chore(release): v3.26.2

Co-authored-by: Codex <noreply@openai.com>
fix(openai): keep turn rate limits scoped to the request
2026-11-07 00:05:49 +00:00 · 2026-10-14 16:16:30 +08:00 · 2026-10-14 16:01:49 +08:00 · 2026-10-14 15:54:47 +08:00 · 2026-10-14 14:30:58 +08:00 · 2026-10-14 13:50:51 +08:00
695 changed files with 37584 additions and 11308 deletions
@@ -6,7 +6,7 @@
 ## 清单与处理器

 - `publisher` 与机器短名 `name` 派生插件 ID，`displayName` 用于展示；复制示例后同时调整扩展项 ID 与注册结果
- `contributes` 每种能力最多一项，普通贡献项可省略派生 ID、能力版本和固定阶段；中间件必须声明版本 `3` 并显式选择阶段。自定义完整扩展项 ID 属于自己的插件命名空间，运行注册与规范化清单一致
+- `contributes` 每种能力最多一项，普通贡献项可省略派生 ID、能力版本和固定阶段；中间件必须声明版本 `4` 并显式选择阶段，上游适配器必须声明版本 `2`。自定义完整扩展项 ID 属于自己的插件命名空间，运行注册与规范化清单一致
 - 作者清单用 `Manifest::from_author_slice` 规范化，不手写 `package`、固定阶段或重复注册；CLI 生成平台、协议与资源摘要，版本范围不能使用全版本通配
 - 安装后宿主会按 `configurationSchema` 准备默认配置，配置完整即可启用；默认绑定的空范围不限制请求。需要业务参数时声明真实必填项，通过 `secretFields` 声明敏感字段，不依赖用户再走一遍自建安装向导
 - Rust 插件只依赖公开 `gateway-plugin-sdk`；需要异步会话辅助时开启 `io`，使用 `PluginSession` 管理握手、回调关联、流控、取消和关闭
@@ -177,8 +177,6 @@ jobs:
          host_path = "backend/crates/gateway-plugin/runtime/plugin-host-compatibility.json"
          host = JSON.parse(File.read(host_path))
          abort "Invalid plugin host compatibility declaration: #{host_path}" unless host["schema_version"] == 2
-          # 保留旧更新器可解析的传输格式，实际支持范围仍取自当前宿主合同。
-          host = host.merge("schema_version" => 1, "permissions" => [])
          # 清单只依赖版本与兼容声明，平台归档和镜像消费同一份封口结果。
          manifest = {
            "schema_version" => 1,
@@ -21,7 +21,7 @@

 ## 快速预览

-无需部署，打开 [快速预览服务](https://codex-proxy-rs.ainz.cc) 即可体验管理端的系统概览、账号分组、代理管理与用量统计
+无需部署即可体验管理端的系统概览、账号分组、代理管理与用量统计：

 | 登录信息 | 默认值 |
 | --- | --- |
@@ -53,8 +53,7 @@ curl -fsSL https://raw.githubusercontent.com/zyycn/codex-proxy-rs/main/deploy/in
 [安装脚本](deploy/install.sh) 默认安装到当前目录下的 `codex-proxy-rs/`，下载同一正式 Release 的部署文件，
 自动生成密码、设置目录权限并启动服务

-完成后会显示访问地址和管理员密码，请保存密码，再按下方步骤
-[添加账号与客户端密钥](#添加账号与客户端密钥)
+完成后保存显示的访问地址和管理员密码，再[登录管理端](#登录管理端)并[添加账号与客户端密钥](#添加账号与客户端密钥)

