,58 +595,65 @@ struct UsageCostScenarios {
    no_cache: ScenarioCosts,
 }

-async fn recover_standard_costs(
-    providers: &ProviderAdminRegistry,
-    mut facts: UsageCalculatedBillingStream<'_>,
-) -> Result<UsageCostScenarios, AdminError> {
-    let mut scenarios = UsageCostScenarios::default();
-    while let Some(mut fact) = facts
-        .try_next()
-        .await
-        .map_err(|error| map_store_error(error, "usage billing facts"))?
-    {
+/// 在后台投影时恢复费用场景，查询不再逐请求读取计费快照
+pub struct ProviderUsageBillingProjector {
+    providers: ProviderAdminRegistry,
+}
+
+impl ProviderUsageBillingProjector {
+    #[must_use]
+    pub fn new(providers: ProviderAdminRegistry) -> Self {
+        Self { providers }
+    }
+}
+
+impl UsageBillingProjector for ProviderUsageBillingProjector {
+    fn project(
+        &self,
+        fact: &UsageCalculatedBillingFact,
+    ) -> Result<UsageBillingProjection, AdminError> {
        let Ok(provider_kind) = ProviderKind::new(fact.provider_kind.clone()) else {
-            continue;
+            return Ok(UsageBillingProjection::default());
        };
        let input = ProviderBillingInput {
            upstream_model_id: fact.upstream_model_id.clone(),
            service_tier: fact.service_tier.clone(),
            input_tokens: fact.input_tokens,
            output_tokens: fact.output_tokens,
-            cached_tokens: fact.cached_tokens,
-            cache_write_tokens: fact.cache_write_tokens,
+            cached_input_tokens: fact.cached_input_tokens,
+            cache_write_input_tokens: fact.cache_write_input_tokens,
            total: fact.total.clone(),
        };
        let breakdown = match fact
            .breakdown
-            .take()
-            .filter(|b| b.total_amount == input.total)
+            .as_ref()
+            .filter(|breakdown| breakdown.total_amount == input.total)
+            .cloned()
            .map_or_else(
-                || providers.calculated_billing(&provider_kind, &input),
-                |b| Ok(Some(b)),
+                || self.providers.calculated_billing(&provider_kind, &input),
+                |breakdown| Ok(Some(breakdown)),
            ) {
            Ok(breakdown) => breakdown,
-            Err(error) if error.kind() == ProviderAdminErrorKind::Unsupported => continue,
+            Err(error) if error.kind() == ProviderAdminErrorKind::Unsupported => {
+                return Ok(UsageBillingProjection::default());
+            }
            Err(error) => return Err(map_provider_error(error, "usage billing")),
        };
        let Some(breakdown) = breakdown else {
-            continue;
+            return Ok(UsageBillingProjection::default());
        };
        if !breakdown
            .standard_amount
            .currency
            .eq_ignore_ascii_case("USD")
        {
-            continue;
-        }
-        scenarios
-            .standard
-            .add(fact.bucket_start, breakdown.standard_amount.amount.clone())?;
-        if let Some(no_cache_cost) = no_cache_cost(&fact, &breakdown) {
-            scenarios.no_cache.add(fact.bucket_start, no_cache_cost)?;
+            return Ok(UsageBillingProjection::default());
        }
+        Ok(UsageBillingProjection {
+            standard_amount: Some(breakdown.standard_amount.amount.clone()),
+            no_cache_amount: no_cache_cost(fact, &breakdown),
+        })
    }
-    Ok(scenarios)
 }

 fn no_cache_cost(
@@ -680,19 +664,21 @@ fn no_cache_cost(
    let input_tokens = fact
        .input_tokens?
        .checked_sub(image.map_or(0, |i| i.input_tokens))?;
-    let cached_tokens = fact
-        .cached_tokens
+    let cached_input_tokens = fact
+        .cached_input_tokens
        .unwrap_or_default()
-        .checked_sub(image.map_or(0, |i| i.cached_tokens))?
+        .checked_sub(image.map_or(0, |i| i.cached_input_tokens))?
        .min(input_tokens);
-    let cache_write_tokens = fact
-        .cache_write_tokens
+    let cache_write_input_tokens = fact
+        .cache_write_input_tokens
        .unwrap_or_default()
-        .min(input_tokens.saturating_sub(cached_tokens));
+        .min(input_tokens.saturating_sub(cached_input_tokens));
    let input_rate = decimal(&breakdown.input_price_per_million.amount)?;
    let replaced_input_amount = input_rate
        .scaled()
-        .checked_mul(u128::from(cached_tokens.saturating_add(cache_write_tokens)))?
+        .checked_mul(u128::from(
+            cached_input_tokens.saturating_add(cache_write_input_tokens),
+        ))?
        .checked_div(1_000_000)?;
    let mut total = decimal(&breakdown.total_amount.amount)?
        .scaled()
@@ -702,7 +688,7 @@ fn no_cache_cost(
    if let Some(image) = image {
        let image_no_cache = decimal(&image.input_price_per_million.amount)?
            .scaled()
-            .checked_mul(u128::from(image.cached_tokens))?
+            .checked_mul(u128::from(image.cached_input_tokens))?
            .checked_div(1_000_000)?;
        total = total
            .checked_sub(decimal(&image.cache_read_amount.amount)?.scaled())?
@@ -827,8 +813,8 @@ impl DefaultObservabilityService {
                service_tier: record.service_tier.clone(),
                input_tokens: record.input_tokens,
                output_tokens: record.output_tokens,
-                cached_tokens: record.cached_tokens,
-                cache_write_tokens: record.cache_write_tokens,
+                cached_input_tokens: record.cached_input_tokens,
+                cache_write_input_tokens: record.cache_write_input_tokens,
                total: total.clone(),
            };
            if let Ok(Some(breakdown)) = self.providers.calculated_billing(&provider_kind, &input) {
@@ -859,8 +845,8 @@ impl DefaultObservabilityService {
                service_tier: record.service_tier.clone(),
                input_tokens: record.input_tokens,
                output_tokens: record.output_tokens,
-                cached_tokens: record.cached_tokens,
-                cache_write_tokens: record.cache_write_tokens,
+                cached_input_tokens: record.cached_input_tokens,
+                cache_write_input_tokens: record.cache_write_input_tokens,
                total: total.clone(),
            };
            if let Ok(Some(breakdown)) = self.providers.calculated_billing(&provider_kind, &input) {
@@ -949,7 +935,11 @@ pub(super) fn health_timeline_at(
    })
 }

-fn trend(kind: TrendKind, points: Vec<RequestMetricPoint>) -> Result<Trend, AdminError> {
+fn trend(
+    kind: TrendKind,
+    points: Vec<RequestMetricPoint>,
+    analytics: crate::model::analytics::AnalyticsMetadata,
+) -> Result<Trend, AdminError> {
    let mut metrics = RequestMetrics::default();
    let mut coverage = CostCoverage::default();
    let mut costs = BTreeMap::<String, DecimalAmount>::new();
@@ -984,7 +974,7 @@ fn trend(kind: TrendKind, points: Vec<RequestMetricPoint>) -> Result<Trend, Admi
    let service_failure_count = service_failure_count(&metrics);
    let success_rate = ratio(
        metrics.success_count,
-        metrics.success_count.saturating_add(service_failure_count),
+        HealthWindow::from_metrics(&metrics).eligible_requests(),
    );
    let cache_hit_request_rate = ratio(
        metrics.cache_hit_request_count,
@@ -1005,13 +995,14 @@ fn trend(kind: TrendKind, points: Vec<RequestMetricPoint>) -> Result<Trend, Admi
        .filter_map(|point| point.metrics.output_throughput_p50)
        .min();
    Ok(Trend {
+        analytics,
        kind,
        points: points.into_iter().map(trend_point).collect(),
        summary: TrendSummary {
            request_count: metrics.request_count,
            input_tokens: metrics.input_tokens,
            output_tokens: metrics.output_tokens,
-            cached_tokens: metrics.cached_tokens,
+            cached_input_tokens: metrics.cached_input_tokens,
            total_tokens: metrics.total_tokens,
            service_failure_count,
            average_latency_ms,
@@ -1042,12 +1033,18 @@ fn trend_point(point: RequestMetricPoint) -> TrendPoint {
            point.metrics.first_token_latency_sum_ms,
            point.metrics.first_token_latency_count,
        ),
-        cached_token_rate: rate_or_zero(point.metrics.cached_tokens, point.metrics.input_tokens),
+        cached_token_rate: rate_or_zero(
+            point.metrics.cached_input_tokens,
+            point.metrics.input_tokens,
+        ),
        cache_hit_request_rate: ratio(
            point.metrics.cache_hit_request_count,
            point.metrics.cache_eligible_request_count,
        ),
-        success_rate: ratio(point.metrics.success_count, point.metrics.request_count),
+        success_rate: ratio(
+            point.metrics.success_count,
+            HealthWindow::from_metrics(&point.metrics).eligible_requests(),
+        ),
        metrics: point.metrics,
        cost_coverage: point.cost_coverage,
        costs: point.costs,
@@ -1068,11 +1065,13 @@ fn dashboard_period_metrics(
        result.request_count = result.request_count.saturating_add(metrics.request_count);
        result.input_tokens = result.input_tokens.saturating_add(metrics.input_tokens);
        result.output_tokens = result.output_tokens.saturating_add(metrics.output_tokens);
-        result.cached_tokens = result.cached_tokens.saturating_add(metrics.cached_tokens);
+        result.cached_input_tokens = result
+            .cached_input_tokens
+            .saturating_add(metrics.cached_input_tokens);
        result.total_tokens = result.total_tokens.saturating_add(metrics.total_tokens);
    }
-    result.cached_token_rate = rate_or_zero(result.cached_tokens, result.input_tokens);
-    result.observed_cached_token_rate = ratio(result.cached_tokens, result.input_tokens);
+    result.cached_token_rate = rate_or_zero(result.cached_input_tokens, result.input_tokens);
+    result.observed_cached_token_rate = ratio(result.cached_input_tokens, result.input_tokens);
    result
 }