 可在执行 `bash install.sh` 时传入环境变量：

@@ -303,7 +303,7 @@ dependencies = [
 "lru",
 "percent-encoding",
 "regex-lite",
- "sha2 0.11.0",
+ "sha2",
 "tracing",
 "url",
 ]
@@ -325,7 +325,7 @@ dependencies = [
 "hmac",
 "http",
 "percent-encoding",
- "sha2 0.11.0",
+ "sha2",
 "time",
 "tracing",
 ]
@@ -358,7 +358,7 @@ dependencies = [
 "md-5",
 "pin-project-lite",
 "sha1 0.11.0",
- "sha2 0.11.0",
+ "sha2",
 "tracing",
 ]

@@ -877,7 +877,7 @@ dependencies = [
 "gateway-plugin-sdk",
 "hex",
 "serde_json",
- "sha2 0.11.0",
+ "sha2",
 "tar",
 "tempfile",
 "thiserror",
@@ -1681,6 +1681,7 @@ dependencies = [
 "gateway-core",
 "heck",
 "hex",
+ "hkdf",
 "prettyplease",
 "quote",
 "rand_core 0.6.4",
@@ -1688,7 +1689,7 @@ dependencies = [
 "semver",
 "serde",
 "serde_json",
- "sha2 0.11.0",
+ "sha2",
 "subtle",
 "syn 3.0.6",
 "tempfile",
@@ -1719,7 +1720,7 @@ dependencies = [
 "secrecy",
 "serde",
 "serde_json",
- "sha2 0.11.0",
+ "sha2",
 "thiserror",
 "tokio",
 "tokio-tungstenite 0.29.0",
@@ -1749,7 +1750,7 @@ dependencies = [
 "semver",
 "serde",
 "serde_json",
- "sha2 0.11.0",
+ "sha2",
 "thiserror",
 "tracing",
 "url",
@@ -1789,7 +1790,7 @@ dependencies = [
 "serde_ignored",
 "serde_json",
 "serde_path_to_error",
- "sha2 0.11.0",
+ "sha2",
 "tar",
 "tempfile",
 "thiserror",
@@ -1830,7 +1831,7 @@ dependencies = [
 "semver",
 "serde",
 "serde_json",
- "sha2 0.11.0",
+ "sha2",
 "sqlx",
 "tar",
 "tempfile",
@@ -1858,6 +1859,7 @@ dependencies = [
 name = "gateway-protocol"
 version = "0.0.0"
 dependencies = [
+ "http",
 "httpdate",
 "memchr",
 "serde",
@@ -1886,7 +1888,7 @@ dependencies = [
 "secrecy",
 "serde",
 "serde_json",
- "sha2 0.11.0",
+ "sha2",
 "sqlx",
 "tempfile",
 "thiserror",
@@ -1979,9 +1981,9 @@ dependencies = [

 [[package]]
 name = "h2"
-version = "0.4.19"
+version = "0.4.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef8e5e5a340588f4452631496976cf8636d4a7ecf600239fdc27615d2530bc16"
+checksum = "7d29020232d6aa3fb1daca64c1127cf662cf97f254ae16c18c05b8ab635fc118"
 dependencies = [
 "atomic-waker",
 "bytes",
@@ -2445,9 +2447,9 @@ dependencies = [

 [[package]]
 name = "jsonschema"
-version = "0.58.4"
+version = "0.58.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5761b0ca0a31464030d7c2a98087fde3124ebb5e09b5a112cdb815f03b8ee150"
+checksum = "f622c574a29fb3034a0a90645afee194dfedc75fc124228801b6e77041075bd1"
 dependencies = [
 "ahash",
 "bytecount",
@@ -2473,18 +2475,18 @@ dependencies = [

 [[package]]
 name = "jsonschema-regex"
-version = "0.58.5"
+version = "0.58.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "854e9e22c420535035e95eed240cbfb4a5f4b7da74d122d63144e0c31926dbfd"
+checksum = "a968fffd387b2ab005bf00c1851f5d26e90df05b6f7ad609ed0d620033cca5e7"
 dependencies = [
 "regex-syntax",
 ]