@@ -1089,13 +1088,15 @@ fn add_request_metrics(total: &mut RequestMetrics, value: &RequestMetrics) {
        .saturating_add(value.caller_error_count);
    total.input_tokens = total.input_tokens.saturating_add(value.input_tokens);
    total.output_tokens = total.output_tokens.saturating_add(value.output_tokens);
-    total.cached_tokens = total.cached_tokens.saturating_add(value.cached_tokens);
-    total.cache_write_tokens = total
-        .cache_write_tokens
-        .saturating_add(value.cache_write_tokens);
-    total.reasoning_tokens = total
-        .reasoning_tokens
-        .saturating_add(value.reasoning_tokens);
+    total.cached_input_tokens = total
+        .cached_input_tokens
+        .saturating_add(value.cached_input_tokens);
+    total.cache_write_input_tokens = total
+        .cache_write_input_tokens
+        .saturating_add(value.cache_write_input_tokens);
+    total.reasoning_output_tokens = total
+        .reasoning_output_tokens
+        .saturating_add(value.reasoning_output_tokens);
    total.total_tokens = total.total_tokens.saturating_add(value.total_tokens);
    total.first_token_latency_sum_ms = total
        .first_token_latency_sum_ms
@@ -1143,20 +1144,29 @@ struct HealthWindow {
 }

 impl HealthWindow {
+    fn from_metrics(metrics: &RequestMetrics) -> Self {
+        Self {
+            success_requests: metrics.success_count,
+            failed_requests: service_failure_count(metrics),
+            cancelled_requests: metrics.cancelled_count,
+            incomplete_requests: metrics.incomplete_count,
+            caller_error_requests: metrics.caller_error_count,
+        }
+    }
+
+    // 未完成保留交付终态，但上游失败、超时和进程中断都不能视为服务成功
+    fn non_success_requests(self) -> u64 {
+        self.failed_requests
+            .saturating_add(self.incomplete_requests)
+    }
+
+    fn eligible_requests(self) -> u64 {
+        self.success_requests
+            .saturating_add(self.non_success_requests())
+    }
+
    fn add_metrics(&mut self, metrics: &RequestMetrics) {
-        self.success_requests = self.success_requests.saturating_add(metrics.success_count);
-        self.failed_requests = self
-            .failed_requests
-            .saturating_add(service_failure_count(metrics));
-        self.cancelled_requests = self
-            .cancelled_requests
-            .saturating_add(metrics.cancelled_count);
-        self.incomplete_requests = self
-            .incomplete_requests
-            .saturating_add(metrics.incomplete_count);
-        self.caller_error_requests = self
-            .caller_error_requests
-            .saturating_add(metrics.caller_error_count);
+        self.add_window(Self::from_metrics(metrics));
    }

    fn add_window(&mut self, other: Self) {
@@ -1175,15 +1185,13 @@ impl HealthWindow {
 }

 fn health_status(bucket: HealthWindow, is_future: bool) -> HealthStatus {
-    let eligible_requests = bucket
-        .success_requests
-        .saturating_add(bucket.failed_requests);
+    let eligible_requests = bucket.eligible_requests();
    if is_future {
        HealthStatus::Future
    } else if eligible_requests == 0 {
        HealthStatus::NoData
    } else if bucket.success_requests == 0
-        && bucket.failed_requests >= HEALTH_TIMELINE_UNAVAILABLE_FAILURE_THRESHOLD
+        && bucket.non_success_requests() >= HEALTH_TIMELINE_UNAVAILABLE_FAILURE_THRESHOLD
    {
        HealthStatus::Unavailable
    } else if eligible_requests < HEALTH_TIMELINE_MIN_SAMPLE_SIZE {
@@ -1198,9 +1206,7 @@ fn health_status(bucket: HealthWindow, is_future: bool) -> HealthStatus {
 }

 fn health_reliability(bucket: HealthWindow) -> Option<f64> {
-    let eligible_requests = bucket
-        .success_requests
-        .saturating_add(bucket.failed_requests);
+    let eligible_requests = bucket.eligible_requests();
    (eligible_requests > 0)
        .then(|| bucket.success_requests as f64 / eligible_requests as f64 * 100.0)
 }
@@ -0,0 +1,300 @@
+//! 有界统计缓存：身份和完整筛选参与键，统计发布代次使旧快照失效
+
+use crate::model::observability::*;
+use crate::ports::store::{
+    AdminStoreError, AdminStoreErrorKind, AdminStoreResult, ObservabilityStore,
+};
+use async_trait::async_trait;
+use chrono::{DateTime, Utc};
+use std::{collections::HashMap, future::Future, hash::Hash, sync::Arc, time::Duration};
+use tokio::{sync::Mutex, time::Instant};
+
+const CAPACITY: usize = 64;
+const TTL: Duration = Duration::from_secs(15);
+const MAX_STALE: Duration = Duration::from_secs(60);
+
+type Slot<T> = Arc<Mutex<Option<Cached<T>>>>;
+struct Cached<T> {
+    value: T,
+    created: Instant,
+}
+struct Entry<T> {
+    slot: Slot<T>,
+    touched: Instant,
+}
+struct Cache<K, T> {
+    entries: Mutex<HashMap<K, Entry<T>>>,
+}
+impl<K, T> Default for Cache<K, T> {
+    fn default() -> Self {
+        Self {
+            entries: Mutex::new(HashMap::new()),
+        }
+    }
+}
+
+trait AnalyticsValue: Clone {
+    fn metadata(&mut self) -> &mut AnalyticsMetadata;
+}
+impl AnalyticsValue for DashboardObservation {
+    fn metadata(&mut self) -> &mut AnalyticsMetadata {
+        &mut self.analytics
+    }
+}
+impl AnalyticsValue for UsageOverview {
+    fn metadata(&mut self) -> &mut AnalyticsMetadata {
+        &mut self.analytics
+    }
+}
+impl AnalyticsValue for UsageInsightsObservation {
+    fn metadata(&mut self) -> &mut AnalyticsMetadata {
+        &mut self.overview.analytics
+    }
+}
+impl AnalyticsValue for DiagnosticsObservation {
+    fn metadata(&mut self) -> &mut AnalyticsMetadata {
+        &mut self.analytics
+    }
+}
+
+impl<K: Eq + Hash, T: AnalyticsValue> Cache<K, T> {
+    async fn get<F, Fut>(
+        &self,
+        key: K,
+        store: &dyn ObservabilityStore,
+        ttl: Duration,
+        load: F,
+    ) -> AdminStoreResult<T>
+    where
+        F: FnOnce() -> Fut,
+        Fut: Future<Output = AdminStoreResult<T>>,
+    {
+        // 刷新失败后的同键等待也计入预算，避免串行重试把延迟放大为队列长度倍数
+        tokio::time::timeout(
+            store.query_timeout(),
+            self.get_within_budget(key, store, ttl, load),
+        )
+        .await
+        .map_err(|source| {
+            AdminStoreError::new(
+                AdminStoreErrorKind::Unavailable,
+                "observability cache",
+                "observability cache execution budget is exhausted",
+            )
+            .with_source(source)
+        })?
+    }
+
+    async fn get_within_budget<F, Fut>(
+        &self,
+        key: K,
+        store: &dyn ObservabilityStore,
+        ttl: Duration,
+        load: F,
+    ) -> AdminStoreResult<T>
+    where
+        F: FnOnce() -> Fut,
+        Fut: Future<Output = AdminStoreResult<T>>,
+    {
+        let slot = {
+            let mut entries = self.entries.lock().await;
+            if !entries.contains_key(&key) && entries.len() >= CAPACITY {
+                let oldest = entries
+                    .iter()
+                    .filter(|(_, entry)| Arc::strong_count(&entry.slot) == 1)
+                    .min_by_key(|(_, entry)| entry.touched)
+                    .map(|(_, entry)| entry.touched);
+                if let Some(oldest) = oldest {
+                    entries.retain(|_, entry| entry.touched != oldest);
+                }
+            }
+            if !entries.contains_key(&key) && entries.len() >= CAPACITY {
+                drop(entries);
+                return load().await;
+            }
+            let entry = entries.entry(key).or_insert_with(|| Entry {
+                slot: Arc::new(Mutex::new(None)),
+                touched: Instant::now(),
+            });
+            entry.touched = Instant::now();
+            entry.slot.clone()
+        };
+        // 同键刷新只执行一次；失败不会缓存成成功，也不延长旧结果寿命
+        let mut cached = slot.lock().await;
+        // 等锁期间代次可能推进；取得同键锁后再核对，失败时也不能回用已被新统计替代的快照
+        let generation = store.analytics_cache_generation().await?;
+        if let Some(entry) = cached.as_mut()
+            && entry.value.metadata().generation == generation
+            && entry.created.elapsed() < ttl
+        {
+            return Ok(with_age(entry.value.clone(), false));
+        }
+        match load().await {
+            Ok(value) => {
+                *cached = Some(Cached {
+                    value: value.clone(),
+                    created: Instant::now(),
+                });
+                Ok(value)
+            }
+            Err(error) => {
+                if ttl == TTL
+                    && error.kind() == AdminStoreErrorKind::Unavailable
+                    && let Some(entry) = cached.as_mut()
+                    && entry.created.elapsed() <= MAX_STALE
+                    && Utc::now()
+                        .signed_duration_since(entry.value.metadata().generated_at)
+                        .to_std()
+                        .unwrap_or_default()
+                        <= MAX_STALE
+                    && entry.value.metadata().state != AnalyticsState::Building
+                    && entry.value.metadata().generation
+                        == store.analytics_cache_generation().await?
+                {
+                    return Ok(with_age(entry.value.clone(), true));
+                }
+                Err(error)
+            }
+        }
+    }
+}
+
+fn with_age<T: AnalyticsValue>(mut value: T, stale: bool) -> T {
+    let metadata = value.metadata();
+    metadata.lag_seconds = metadata.lag_seconds.saturating_add(
+        Utc::now()
+            .signed_duration_since(metadata.generated_at)
+            .num_seconds()
+            .max(0) as u64,
+    );
+    if stale {
+        metadata.state = AnalyticsState::Stale;
+    }
+    value
+}
+
+type UsageKey = (TimeRange, UsageFilter);
+pub(crate) struct CachedObservabilityStore {
+    inner: Arc<dyn ObservabilityStore>,
+    dashboard: Cache<DashboardQuery, DashboardObservation>,
+    summaries: Cache<UsageKey, UsageOverview>,
+    insights: Cache<(UsageKey, Granularity), UsageInsightsObservation>,
+    diagnostics: Cache<(UsageKey, DiagnosticDimension, u16), DiagnosticsObservation>,
+}
+impl CachedObservabilityStore {
+    pub(crate) fn new(inner: Arc<dyn ObservabilityStore>) -> Self {
+        Self {
+            inner,
+            dashboard: Cache::default(),
+            summaries: Cache::default(),
+            insights: Cache::default(),
+            diagnostics: Cache::default(),
+        }
+    }
+}
+
+#[async_trait]
+impl ObservabilityStore for CachedObservabilityStore {
+    fn query_timeout(&self) -> Duration {
+        self.inner.query_timeout()
+    }
+
+    async fn analytics_cache_generation(&self) -> AdminStoreResult<u64> {
+        self.inner.analytics_cache_generation().await
+    }
+    async fn dashboard_summary(
+        &self,
+        query: DashboardQuery,
+        observed_at: DateTime<Utc>,
+    ) -> AdminStoreResult<DashboardObservation> {
+        // 复合概览还包含账号容量和最近请求，保持原有两秒实时刷新上限
+        self.dashboard
+            .get(
+                query.clone(),
+                self.inner.as_ref(),
+                Duration::from_secs(2),
+                || self.inner.dashboard_summary(query, observed_at),
+            )
+            .await
+    }
+    async fn dashboard_trend(
+        &self,
+        range: TimeRange,
+        granularity: Granularity,
+    ) -> AdminStoreResult<Vec<RequestMetricPoint>> {
+        self.inner.dashboard_trend(range, granularity).await
+    }
+    async fn usage_trend(
+        &self,
+        range: TimeRange,
+        filter: UsageFilter,
+        granularity: Granularity,
+    ) -> AdminStoreResult<Vec<RequestMetricPoint>> {
+        self.inner.usage_trend(range, filter, granularity).await
+    }
+    async fn usage_insights_observation(
+        &self,
+        range: TimeRange,
+        filter: UsageFilter,
+        granularity: Granularity,
+    ) -> AdminStoreResult<UsageInsightsObservation> {
+        self.insights
+            .get(
+                ((range, filter.clone()), granularity),
+                self.inner.as_ref(),
+                TTL,
+                || {
+                    self.inner
+                        .usage_insights_observation(range, filter, granularity)
+                },
+            )
+            .await
+    }
+    async fn usage_summary(
+        &self,
+        range: TimeRange,
+        filter: UsageFilter,
+    ) -> AdminStoreResult<UsageOverview> {
+        self.summaries
+            .get((range, filter.clone()), self.inner.as_ref(), TTL, || {
+                self.inner.usage_summary(range, filter)
+            })
+            .await
+    }
+    async fn usage_diagnostics(
+        &self,
+        range: TimeRange,
+        filter: UsageFilter,
+        dimension: DiagnosticDimension,
+        limit: u16,
+    ) -> AdminStoreResult<DiagnosticsObservation> {
+        self.diagnostics
+            .get(
+                ((range, filter.clone()), dimension, limit),
+                self.inner.as_ref(),
+                TTL,
+                || {
+                    self.inner
+                        .usage_diagnostics(range, filter, dimension, limit)
+                },
+            )
+            .await
+    }
+    async fn list_usage_records(&self, query: UsageQuery) -> AdminStoreResult<UsagePage> {
+        self.inner.list_usage_records(query).await
+    }
+    async fn usage_record_detail(&self, request_id: &str) -> AdminStoreResult<UsageDetail> {
+        self.inner.usage_record_detail(request_id).await
+    }
+    async fn list_ops_errors(&self, query: OpsErrorQuery) -> AdminStoreResult<OpsErrorPage> {
+        self.inner.list_ops_errors(query).await
+    }
+
+    async fn diagnostic_errors(
+        &self,
+        target: &crate::model::diagnostics::DiagnosticTarget,
+        limit: u16,
+    ) -> AdminStoreResult<Vec<crate::model::observability::OpsError>> {
+        self.inner.diagnostic_errors(target, limit).await
+    }
+}
@@ -52,6 +52,7 @@ impl PluginResourceAccess for DefaultPluginResourceAccess {
                    owner,
                    resource_key,
                    NewAccountGroup {
+                        allow_image_generation: command.allow_image_generation,
                        id,
                        name: command.name,
                        description: command.description,
@@ -305,6 +305,9 @@ impl PluginsService {
            .get(id)
            .await
            .map_err(|error| map_store_error(error, "proxy"))?;
+        if !record.enabled {
+            return Err(AdminError::invalid("下载代理已禁用，请启用或改为直连"));
+        }
        Ok(Some(PluginDistributionEgress::new(
            record.id,
            record.revision,
@@ -2,7 +2,10 @@

 use std::collections::{BTreeMap, BTreeSet};

-use gateway_core::{policy::ClientApiKeyId, routing::AccountGroupId};
+use gateway_core::{
+    policy::ClientApiKeyId,
+    routing::{AccountGroupId, extensions::ExtensionSetReference},
+};
 use secrecy::ExposeSecret;

 use super::PluginsService;
@@ -41,14 +44,11 @@ impl PluginsService {
            .map_err(|error| map_store_error(error, "plugin"))?;
        let warning = match self
            .inspector
-            .inspect(artifact.archive.clone(), Some(digest.to_owned()))
+            .compatibility_warning(artifact.archive, digest.to_owned())
            .await
        {
-            Ok(_) => PackageStatus {
-                warning: self
-                    .inspector
-                    .compatibility_warning(artifact.archive, digest.to_owned())
-                    .await?,
+            Ok(warning) => PackageStatus {
+                warning,
                load_error: None,
            },
            Err(error) if error.kind() == AdminErrorKind::Invalid => PackageStatus {
@@ -368,25 +368,8 @@ impl PluginsService {
            )
            .await
            .map_err(|e| map_store_error(e, "plugin"))?;
-        let prepared = if result.config_revision == candidate_revision
-            && result.instance.revision == candidate_revision
-        {
-            prepared
-        } else {
-            snapshot.config_revision = result.config_revision;
-            snapshot
-                .instances
-                .retain(|item| item.id != result.instance.id);
-            snapshot.instances.push(result.instance.clone());
-            apply_replacements(&mut snapshot, &replacements);
-            self.preparation.prepare(snapshot).await?
-        };
-        self.preparation
-            .activate_state(&prepared, &result.instance)
+        self.publish_instance(snapshot, prepared, &result, &replacements)
            .await?;
-        // prepared 的强引用跨过提交与唯一发布入口，防止候选在被读取之前回收
-        publish_committed(self.snapshots.as_ref(), result.config_revision).await?;
-        drop(prepared);
        Ok(result)
    }

@@ -463,48 +446,45 @@ impl PluginsService {
                    .await);
            }
        };
-        if let Err(error) = self
-            .preparation
-            .migrate_state(&migration_prepared, transition.clone())
-            .await
-        {
-            return Err(self
-                .recover_failed_state_transition(
-                    Some(&transition.id),
-                    &previous,
-                    &previous_state,
-                    disabled_revision,
+        // 迁移开始后的所有提交前失败都走同一恢复出口；提交成功后不再回滚旧配置
+        let committed = async {
+            self.preparation
+                .migrate_state(&migration_prepared, transition.clone())
+                .await?;
+            let mut current = self
+                .store
+                .load_instances()
+                .await
+                .map_err(|error| map_store_error(error, "plugin"))?;
+            if current.config_revision != expected_revision {
+                return Err(AdminError::conflict("迁移期间插件配置已发生变化"));
+            }
+            let candidate_revision = next_revision(expected_revision)?;
+            target.revision = candidate_revision;
+            current.instances.retain(|item| item.id != target.id);
+            current.instances.push(target.clone());
+            current.config_revision = candidate_revision;
+            apply_replacements(&mut current, replacements);
+            let prepared = self.preparation.prepare(current.clone()).await?;
+            let result = self
+                .store
+                .save_instance_replacing(
+                    target,
+                    expected_revision,
+                    PluginStateCommit {
+                        configuration: target_state,
+                        transition_id: Some(transition.id.clone()),
+                    },
+                    replacements,
                    context,
-                    error,
                )
-                .await);
+                .await
+                .map_err(|error| map_store_error(error, "plugin"))?;
+            Ok((current, prepared, result))
        }
-
-        let mut current = self
-            .store
-            .load_instances()
-            .await
-            .map_err(|error| map_store_error(error, "plugin"))?;
-        if current.config_revision != expected_revision {
-            return Err(self
-                .recover_failed_state_transition(
-                    Some(&transition.id),
-                    &previous,
-                    &previous_state,
-                    disabled_revision,
-                    context,
-                    AdminError::conflict("迁移期间插件配置已发生变化"),
-                )
-                .await);
-        }
-        let candidate_revision = next_revision(expected_revision)?;
-        target.revision = candidate_revision;
-        current.instances.retain(|item| item.id != target.id);
-        current.instances.push(target.clone());
-        current.config_revision = candidate_revision;
-        apply_replacements(&mut current, replacements);
-        let prepared = match self.preparation.prepare(current.clone()).await {
-            Ok(prepared) => prepared,
+        .await;
+        let (current, prepared, result) = match committed {
+            Ok(committed) => committed,
            Err(error) => {
                return Err(self
                    .recover_failed_state_transition(
@@ -518,53 +498,9 @@ impl PluginsService {
                    .await);
            }
        };
-        let result = match self
-            .store
-            .save_instance_replacing(
-                target,
-                expected_revision,
-                PluginStateCommit {
-                    configuration: target_state,
-                    transition_id: Some(transition.id.clone()),
-                },
-                replacements,
-                context,
-            )
-            .await
-        {
-            Ok(result) => result,
-            Err(error) => {
-                return Err(self
-                    .recover_failed_state_transition(
-                        Some(&transition.id),
-                        &previous,
-                        &previous_state,
-                        disabled_revision,
-                        context,
-                        map_store_error(error, "plugin"),
-                    )
-                    .await);
-            }
-        };
-        let prepared = if result.config_revision == candidate_revision
-            && result.instance.revision == candidate_revision
-        {
-            prepared
-        } else {
-            current.config_revision = result.config_revision;
-            current
-                .instances
-                .retain(|item| item.id != result.instance.id);
-            current.instances.push(result.instance.clone());
-            apply_replacements(&mut current, replacements);
-            self.preparation.prepare(current).await?
-        };
-        self.preparation
-            .activate_state(&prepared, &result.instance)
+        self.publish_instance(current, prepared, &result, replacements)
            .await?;
-        publish_committed(self.snapshots.as_ref(), result.config_revision).await?;
        drop(migration_prepared);
-        drop(prepared);
        Ok(result)
    }