 [[package]]
 name = "jsonschema-value"
-version = "0.58.5"
+version = "0.58.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4e3bfac11ac357ec620880025757d38c67da8fd5b9ef5024d19f0f360002b4ca"
+checksum = "39b7670345e5ce87371339d13705dbb9276b7e3e934bbe1efa2c6734a1f65a96"
 dependencies = [
 "ahash",
 "bytecount",
@@ -2524,6 +2526,15 @@ version = "0.2.186"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"

+[[package]]
+name = "libredox"
+version = "0.1.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61ff90caf6077a803a240f62fdbe88645a890bbca49ef8174c3cb0404362171d"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "libsqlite3-sys"
 version = "0.37.0"
@@ -2841,6 +2852,24 @@ dependencies = [
 "libc",
 ]

+[[package]]
+name = "objc2-core-foundation"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a180dd8642fa45cdb7dd721cd4c11b1cadd4929ce112ebd8b9f5803cc79d536"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "objc2-system-configuration"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7216bd11cbda54ccabcab84d523dc93b858ec75ecfb3a7d89513fa22464da396"
+dependencies = [
+ "objc2-core-foundation",
+]
+
 [[package]]
 name = "once_cell"
 version = "1.21.4"
@@ -2929,7 +2958,7 @@ dependencies = [
 "elliptic-curve",
 "primefield",
 "primeorder",
- "sha2 0.11.0",
+ "sha2",
 ]

 [[package]]
@@ -3261,6 +3290,7 @@ dependencies = [
 "native-tls",
 "openssl",
 "openssl-sys",
+ "regex",
 "reqwest",
 "roxmltree",
 "rustls",
@@ -3270,7 +3300,7 @@ dependencies = [
 "semver",
 "serde",
 "serde_json",
- "sha2 0.11.0",
+ "sha2",
 "subtle",
 "tar",
 "tempfile",
@@ -3312,7 +3342,7 @@ dependencies = [
 "semver",
 "serde",
 "serde_json",
- "sha2 0.11.0",
+ "sha2",
 "thiserror",
 "tokio",
 "tracing",
@@ -3372,9 +3402,9 @@ dependencies = [

 [[package]]
 name = "quinn-proto"
-version = "0.11.16"
+version = "0.11.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f4bfc015262b9df63c8845072ce59068853ff5872180c2ce2f13038b970e560"
+checksum = "a9746dbde176634f4f2f1faf2404e30a31b2bc1e9cafb5329c95d8177a18c9fc"
 dependencies = [
 "bytes",
 "getrandom 0.4.3",
@@ -3558,9 +3588,9 @@ dependencies = [

 [[package]]
 name = "referencing"
-version = "0.58.5"
+version = "0.58.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "590efadb0a669f1712c1e3ab810a55d4c3d20d0127c455f7236dd0710aba0346"
+checksum = "558f3855529c0a7e78a48e409fa653456e55f1b167eab4109c16a255b7727e3f"
 dependencies = [
 "ahash",
 "fluent-uri",
@@ -3575,9 +3605,9 @@ dependencies = [

 [[package]]
 name = "regex"
-version = "1.13.0"
+version = "1.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a0e75113e14dc5acb068cd0786884f214f1312650a3d36d269f5c4f3cdee8a2"
+checksum = "f020237b6c8eed93db2e2cb53c00c60a8e1bc73da7d073199a1180401450218d"
 dependencies = [
 "aho-corasick",
 "memchr",
@@ -4023,17 +4053,6 @@ version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bbfa15b3dddfee50a0fff136974b3e1bde555604ba463834a7eb7deb6417705d"

-[[package]]
-name = "sha2"
-version = "0.10.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
-dependencies = [
- "cfg-if",
- "cpufeatures 0.2.17",
- "digest 0.10.7",
-]
-
 [[package]]
 name = "sha2"
 version = "0.11.0"
@@ -4154,8 +4173,7 @@ dependencies = [
 [[package]]
 name = "sqlx"
 version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "378620ccc25c62c89d8be1c819e76a88d59bdcc3304733330788948e619bfd71"
+source = "git+https://github.com/transact-rs/sqlx?rev=f1e94ec34dd5f11ad6488a3a8ac7988439a3f757#f1e94ec34dd5f11ad6488a3a8ac7988439a3f757"
 dependencies = [
 "sqlx-core",
 "sqlx-macros",
@@ -4167,8 +4185,7 @@ dependencies = [
 [[package]]
 name = "sqlx-core"
 version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05b44e85bf579a8eeb4ceaa77a3a523baf2bf0e9bac7e40f405d537b5d2d5ccb"
+source = "git+https://github.com/transact-rs/sqlx?rev=f1e94ec34dd5f11ad6488a3a8ac7988439a3f757#f1e94ec34dd5f11ad6488a3a8ac7988439a3f757"
 dependencies = [
 "base64 0.22.1",
 "bytes",
@@ -4191,7 +4208,7 @@ dependencies = [
 "rustls",
 "serde",
 "serde_json",
- "sha2 0.10.9",
+ "sha2",
 "smallvec",
 "thiserror",
 "tokio",
@@ -4205,8 +4222,7 @@ dependencies = [
 [[package]]
 name = "sqlx-macros"
 version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd2b84f2bc39a5705ef27ec785a11c934a41bbd4a24941e257927cddc26b60bf"
+source = "git+https://github.com/transact-rs/sqlx?rev=f1e94ec34dd5f11ad6488a3a8ac7988439a3f757#f1e94ec34dd5f11ad6488a3a8ac7988439a3f757"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -4218,8 +4234,7 @@ dependencies = [
 [[package]]
 name = "sqlx-macros-core"
 version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fb8d96de5fdc85a5c4ec813432b523ec637e80ba98f046555f75f7908ddac7c3"
+source = "git+https://github.com/transact-rs/sqlx?rev=f1e94ec34dd5f11ad6488a3a8ac7988439a3f757#f1e94ec34dd5f11ad6488a3a8ac7988439a3f757"
 dependencies = [
 "cfg-if",
 "dotenvy",
@@ -4230,7 +4245,7 @@ dependencies = [
 "quote",
 "serde",
 "serde_json",
- "sha2 0.10.9",
+ "sha2",
 "sqlx-core",
 "sqlx-mysql",
 "sqlx-postgres",
@@ -4244,8 +4259,7 @@ dependencies = [
 [[package]]
 name = "sqlx-mysql"
 version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90b8020fe17c5f2c245bfa2505d7ef59c5604839527c740266ad2214acebea27"
+source = "git+https://github.com/transact-rs/sqlx?rev=f1e94ec34dd5f11ad6488a3a8ac7988439a3f757#f1e94ec34dd5f11ad6488a3a8ac7988439a3f757"
 dependencies = [
 "bitflags",
 "byteorder",
@@ -4262,7 +4276,7 @@ dependencies = [
 "percent-encoding",
 "serde",
 "sha1 0.11.0",
- "sha2 0.11.0",
+ "sha2",
 "sqlx-core",
 "thiserror",
 "tracing",
@@ -4272,8 +4286,7 @@ dependencies = [
 [[package]]
 name = "sqlx-postgres"
 version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87a2bdd6e83f6b3ea525ca9fee568030508b58355a43d0b2c1674d5f79dcd65e"
+source = "git+https://github.com/transact-rs/sqlx?rev=f1e94ec34dd5f11ad6488a3a8ac7988439a3f757#f1e94ec34dd5f11ad6488a3a8ac7988439a3f757"
 dependencies = [
 "atoi",
 "base64 0.22.1",
@@ -4296,7 +4309,7 @@ dependencies = [
 "rand 0.10.2",
 "serde",
 "serde_json",
- "sha2 0.11.0",
+ "sha2",
 "smallvec",
 "sqlx-core",
 "stringprep",
@@ -4309,8 +4322,7 @@ dependencies = [
 [[package]]
 name = "sqlx-sqlite"
 version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "488e99c397a62007e4229aec669a179816339afc6d2620ca6fa420dbee2e982c"
+source = "git+https://github.com/transact-rs/sqlx?rev=f1e94ec34dd5f11ad6488a3a8ac7988439a3f757#f1e94ec34dd5f11ad6488a3a8ac7988439a3f757"
 dependencies = [
 "atoi",
 "chrono",
@@ -4995,9 +5007,9 @@ checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"