@@ -615,22 +551,8 @@ impl PluginsService {
                )
                .await
                .map_err(|error| map_store_error(error, "plugin"))?;
-            let prepared = if mutation.config_revision == candidate_revision
-                && mutation.instance.revision == candidate_revision
-            {
-                prepared
-            } else {
-                snapshot.config_revision = mutation.config_revision;
-                snapshot
-                    .instances
-                    .retain(|item| item.id != mutation.instance.id);
-                snapshot.instances.push(mutation.instance.clone());
-                self.preparation.prepare(snapshot).await?
-            };
-            self.preparation
-                .activate_state(&prepared, &mutation.instance)
+            self.publish_instance(snapshot, prepared, &mutation, &[])
                .await?;
-            publish_committed(self.snapshots.as_ref(), mutation.config_revision).await?;
            Ok::<(), AdminError>(())
        }
        .await;
@@ -646,6 +568,35 @@ impl PluginsService {
        }
    }

+    /// 以事务返回的版本激活并发布，候选强引用必须覆盖整个提交后阶段
+    async fn publish_instance(
+        &self,
+        mut snapshot: PluginInstanceSnapshot,
+        prepared: ExtensionSetReference,
+        mutation: &PluginInstanceMutation,
+        replacements: &[PluginInstanceReplacement],
+    ) -> Result<(), AdminError> {
+        let prepared = if mutation.config_revision == snapshot.config_revision
+            && mutation.instance.revision == snapshot.config_revision
+        {
+            prepared
+        } else {
+            snapshot.config_revision = mutation.config_revision;
+            snapshot
+                .instances
+                .retain(|item| item.id != mutation.instance.id);
+            snapshot.instances.push(mutation.instance.clone());
+            apply_replacements(&mut snapshot, replacements);
+            self.preparation.prepare(snapshot).await?
+        };
+        self.preparation
+            .activate_state(&prepared, &mutation.instance)
+            .await?;
+        publish_committed(self.snapshots.as_ref(), mutation.config_revision).await?;
+        drop(prepared);
+        Ok(())
+    }
+
    pub async fn delete_instance(
        &self,
        id: &str,
@@ -2,7 +2,8 @@

 use std::sync::Arc;

-use gateway_core::runtime::{RuntimeSnapshotHandle, extensions::ExtensionSetReference};
+use gateway_core::routing::extensions::ExtensionSetReference;
+use gateway_core::runtime::RuntimeSnapshotHandle;

 use crate::{
    model::{
@@ -1,6 +1,9 @@
 //! 账号出站代理的管理、账号解绑与连通性测试用例

-use std::sync::Arc;
+use std::sync::{
+    Arc,
+    atomic::{AtomicBool, Ordering},
+};

 use async_trait::async_trait;
 use futures::{StreamExt, stream};
@@ -27,6 +30,16 @@ use crate::{

 #[async_trait]
 pub trait ProxiesService: Send + Sync {
+    async fn create_batch(
+        &self,
+        commands: Vec<Result<NewProxy, AdminError>>,
+        context: &MutationContext,
+    ) -> Result<Vec<ProxyBatchResult<ProxyMutation>>, AdminError>;
+    async fn test_batch(
+        &self,
+        commands: Vec<Result<TestProxy, AdminError>>,
+        context: &MutationContext,
+    ) -> Result<Vec<ProxyBatchResult<ProxyRecord>>, AdminError>;
    async fn list(&self, query: ProxyListQuery) -> Result<ProxyPage, AdminError>;
    async fn list_accounts(
        &self,
@@ -61,10 +74,10 @@ pub trait ProxiesService: Send + Sync {
        detect_location: bool,
        context: &MutationContext,
    ) -> Result<ProxyRecord, AdminError>;
-    /// 探测未保存的连接地址，不写入代理记录或修改账号绑定
+    /// 探测未保存的连接地址或服务器直连出口，不写入配置或修改账号绑定
    async fn probe(
        &self,
-        proxy: &OutboundProxy,
+        proxy: Option<&OutboundProxy>,
        detect_location: bool,
    ) -> Result<ProxyTestResult, AdminError>;
 }
@@ -96,6 +109,75 @@ impl DefaultProxiesService {

 #[async_trait]
 impl ProxiesService for DefaultProxiesService {
+    async fn create_batch(
+        &self,
+        commands: Vec<Result<NewProxy, AdminError>>,
+        context: &MutationContext,
+    ) -> Result<Vec<ProxyBatchResult<ProxyMutation>>, AdminError> {
+        validate_batch_size(commands.len())?;
+        let mut stopped = false;
+        let mut results = Vec::with_capacity(commands.len());
+        for command in commands {
+            if stopped {
+                results.push(ProxyBatchResult::Skipped);
+                continue;
+            }
+            let result = match command {
+                Ok(command) => self.create(command, context).await,
+                Err(error) => Err(error),
+            };
+            stopped = result.as_ref().is_err_and(batch_should_stop);
+            results.push(ProxyBatchResult::Completed(result));
+        }
+        Ok(results)
+    }
+
+    async fn test_batch(
+        &self,
+        commands: Vec<Result<TestProxy, AdminError>>,
+        context: &MutationContext,
+    ) -> Result<Vec<ProxyBatchResult<ProxyRecord>>, AdminError> {
+        validate_batch_size(commands.len())?;
+        let mut ids = std::collections::HashSet::with_capacity(commands.len());
+        if commands
+            .iter()
+            .filter_map(|command| command.as_ref().ok())
+            .any(|command| !ids.insert(&command.id))
+        {
+            return Err(AdminError::invalid("批量测试不能包含重复代理"));
+        }
+        let stopped = AtomicBool::new(false);
+        // 与单条测试共用全局容量，批次最多占用两槽，保留交互操作的容量
+        Ok(stream::iter(commands)
+            .map(|command| {
+                let stopped = &stopped;
+                async move {
+                    if stopped.load(Ordering::Relaxed) {
+                        return ProxyBatchResult::Skipped;
+                    }
+                    let result = match command {
+                        Ok(command) => {
+                            self.test(
+                                &command.id,
+                                command.revision,
+                                command.detect_location,
+                                context,
+                            )
+                            .await
+                        }
+                        Err(error) => Err(error),
+                    };
+                    if result.as_ref().is_err_and(batch_should_stop) {
+                        stopped.store(true, Ordering::Relaxed);
+                    }
+                    ProxyBatchResult::Completed(result)
+                }
+            })
+            .buffered(2)
+            .collect()
+            .await)
+    }
+
    async fn remove_account(
        &self,
        proxy_id: &str,
@@ -194,7 +276,7 @@ impl ProxiesService for DefaultProxiesService {
            .transpose()
            .map_err(|_| AdminError::invalid("代理位置不合法"))?;
        command.test = if command.auto_location {
-            Some(self.probe(&command.proxy, true).await?)
+            Some(self.probe(Some(&command.proxy), true).await?)
        } else {
            None
        };
@@ -233,7 +315,7 @@ impl ProxiesService for DefaultProxiesService {
            if command.auto_location.unwrap_or(current.auto_location)
                && (!current.auto_location || proxy != &current.proxy)
            {
-                command.test = Some(self.probe(proxy, true).await?);
+                command.test = Some(self.probe(Some(proxy), true).await?);
            }
        }
        let result = self
@@ -262,7 +344,7 @@ impl ProxiesService for DefaultProxiesService {

    async fn probe(
        &self,
-        proxy: &OutboundProxy,
+        proxy: Option<&OutboundProxy>,
        detect_location: bool,
    ) -> Result<ProxyTestResult, AdminError> {
        let _permit = self.test_slots.try_acquire().map_err(|_| {
@@ -292,7 +374,7 @@ impl ProxiesService for DefaultProxiesService {
        // 手动解析只为本次测试请求位置，不改变自动跟随的持久配置
        let result = self
            .probe
-            .test(&record.proxy, record.auto_location || detect_location)
+            .test(Some(&record.proxy), record.auto_location || detect_location)
            .await;
        let mutation = self
            .store
@@ -313,3 +395,22 @@ fn validate_name(value: &str) -> Result<String, AdminError> {
    }
    Ok(value.to_owned())
 }
+
+fn validate_batch_size(size: usize) -> Result<(), AdminError> {
+    if size == 0 || size > MAX_PROXY_BATCH_SIZE {
+        return Err(AdminError::invalid("一次需要提交 1 至 100 条代理"));
+    }
+    Ok(())
+}
+
+fn batch_should_stop(error: &AdminError) -> bool {
+    matches!(
+        error.kind(),
+        AdminErrorKind::Unauthorized
+            | AdminErrorKind::Forbidden
+            | AdminErrorKind::BadGateway
+            | AdminErrorKind::UpstreamResultUnknown
+            | AdminErrorKind::Unavailable
+            | AdminErrorKind::Internal
+    )
+}
@@ -0,0 +1,14 @@
+//! 管理事务提交后的运行快照发布入口
+
+use crate::model::AdminError;
+use gateway_core::{routing::ConfigRevision, runtime::SnapshotControl};
+
+pub(super) async fn publish_committed(
+    snapshot: &dyn SnapshotControl,
+    revision: crate::model::Revision,
+) -> Result<(), AdminError> {
+    let revision = ConfigRevision::new(revision.get())
+        .map_err(|_| AdminError::internal("已提交的配置版本不合法"))?;
+    snapshot.publish_committed(revision).await;
+    Ok(())
+}
@@ -3,7 +3,6 @@
 use std::sync::Arc;

 use async_trait::async_trait;
-use gateway_core::policy::CodexClientVersion;
 use gateway_core::runtime::SnapshotControl;
 use rand_core::{OsRng, RngCore as _};