 [[package]]
 name = "uuid"
-version = "1.26.1"
+version = "1.27.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ef6dac1e96601b4fb3acccccff2139741fcb757cb9a36089bf5be91cfb285ce"
+checksum = "97277d36b9c3ace13e58fa6e753f8b0bbbf302a18dd193240d70f9e29681059a"
 dependencies = [
 "getrandom 0.4.3",
 "js-sys",
@@ -5182,6 +5194,12 @@ name = "whoami"
 version = "2.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "998767ef88740d1f5b0682a9c53c24431453923962269c2db68ee43788c5a40d"
+dependencies = [
+ "libc",
+ "libredox",
+ "objc2-system-configuration",
+ "web-sys",
+]

 [[package]]
 name = "winapi"
@@ -5529,9 +5547,9 @@ dependencies = [

 [[package]]
 name = "zeroize"
-version = "1.9.0"
+version = "1.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
+checksum = "e13084392c5e4bc371903e2935a5eaeed24905a7511356b883835e18a78f6879"
 dependencies = [
 "zeroize_derive",
 ]
@@ -59,3 +59,5 @@ panic = "abort"
 [patch.crates-io]
 # Upstream SOCKS IPv6 fix; remove once a release includes hyperium/hyper-util#302.
 hyper-util = { git = "https://github.com/hyperium/hyper-util", rev = "191b1acf0a6b18e807e4abf5a6d4a7c47979ecd6" }
+# 固定上游 BEGIN 取消回滚修复，避免未结束事务复用；见 transact-rs/sqlx#4394
+sqlx = { git = "https://github.com/transact-rs/sqlx", rev = "f1e94ec34dd5f11ad6488a3a8ac7988439a3f757" }
@@ -1,4 +1,4 @@
-//! 服务模式完成全部组装后交给 Host 监听，并在请求和 Worker 排空后关闭插件
+//! 服务模式完成全部组装后交给 Host 监听，并在停止监听与 Worker 收尾后关闭插件

 use gateway_host::ConfigError;

@@ -56,6 +56,12 @@ pub async fn run() -> Result<(), BootstrapError> {
        plugin_runtime,
        gateway_host::plugin_distribution::HttpPluginDistribution::new(plugin_http)
    ));
+    let analytics_worker = or_shutdown!(
+        plugin_runtime,
+        store.request_analytics_worker(std::sync::Arc::new(
+            gateway_admin::ProviderUsageBillingProjector::new(providers.admin.clone()),
+        ))
+    );
    let mut admin = or_shutdown!(
        plugin_runtime,
        gateway_admin::initialize_with_plugin_accounts(
@@ -142,6 +148,7 @@ pub async fn run() -> Result<(), BootstrapError> {
    );

    let mut plan = store.take_worker_contributions();
+    plan.push(analytics_worker);
    plan.push(or_shutdown!(
        plugin_runtime,
        gateway_host::retention::worker(store.retention())
@@ -28,11 +28,8 @@ cpr-plugin package \

 资源映射相对于作者清单所在目录解析。输出包括完整插件 ID、版本和目标 triple 命名的 `.tar.gz` 及 `.sha256`；归档根目录直接包含 `plugin.json`、可执行文件和已声明资源，不包含开发依赖