@@ -23,6 +22,13 @@ use super::{map_store_error, publish_committed};
 /// API 消费的 Runtime settings 管理服务
 #[async_trait]
 pub trait SettingsService: Send + Sync {
+    async fn preview_privacy_policy(
+        &self,
+        _request: gateway_core::settings::privacy::PrivacyPreviewRequest,
+    ) -> Result<gateway_core::settings::privacy::PrivacyPreviewResult, AdminError> {
+        Err(AdminError::invalid("隐私预览不可用"))
+    }
+
    async fn preview_pricing_sync(
        &self,
    ) -> Result<crate::model::pricing::PricingSyncPreview, AdminError>;
@@ -103,54 +109,36 @@ impl DefaultSettingsService {
 }

 fn validate_settings(command: &ReplaceRuntimeSettings) -> Result<(), AdminError> {
-    let valid = command.request_location.validate().is_ok()
-        && command.responses_max_decompressed_body_bytes > 0
-        && isize::try_from(command.responses_max_decompressed_body_bytes).is_ok()
-        && command.refresh_margin_seconds > 0
-        && command.refresh_concurrency > 0
-        && command.max_waiting_per_key <= 1_000
-        && command.max_waiting_per_account <= 1_000
-        && (1..=120).contains(&command.concurrency_wait_timeout_seconds)
-        && crate::model::retention::RetentionPolicy::try_new(
-            command.usage_retention_days,
-            command.ops_event_retention_days,
-            command.audit_retention_days,
-        )
-        .is_ok()
-        && valid_client_version(command.min_codex_desktop_version.as_deref())
-        && valid_client_version(command.min_codex_cli_version.as_deref())
-        && valid_probe_model(command.account_auto_freeze_probe_model.as_deref())
-        && gateway_core::provider_ports::valid_warmup_schedule_time(
-            &command.account_warmup_schedule_time,
-        )
-        && valid_probe_model(command.account_warmup_model.as_deref())
-        && (!command.account_warmup_enabled || command.account_warmup_model.is_some())
-        && i64::try_from(command.request_interval_ms).is_ok()
-        && (2..=1_000).contains(&command.account_auto_freeze_threshold)
-        && (60..=3_600).contains(&command.account_auto_freeze_window_seconds)
-        && (300..=604_800).contains(&command.account_auto_freeze_duration_seconds);
-    if valid {
-        Ok(())
-    } else {
-        Err(AdminError::invalid("运行时设置不满足约束"))
-    }
-}
-
-fn valid_client_version(value: Option<&str>) -> bool {
-    value.is_none_or(|value| CodexClientVersion::parse(value).is_ok())
-}
-
-fn valid_probe_model(value: Option<&str>) -> bool {
-    value.is_none_or(|value| {
-        !value.is_empty()
-            && value.len() <= 128
-            && value == value.trim()
-            && !value.bytes().any(|byte| byte.is_ascii_control())
-    })
+    crate::model::settings::validate_model_mappings(
+        command
+            .model_mappings
+            .iter()
+            .map(|(requested, upstream)| (requested.as_str(), upstream.as_str())),
+    )
+    .map_err(|_| AdminError::invalid("运行时设置不满足约束"))?;
+    command
+        .values
+        .validate()
+        .map_err(|_| AdminError::invalid("运行时设置不满足约束"))
 }

 #[async_trait]
 impl SettingsService for DefaultSettingsService {
+    async fn preview_privacy_policy(
+        &self,
+        request: gateway_core::settings::privacy::PrivacyPreviewRequest,
+    ) -> Result<gateway_core::settings::privacy::PrivacyPreviewResult, AdminError> {
+        self.profile_provider("openai")?
+            .preview_privacy_policy(request)
+            .map_err(|error| {
+                AdminError::invalid(format!(
+                    "第 {} 条规则：{}",
+                    error.rule_index + 1,
+                    error.reason
+                ))
+            })
+    }
+
    async fn preview_pricing_sync(
        &self,
    ) -> Result<crate::model::pricing::PricingSyncPreview, AdminError> {
@@ -272,10 +260,12 @@ impl SettingsService for DefaultSettingsService {
            PricingChange::Replace(pricing) => {
                pricing.validate().map_err(AdminError::invalid)?;
                if command.provider == "xai"
-                    && pricing
-                        .bands
-                        .keys()
-                        .any(|band| matches!(band.as_str(), "image" | "flex" | "long_flex"))
+                    && pricing.bands.keys().any(|band| {
+                        matches!(
+                            band.as_str(),
+                            "image" | "flex" | "long_flex" | "ultrafast" | "long_ultrafast"
+                        )
+                    })
                {
                    return Err(AdminError::invalid("xAI 不支持此价格档位"));
                }
@@ -376,6 +366,17 @@ impl SettingsService for DefaultSettingsService {
        mut command: ReplaceRuntimeSettings,
    ) -> Result<RuntimeSettings, AdminError> {
        validate_settings(&command)?;
+        if command.values.codex_privacy_policy != Default::default() {
+            self.profile_provider("openai")?
+                .compile_privacy_policy(&command.values.codex_privacy_policy)
+                .map_err(|error| {
+                    AdminError::invalid(format!(
+                        "第 {} 条规则：{}",
+                        error.rule_index + 1,
+                        error.reason
+                    ))
+                })?;
+        }
        if command
            .request_profile_updates
            .values()
@@ -0,0 +1,184 @@
+//! 公开原生用量读写与纯计价，插件拥有跨调用流程和恢复策略
+
+mod pricing;
+mod validation;
+
+use crate::{
+    model::{
+        auth::{AdminAuditEvent, AuditActorKind},
+        usage_data::*,
+    },
+    ports::{provider::ProviderAdminRegistry, store::SettingsStore, usage_data::*},
+};
+use async_trait::async_trait;
+use std::sync::Arc;
+
+#[async_trait]
+pub trait UsageDataService: Send + Sync {
+    async fn list_aggregates(
+        &self,
+        request: ListUsageAggregates,
+    ) -> UsageDataResult<UsageAggregatePage>;
+    async fn write_aggregates(
+        &self,
+        actor: &UsageActor,
+        request: WriteUsageAggregates,
+    ) -> UsageDataResult<UsageAggregateWriteResult>;
+    async fn get_record(&self, request: GetUsageRecord) -> UsageDataResult<UsageRecord>;
+    async fn list_records(&self, request: ListUsageRecords) -> UsageDataResult<UsageRecordPage>;
+    async fn write_records(
+        &self,
+        actor: &UsageActor,
+        request: WriteUsageRecords,
+    ) -> UsageDataResult<UsageWriteResult>;
+    async fn evaluate_pricing(
+        &self,
+        request: EvaluateUsagePricing,
+    ) -> UsageDataResult<UsagePricingEvaluation>;
+}
+
+pub struct DefaultUsageDataService {
+    store: Arc<dyn UsageDataStore>,
+    settings: Arc<dyn SettingsStore>,
+    providers: ProviderAdminRegistry,
+}
+impl DefaultUsageDataService {
+    pub fn new(
+        store: Arc<dyn UsageDataStore>,
+        settings: Arc<dyn SettingsStore>,
+        providers: ProviderAdminRegistry,
+    ) -> Self {
+        Self {
+            store,
+            settings,
+            providers,
+        }
+    }
+}
+
+#[async_trait]
+impl UsageDataService for DefaultUsageDataService {
+    async fn list_aggregates(
+        &self,
+        request: ListUsageAggregates,
+    ) -> UsageDataResult<UsageAggregatePage> {
+        validation::query(&request.filter, request.cursor.as_deref(), request.limit)?;
+        self.store.list_aggregates(request).await
+    }
+    async fn write_aggregates(
+        &self,
+        actor: &UsageActor,
+        request: WriteUsageAggregates,
+    ) -> UsageDataResult<UsageAggregateWriteResult> {
+        validation::bounded(&request, request.changes.len())?;
+        let mut changes = Vec::with_capacity(request.changes.len());
+        for change in request.changes {
+            validation::aggregate(&change)?;
+            let identity = match &change {
+                UsageAggregateChange::Put { aggregate } => &aggregate.identity,
+                UsageAggregateChange::Delete { identity } => identity,
+            };
+            let action = match &change {
+                UsageAggregateChange::Put { .. } => "usage.aggregate.put",
+                UsageAggregateChange::Delete { .. } => "usage.aggregate.delete",
+            };
+            let audit = audit_event(
+                actor,
+                action,
+                "usage_aggregate",
+                &identity.key,
+                vec!["aggregate".into()],
+            );
+            changes.push((change, audit));
+        }
+        self.store
+            .write_aggregates(StoredAggregateWrite { changes })
+            .await
+    }
+    async fn get_record(&self, request: GetUsageRecord) -> UsageDataResult<UsageRecord> {
+        validation::text(&request.id, 128)?;
+        self.store.get_record(request).await
+    }
+    async fn list_records(&self, request: ListUsageRecords) -> UsageDataResult<UsageRecordPage> {
+        validation::query(&request.filter, request.cursor.as_deref(), request.limit)?;
+        self.store.list_records(request).await
+    }
+    async fn write_records(
+        &self,
+        actor: &UsageActor,
+        request: WriteUsageRecords,
+    ) -> UsageDataResult<UsageWriteResult> {
+        validation::bounded(&request, request.changes.len())?;
+        let mut changes = Vec::with_capacity(request.changes.len());
+        for change in request.changes {
+            validation::change(&change)?;
+            let action = match &change {
+                UsageRecordChange::Put { .. } => "usage.put",
+                UsageRecordChange::Update { .. } => "usage.update",
+                UsageRecordChange::Delete { .. } => "usage.delete",
+            };
+            let fields = match &change {
+                UsageRecordChange::Update { tokens, cost, .. } => tokens
+                    .as_ref()
+                    .map(|_| "tokens".to_owned())
+                    .into_iter()
+                    .chain(cost.as_ref().map(|_| "cost".to_owned()))
+                    .collect(),
+                _ => vec!["record".into()],
+            };
+            let audit = audit_event(actor, action, "model_request", change.id(), fields);
+            changes.push((change, audit));
+        }
+        self.store.write_records(StoredUsageWrite { changes }).await
+    }
+    async fn evaluate_pricing(
+        &self,
+        request: EvaluateUsagePricing,
+    ) -> UsageDataResult<UsagePricingEvaluation> {
+        validation::bounded(&request, request.items.len())?;
+        let stored = self
+            .settings
+            .load_pricing()
+            .await
+            .map_err(|_| UsageDataError::unavailable("读取价目失败"))?;
+        let prices = gateway_core::metering::merge_pricing(stored.synced, &stored.overrides);
+        let mut items = Vec::with_capacity(request.items.len());
+        for input in request.items {
+            validation::text(&input.id, 128)?;
+            items.push(self.evaluate_one(input, &prices)?);
+        }
+        Ok(UsagePricingEvaluation { items })
+    }
+}
+
+fn audit_event(
+    actor: &UsageActor,
+    action: &str,
+    entity_kind: &str,
+    id: &str,
+    changed_fields: Vec<String>,
+) -> AdminAuditEvent {
+    let actor_ref = match actor {
+        UsageActor::Plugin {
+            instance_id,
+            publisher,
+            name,
+            ..
+        } => format!("plugin:{publisher}/{name}:{instance_id}"),
+        UsageActor::Admin { subject } => format!("admin:{subject}"),
+        UsageActor::System => "system".into(),
+    };
+    AdminAuditEvent {
+        id: format!("audit_{}", uuid::Uuid::now_v7().simple()),
+        actor_kind: AuditActorKind::System,
+        actor_admin_user_id: None,
+        actor_ref,
+        request_id: None,
+        action: action.into(),
+        entity_kind: entity_kind.into(),
+        entity_ref: id.to_owned(),
+        config_revision: None,
+        changed_fields,
+        occurred_at: chrono::Utc::now(),
+    }
+}
@@ -0,0 +1,87 @@
+//! 复用 Provider 的单请求 Token 计价规则，不写入历史或账本
+
+use super::{DefaultUsageDataService, validation};
+use crate::{
+    model::usage_data::*,
+    ports::provider::{ProviderAdminErrorKind, ProviderUsagePricingInput},
+};
+use gateway_core::{
+    metering::{PricingOverrides, Usage},
+    routing::ProviderKind,
+};
+
+impl DefaultUsageDataService {
+    pub(super) fn evaluate_one(
+        &self,
+        input: UsagePricingInput,
+        prices: &PricingOverrides,
+    ) -> UsageDataResult<UsagePricingResult> {
+        validation::text(&input.provider, 128)?;
+        validation::text(&input.model, 128)?;
+        validation::tokens(&input.tokens)?;
+        let unavailable = |reason: &str| UsagePricingResult::NotEstimable {
+            id: input.id.clone(),
+            reason: reason.into(),
+        };
+        let kind = ProviderKind::new(input.provider.clone())
+            .map_err(|_| UsageDataError::invalid("Provider 无效"))?;
+        let Ok(provider) = self.providers.require(&kind) else {
+            return Ok(unavailable("Provider 没有可用的计价规则"));
+        };
+        let tokens = &input.tokens;
+        let price = match &input.price {
+            UsagePriceSelection::Current => prices
+                .get(&input.provider)
+                .and_then(|models| models.get(&input.model)),
+            UsagePriceSelection::Override { price } => {
+                price.validate().map_err(UsageDataError::invalid)?;
+                Some(price.as_ref())
+            }
+        };
+        let request = ProviderUsagePricingInput {
+            upstream_model_id: input.model.clone(),
+            service_tier: input.service_tier.clone(),
+            usage: Usage {
+                input_tokens: tokens.input_tokens.map(UsageCount::get),
+                output_tokens: tokens.output_tokens.map(UsageCount::get),
+                cached_input_tokens: tokens.cached_input_tokens.map(UsageCount::get),
+                cache_write_input_tokens: tokens.cache_write_input_tokens.map(UsageCount::get),
+                reasoning_output_tokens: tokens.reasoning_output_tokens.map(UsageCount::get),
+                image_input_tokens: tokens.image_input_tokens.map(UsageCount::get),
+                image_output_tokens: tokens.image_output_tokens.map(UsageCount::get),
+                total_tokens: tokens.total_tokens.map(UsageCount::get),
+            },
+        };
+        let calculated = match provider.evaluate_usage_pricing(&request, price) {
+            Ok(Some(value)) => value,
+            Ok(None) => return Ok(unavailable("用量不完整、包含图像或价格不可用")),
+            Err(error)
+                if matches!(
+                    error.kind(),
+                    ProviderAdminErrorKind::Unsupported | ProviderAdminErrorKind::Invalid
+                ) =>
+            {
+                return Ok(unavailable("Provider 不支持该计价输入"));
+            }
+            Err(_) => return Err(UsageDataError::unavailable("Provider 计价失败")),
+        };
+        Ok(UsagePricingResult::Estimated {
+            id: input.id,
+            cost: UsageCost::Known {
+                source: UsageCostSource::Calculated,
+                amount: calculated.total_amount().amount().canonical(),
+                currency: calculated.total_amount().currency().as_str().into(),
+            },
+            breakdown: UsagePricingBreakdown {
+                input_amount: calculated.input_amount().amount().canonical(),
+                output_amount: calculated.output_amount().amount().canonical(),
+                cache_read_amount: calculated.cache_read_amount().amount().canonical(),
+                cache_write_amount: calculated.cache_write_amount().amount().canonical(),
+                standard_amount: calculated.standard_amount().amount().canonical(),
+                long_context_billing_applied: calculated.long_context_billing_applied(),
+                service_tier: calculated.service_tier().map(str::to_owned),
+                custom_multiplier_bps: calculated.custom_multiplier_bps(),
+            },
+        })
+    }
+}
@@ -0,0 +1,194 @@
+//! 用量输入沿用原生记录的数值、时间和资源边界
+
+use crate::model::usage_data::*;
+use gateway_core::metering::Decimal;
+use serde::Serialize;
+
+pub(super) fn text(value: &str, max: usize) -> UsageDataResult<()> {
+    if value.trim().is_empty() || value.len() > max || value.chars().any(char::is_control) {
+        return Err(UsageDataError::invalid("文本为空、过长或包含控制字符"));
+    }
+    Ok(())
+}
+pub(super) fn bounded(value: &impl Serialize, count: usize) -> UsageDataResult<()> {
+    if count == 0
+        || count > USAGE_DATA_MAX_TARGETS
+        || serde_json::to_vec(value)
+            .map_err(|_| UsageDataError::invalid("请求编码失败"))?
+            .len()
+            > USAGE_DATA_MAX_REQUEST_BYTES
+    {
+        return Err(UsageDataError::new(
+            UsageErrorKind::CapacityExceeded,
+            "每次操作接受 1～500 项且不超过 2 MiB",
+        ));
+    }
+    Ok(())
+}
+pub(super) fn tokens(value: &UsageTokens) -> UsageDataResult<()> {
+    if [
+        value.input_tokens,
+        value.output_tokens,
+        value.cached_input_tokens,
+        value.cache_write_input_tokens,
+        value.reasoning_output_tokens,
+        value.image_input_tokens,
+        value.image_output_tokens,
+        value.total_tokens,
+    ]
+    .into_iter()
+    .flatten()
+    .any(|v| v.get() > i64::MAX as u64)
+    {
+        return Err(UsageDataError::invalid("Token 超出原生存储范围"));
+    }
+    Ok(())
+}
+fn cost(value: &UsageCost) -> UsageDataResult<()> {
+    if let UsageCost::Known {
+        amount, currency, ..
+    } = value
+    {
+        let _ = amount
+            .parse::<Decimal>()
+            .map_err(|_| UsageDataError::invalid("费用不是有效十进制数"))?;
+        if currency.len() != 3 || !currency.bytes().all(|b| b.is_ascii_uppercase()) {
+            return Err(UsageDataError::invalid("费用或币种不符合原生存储范围"));
+        }
+    }
+    Ok(())
+}
+pub(super) fn change(value: &UsageRecordChange) -> UsageDataResult<()> {
+    text(value.id(), 128)?;
+    match value {
+        UsageRecordChange::Put { data, .. } => {
+            text(&data.client_key_ref, 128)?;
+            for v in [
+                &data.provider,
+                &data.account_ref,
+                &data.requested_model,
+                &data.model,
+                &data.service_tier,
+            ]
+            .into_iter()
+            .flatten()
+            {
+                text(v, 128)?;
+            }
+            for v in [
+                &data.protocol,
+                &data.operation,
+                &data.endpoint,
+                &data.client_transport,
+            ] {
+                text(v, 256)?;
+            }
+            if data.outcome == UsageOutcome::Running
+                || data
+                    .completed_at_ms
+                    .is_none_or(|end| end < data.started_at_ms)
+            {
+                return Err(UsageDataError::invalid("只允许写入已结束的请求明细"));
+            }
+            for at in [Some(data.started_at_ms), data.completed_at_ms]
+                .into_iter()
+                .flatten()
+            {
+                if chrono::DateTime::from_timestamp_millis(at).is_none() {
+                    return Err(UsageDataError::invalid("请求时间无效"));
+                }
+            }
+            tokens(&data.tokens)?;
+            cost(&data.cost)?;
+        }
+        UsageRecordChange::Update {
+            tokens: new_tokens,
+            cost: new_cost,
+            ..
+        } => {
+            if new_tokens.is_none() && new_cost.is_none() {
+                return Err(UsageDataError::invalid("修改必须指定 Token 或费用"));
+            }
+            if let Some(value) = new_tokens {
+                tokens(value)?;
+            }
+            if let Some(value) = new_cost {
+                cost(value)?;
+            }
+        }
+        UsageRecordChange::Delete { .. } => {}
+    }
+    Ok(())
+}
+pub(super) fn query(
+    filter: &UsageRecordFilter,
+    cursor: Option<&str>,
+    limit: Option<u16>,
+) -> UsageDataResult<()> {
+    if limit.is_some_and(|v| v == 0 || v > USAGE_DATA_MAX_PAGE_SIZE)
+        || filter.start_ms >= filter.end_ms
+        || chrono::DateTime::from_timestamp_millis(filter.start_ms).is_none()
+        || chrono::DateTime::from_timestamp_millis(filter.end_ms).is_none()
+    {
+        return Err(UsageDataError::invalid("查询时间范围或分页大小无效"));
+    }
+    for v in [
+        &filter.provider,
+        &filter.model,
+        &filter.account_ref,
+        &filter.client_key_ref,
+    ]
+    .into_iter()
+    .flatten()
+    {
+        text(v, 128)?;
+    }
+    if cursor.is_some_and(|v| v.len() > 4096) {
+        return Err(UsageDataError::invalid("游标过长"));
+    }
+    Ok(())
+}
+
+pub(super) fn aggregate(value: &UsageAggregateChange) -> UsageDataResult<()> {
+    let identity = match value {
+        UsageAggregateChange::Put { aggregate } => &aggregate.identity,
+        UsageAggregateChange::Delete { identity } => identity,
+    };
+    text(&identity.key, 128)?;
+    if chrono::DateTime::from_timestamp_millis(identity.bucket_start_ms).is_none() {
+        return Err(UsageDataError::invalid("聚合归属时间无效"));
+    }
+    let d = &identity.dimensions;
+    for value in [
+        &d.provider,
+        &d.model,
+        &d.account_ref,
+        &d.client_key_ref,
+        &d.operation,
+        &d.transport,
+    ]
+    .into_iter()
+    .flatten()
+    {
+        text(value, 128)?;
+    }
+    if let UsageAggregateChange::Put { aggregate } = value {
+        if aggregate.costs.len() > 32 {
+            return Err(UsageDataError::invalid("费用币种数量超过限制"));
+        }
+        for (currency, amount) in &aggregate.costs {
+            if currency.len() != 3
+                || !currency.bytes().all(|b| b.is_ascii_uppercase())
+                || amount.len() > 128
+            {
+                return Err(UsageDataError::invalid("聚合费用格式无效"));
+            }
+            amount
+                .strip_prefix('-')
+                .unwrap_or(amount)
+                .parse::<Decimal>()
+                .map_err(|_| UsageDataError::invalid("聚合费用不是有效十进制数"))?;
+        }
+    }
+    Ok(())
+}
@@ -519,9 +519,16 @@ impl DatabaseDumpPort for FakeDumpPort {

    async fn cleanup_staging(
        &self,
-        _backup_id: &str,
+        backup_id: &str,
    ) -> Result<(), gateway_admin::model::backup::BackupError> {
-        Ok(())
+        match std::fs::remove_file(self.dir.path().join(format!("{backup_id}.dump"))) {
+            Ok(()) => Ok(()),
+            Err(error) if error.kind() == std::io::ErrorKind::NotFound => Ok(()),
+            Err(_) => Err(gateway_admin::model::backup::BackupError::new(
+                gateway_admin::model::backup::code::PG_DUMP_FAILED,
+                "cleanup failed".to_owned(),
+            )),
+        }
    }
 }

@@ -529,6 +536,9 @@ impl DatabaseDumpPort for FakeDumpPort {
 pub(crate) struct FakeObjectStore {
    pub(crate) objects: Mutex<std::collections::HashMap<String, Vec<u8>>>,
    upload_error: Option<BackupError>,
+    head_error: Option<BackupError>,
+    delete_error: Option<BackupError>,
+    connection_error: Option<BackupError>,
 }

 impl FakeObjectStore {
@@ -536,6 +546,9 @@ impl FakeObjectStore {
        Self {
            objects: Mutex::new(std::collections::HashMap::new()),
            upload_error: None,
+            head_error: None,
+            delete_error: None,
+            connection_error: None,
        }
    }

@@ -545,6 +558,21 @@ impl FakeObjectStore {
        self
    }

+    pub(crate) fn fail_head(mut self, code: &'static str) -> Self {
+        self.head_error = Some(BackupError::new(code, "HEAD failed".into()));
+        self
+    }
+
+    pub(crate) fn fail_delete(mut self, code: &'static str) -> Self {
+        self.delete_error = Some(BackupError::new(code, "DELETE failed".into()));
+        self
+    }
+
+    pub(crate) fn fail_connection(mut self, code: &'static str) -> Self {
+        self.connection_error = Some(BackupError::new(code, "DELETE failed".into()));
+        self
+    }
+
    pub(crate) fn object(&self, key: &str) -> Option<Vec<u8>> {
        self.objects.lock().expect("objects").get(key).cloned()
    }
@@ -556,6 +584,14 @@ impl BackupObjectStorePort for FakeObjectStore {
        &self,
        _config: &BackupStorageConfig,
    ) -> Result<ConnectionTestResult, gateway_admin::model::backup::BackupError> {
+        if let Some(error) = &self.connection_error {
+            return Ok(ConnectionTestResult {
+                ok: false,
+                stage: "deleteObject",
+                code: Some(error.code()),
+                message: error.message().into(),
+            });
+        }
        Ok(ConnectionTestResult {
            ok: true,
            stage: "deleteObject",
@@ -590,6 +626,9 @@ impl BackupObjectStorePort for FakeObjectStore {
        _config: &BackupStorageConfig,
        object_key: &str,
    ) -> Result<Option<BackupObjectMetadata>, gateway_admin::model::backup::BackupError> {
+        if let Some(error) = &self.head_error {
+            return Err(error.clone());
+        }
        let Some(content) = self.object(object_key) else {
            return Ok(None);
        };
@@ -606,6 +645,9 @@ impl BackupObjectStorePort for FakeObjectStore {
        _config: &BackupStorageConfig,
        object_key: &str,
    ) -> Result<(), gateway_admin::model::backup::BackupError> {
+        if let Some(error) = &self.delete_error {
+            return Err(error.clone());
+        }
        self.objects.lock().expect("objects").remove(object_key);
        Ok(())
    }
@@ -683,6 +725,15 @@ impl AuthStore for FakeAuthStore {
    ) -> AdminStoreResult<()> {
        Ok(())
    }
+    async fn compare_exchange_session(
+        &self,
+        _: &str,
+        _: &gateway_admin::model::auth::AuthSession,
+        _: Option<&gateway_admin::model::auth::AuthSession>,
+    ) -> AdminStoreResult<Option<gateway_admin::model::auth::AuthSession>> {
+        Ok(None)
+    }
+
    async fn delete_session(
        &self,
        _session_id: &str,
@@ -55,6 +55,7 @@ async fn backup_task_runs_full_dump_upload_verify_pipeline() {
        .object(&seed.object_key)
        .expect("uploaded object exists");
    assert_eq!(stored.as_slice(), DUMP_CONTENT);
+    assert!(dump.inspect_staging(&seed.id).await.unwrap().is_none());
 }

 #[tokio::test]
@@ -259,3 +260,122 @@ async fn timezone_change_rebases_future_cursor_without_running_old_due_backup()
    task.run_cycle(&CancellationToken::new()).await.unwrap();
    assert!(repository.all_records().is_empty());
 }
+
+#[tokio::test]
+async fn completed_recovery_removes_staging_for_dumping_and_uploading_tasks() {
+    for (status, remote_exists) in [
+        (BackupStatus::Dumping, false),
+        (BackupStatus::Uploading, false),
+        (BackupStatus::Uploading, true),
+    ] {
+        let repository = Arc::new(FakeBackupRepository::new(configured_settings()));
+        let dump = Arc::new(FakeDumpPort::new());
+        let object_store = Arc::new(FakeObjectStore::new());
+        let seed = BackupRecordSeed {
+            id: backup_id("recovery-cleanup"),
+            trigger_kind: BackupTriggerKind::Manual,
+            scheduled_at: None,
+            object_key: "recovery.dump".to_owned(),
+            expires_at: None,
+        };
+        repository.insert_backup_record(seed.clone()).await.unwrap();
+        let artifact = dump
+            .dump(DumpRequest {
+                backup_id: seed.id.clone(),
+                cancellation: CancellationToken::new(),
+            })
+            .await
+            .unwrap();
+        repository.force_status(&seed.id, BackupStatus::Dumping);
+        if status == BackupStatus::Uploading {
+            repository
+                .transition_status(
+                    &seed.id,
+                    gateway_admin::model::backup::BackupStatusTransition::try_new(
+                        BackupStatus::Dumping,
+                        status,
+                    )
+                    .unwrap(),
+                    gateway_admin::ports::backup::StatusTransitionUpdate {
+                        size_bytes: Some(artifact.size_bytes),
+                        sha256: Some(artifact.sha256),
+                        ..Default::default()
+                    },
+                    Utc::now(),
+                )
+                .await
+                .unwrap();
+        }
+        if remote_exists {
+            object_store
+                .objects
+                .lock()
+                .unwrap()
+                .insert(seed.object_key.clone(), DUMP_CONTENT.to_vec());
+        }
+        BackupTask::new(repository.clone(), dump.clone(), object_store)
+            .run_cycle(&CancellationToken::new())
+            .await
+            .unwrap();
+        assert_eq!(repository.all_records()[0].status, BackupStatus::Completed);
+        assert!(
+            dump.inspect_staging(&seed.id).await.unwrap().is_none(),
+            "completed recovery must remove staging: {status:?}"
+        );
+    }
+}
+
+#[tokio::test]
+async fn manual_backup_preserves_primary_and_final_delete_failures() {
+    for (upload_fails, expiring) in [(false, false), (true, false), (false, true)] {
+        let repository = Arc::new(FakeBackupRepository::new(configured_settings()));
+        let dump = Arc::new(FakeDumpPort::new());
+        let store = FakeObjectStore::new().fail_delete(code::S3_PERMISSION_DENIED);
+        let store = Arc::new(if upload_fails {
+            store.fail_upload(code::S3_UPLOAD_FAILED, "上传失败")
+        } else {
+            store.fail_head(code::REMOTE_VERIFICATION_FAILED)
+        });
+        let seed = BackupRecordSeed {
+            id: backup_id("cleanup-failure"),
+            trigger_kind: BackupTriggerKind::Manual,
+            scheduled_at: None,
+            object_key: "codex/cleanup-failure.dump".into(),
+            expires_at: expiring.then(|| Utc::now() + Duration::hours(1)),
+        };
+        repository.insert_backup_record(seed.clone()).await.unwrap();
+        let task = BackupTask::new(repository.clone(), dump.clone(), store.clone());
+        task.run_cycle(&CancellationToken::new()).await.unwrap();
+        let records = repository.all_records();
+        let record = &records[0];
+        assert_eq!(record.status, BackupStatus::Failed);
+        assert_eq!(
+            record.error_code.as_deref(),
+            Some(if upload_fails {
+                code::S3_UPLOAD_FAILED
+            } else {
+                code::REMOTE_VERIFICATION_FAILED
+            })
+        );
+        let message = record.error_message.as_deref().unwrap();
+        assert!(message.contains(if upload_fails {
+            "上传失败"
+        } else {
+            "HEAD failed"
+        }));
+        assert!(message.contains("DeleteObject"));
+        assert!(message.contains(code::S3_PERMISSION_DENIED));
+        assert!(message.contains(if expiring {
+            "等待备份到期清理"
+        } else {
+            "未安排自动重试"
+        }));
+        assert_eq!(store.object(&seed.object_key).is_some(), !upload_fails);
+        assert!(dump.inspect_staging(&seed.id).await.unwrap().is_none());
+        task.run_cycle(&CancellationToken::new()).await.unwrap();
+        assert_eq!(
+            repository.all_records()[0].error_message,
+            record.error_message
+        );
+    }
+}
@@ -70,12 +70,6 @@ fn request_outcome_filter_should_preserve_known_and_bounded_other_values() {
    assert!(RequestOutcome::new("future\nstate").is_err());
 }

-#[test]
-fn time_range_should_accept_exactly_366_days() {
-    let end = Utc::now();
-    assert!(TimeRange::new(end - TimeDelta::days(366), end).is_ok());
-}
-
 #[test]
 fn time_range_should_reject_more_than_366_days() {
    let end = Utc::now();
@@ -176,9 +170,9 @@ fn usage_window_should_not_use_daily_rolling_usage_for_weekly_statistics() {
        success_count: 5,
        input_tokens: Some(100),
        output_tokens: Some(20),
-        cached_tokens: Some(80),
-        cache_write_tokens: Some(0),
-        reasoning_tokens: Some(0),
+        cached_input_tokens: Some(80),
+        cache_write_input_tokens: Some(0),
+        reasoning_output_tokens: Some(0),
        image_input_tokens: Some(0),
        image_output_tokens: Some(0),
        image_request_count: 0,
@@ -0,0 +1,17 @@
+//! 验证分组文本共用规则中的字符数、字节数和控制字符边界
+
+use gateway_admin::model::account_groups::validate_group_fields;
+
+#[test]
+fn group_fields_distinguish_name_characters_from_description_bytes() {
+    let name = "组".repeat(100);
+    let description = "é".repeat(2048);
+    assert!(validate_group_fields(&name, Some(&description)).is_ok());
+    assert!(validate_group_fields(&"组".repeat(101), None).is_err());
+    assert!(validate_group_fields("组", Some(&"é".repeat(2049))).is_err());
+    for name in ["", " 组", "组 ", "组\n名"] {
+        assert!(validate_group_fields(name, None).is_err());
+    }
+    assert!(validate_group_fields("组", Some("含\t制表符")).is_err());
+    assert!(validate_group_fields("组", Some("")).is_ok());
+}
@@ -0,0 +1,16 @@
+//! 验证 Client Key 分组集合的共同上限与唯一性规则
+
+use gateway_admin::model::client_keys::validate_group_ids;
+use gateway_core::routing::AccountGroupId;
+
+#[test]
+fn client_key_groups_reject_duplicates_and_more_than_one_thousand_ids() {
+    assert!(validate_group_ids(&[]).is_ok());
+    let mut groups: Vec<_> = (0..1000)
+        .map(|index| AccountGroupId::new(format!("grp_{index:032x}")).unwrap())
+        .collect();
+    assert!(validate_group_ids(&groups).is_ok());
+    groups.push(AccountGroupId::new("grp_ffffffffffffffffffffffffffffffff").unwrap());
+    assert!(validate_group_ids(&groups).is_err());
+    assert!(validate_group_ids(&[groups[0].clone(), groups[0].clone()]).is_err());
+}
@@ -1,7 +1,10 @@
 //! 模型模块测试：镜像 src/model/ 中带逻辑的模块

+mod account_groups;
 mod audit;
 mod backup;
+mod client_keys;
+mod observability;
 mod plugins;
 mod provider_credentials;
 mod quota_forecast;
@@ -0,0 +1,67 @@
+//! 验证观测查询和数值类型在 HTTP、管理及持久化边界共用的约束
+
+use gateway_admin::model::{
+    PageSize,
+    observability::{DecimalAmount, ObservabilityPageSize, PercentileMilliseconds},
+};
+
+#[test]
+fn observability_page_size_has_its_own_limit() {
+    for value in [1, 100] {
+        assert_eq!(ObservabilityPageSize::new(value).unwrap().get(), value);
+    }
+    for value in [0, 101, 150, 200, u16::MAX] {
+        assert!(ObservabilityPageSize::new(value).is_err(), "{value}");
+    }
+    assert!(PageSize::new(200).is_ok());
+}
+
+#[test]
+fn decimal_amount_preserves_numeric_precision_and_normalization() {
+    for (input, expected) in [
+        ("0", "0"),
+        (" 00012.34000 ", "12.34"),
+        ("00000.00000", "0"),
+        ("9999999999.9999999999", "9999999999.9999999999"),
+        ("0.0000000001", "0.0000000001"),
+    ] {
+        assert_eq!(input.parse::<DecimalAmount>().unwrap().as_str(), expected);
+    }
+    for input in [
+        "",
+        "-1",
+        "+1",
+        "NaN",
+        "inf",
+        "1e3",
+        ".1",
+        "1.",
+        "1.2.3",
+        "10000000000",
+        "0.00000000001",
+        "１",
+    ] {
+        assert!(input.parse::<DecimalAmount>().is_err(), "{input:?}");
+    }
+}
+
+#[test]
+fn decimal_arithmetic_keeps_the_shared_storage_precision() {
+    let max: DecimalAmount = "9999999999.9999999999".parse().unwrap();
+    let unit: DecimalAmount = "0.0000000001".parse().unwrap();
+    assert!(max.checked_add(&unit).is_none());
+    let one: DecimalAmount = "1".parse().unwrap();
+    assert_eq!(one.checked_div_u64(3).unwrap().as_str(), "0.3333333333");
+    assert!(one.checked_div_u64(0).is_none());
+    assert_eq!(one.checked_add(&unit).unwrap().as_str(), "1.0000000001");
+}
+
+#[test]
+fn percentile_preserves_interpolation_and_rejects_invalid_values() {
+    for value in [0.0, 0.125, 1.5, 95.75] {
+        assert_eq!(PercentileMilliseconds::new(value).unwrap().as_f64(), value);
+    }
+    for value in [-1.0, f64::NAN, f64::INFINITY, f64::NEG_INFINITY] {
+        assert!(PercentileMilliseconds::new(value).is_err());
+    }
+}
@@ -115,9 +115,9 @@ fn usage_window(key: &str, group: &str, seconds: u64) -> ProviderQuotaWindow {
            success_count: 0,
            input_tokens: None,
            output_tokens: None,
-            cached_tokens: None,
-            cache_write_tokens: None,
-            reasoning_tokens: None,
+            cached_input_tokens: None,
+            cache_write_input_tokens: None,
+            reasoning_output_tokens: None,
            image_input_tokens: None,
            image_output_tokens: None,
            image_request_count: 0,
@@ -223,8 +223,9 @@ fn pending_mutation_v1_should_round_trip_all_targets_and_owners() {
                assert_eq!(
                    PendingAuthorizationMutation::from_storage_v1(Value::Object(
                        expected.to_storage_v1()
-                    )),
-                    Ok(expected.clone()),
+                    ))
+                    .unwrap(),
+                    expected.clone(),
                );
                let with_proxy = expected
                    .with_outbound_proxy(Some(
@@ -237,8 +238,9 @@ fn pending_mutation_v1_should_round_trip_all_targets_and_owners() {
                assert_eq!(
                    PendingAuthorizationMutation::from_storage_v1(Value::Object(
                        with_proxy.to_storage_v1()
-                    )),
-                    Ok(with_proxy)
+                    ))
+                    .unwrap(),
+                    with_proxy
                );
            }
        }
@@ -32,9 +32,9 @@ fn window(key: &str, days: u64) -> ProviderQuotaWindow {
            success_count: 10,
            input_tokens: Some(900),
            output_tokens: Some(100),
-            cached_tokens: Some(800),
-            cache_write_tokens: None,
-            reasoning_tokens: None,
+            cached_input_tokens: Some(800),
+            cache_write_input_tokens: None,
+            reasoning_output_tokens: None,
            image_input_tokens: None,
            image_output_tokens: None,
            image_request_count: 0,
@@ -84,7 +84,7 @@ fn samples(quota: &ProviderQuota) -> Vec<QuotaForecastSample> {
                tokens: usage.total_tokens.unwrap_or(0),
                input_tokens: usage.input_tokens.unwrap_or(0),
                output_tokens: usage.output_tokens.unwrap_or(0),
-                cached_tokens: usage.cached_tokens.unwrap_or(0),
+                cached_input_tokens: usage.cached_input_tokens.unwrap_or(0),
                missing_token_count: u64::from(usage.total_tokens.is_none()),
                known_cost_count: if usd.is_some() {
                    usage.cost_coverage.known_count()
--- a/Show More
+++ b/Show More