-作者清单可省略普通贡献项的 `id`、`version` 和固定阶段；`middleware` 必须显式声明版本 `4`，
-并从 `http`、`websocket`、`service`、`request`、`attempt` 中选择挂载阶段；`upstream_adapter` 必须显式声明版本 `2`。
-CLI 与 SDK 的 `Manifest::from_author_slice`、`PluginBuilder::from_json` 共用规范化入口；归档中的
-`plugin.json` 写入补全后的贡献项字段，不保留另一份作者声明。
-完整规则见 [SDK 清单](../../crates/gateway-plugin/sdk/docs/manifest.md)
+作者清单的省略规则、能力版本和挂载阶段见 [SDK 扩展项声明](../../crates/gateway-plugin/sdk/docs/manifest.md#扩展项简写)。
+CLI 与 SDK 的 `Manifest::from_author_slice`、`PluginBuilder::from_json` 共用规范化入口，归档只保留补全字段后的 `plugin.json`

 支持 `x86_64-unknown-linux-gnu`、`aarch64-unknown-linux-gnu` 和 `aarch64-apple-darwin`。
 完整开发示例在独立仓库 `codex-proxy-plugins` 的 `examples/workbench`，可通过[子模块](../../../docs/development.md#源码联调)检出；本工具不负责源码构建、上传或启用插件
@@ -21,6 +21,7 @@ futures = "0.3.32"
 gateway-core = { path = "../gateway-core" }
 heck = "0.5.0"
 hex = "0.4.3"
+hkdf = "0.13.0"
 rand_core = { version = "0.6.4", features = ["getrandom"] }
 serde = { version = "1.0.228", features = ["derive"] }
 serde_json = { version = "1.0.150", features = ["arbitrary_precision", "preserve_order"] }
@@ -491,11 +491,13 @@ impl BackupTask {
            )
            .await
        {
-            let _ = store.delete_object(&config, &record.object_key).await;
-            self.fail_task(
+            self.fail_uploaded_task(
                record,
-                error.code(),
-                format!("上传到对象存储失败：{}", error.message()),
+                &config,
+                BackupError::new(
+                    error.code(),
+                    format!("上传到对象存储失败：{}", error.message()),
+                ),
            )
            .await?;
            return Ok(());
@@ -533,16 +535,19 @@ impl BackupTask {
                    sha256_matches,
                    "备份远端对象校验不一致"
                );
-                let _ = store.delete_object(&config, &record.object_key).await;
-                self.fail_task(
+                self.fail_uploaded_task(
                    record,
-                    code::REMOTE_VERIFICATION_FAILED,
-                    match (size_matches, sha256_matches) {
-                        (false, true) => "远端对象大小不一致",
-                        (true, false) => "远端对象 sha256 校验值不一致",
-                        (false, false) => "远端对象大小和 sha256 校验值均不一致",
-                        (true, true) => "远端对象校验状态异常",
-                    },
+                    &config,
+                    BackupError::new(
+                        code::REMOTE_VERIFICATION_FAILED,
+                        match (size_matches, sha256_matches) {
+                            (false, true) => "远端对象大小不一致",
+                            (true, false) => "远端对象 sha256 校验值不一致",
+                            (false, false) => "远端对象大小和 sha256 校验值均不一致",
+                            (true, true) => "远端对象校验状态异常",
+                        }
+                        .to_owned(),
+                    ),
                )
                .await?;
            }
@@ -556,11 +561,13 @@ impl BackupTask {
                .await?;
            }
            Err(error) => {
-                let _ = store.delete_object(&config, &record.object_key).await;
-                self.fail_task(
+                self.fail_uploaded_task(
                    record,
-                    error.code(),
-                    format!("远端对象校验失败：{}", error.message()),
+                    &config,
+                    BackupError::new(
+                        error.code(),
+                        format!("远端对象校验失败：{}", error.message()),
+                    ),
                )
                .await?;
            }
@@ -568,6 +575,24 @@ impl BackupTask {
        Ok(())
    }

+    /// 清理失败并入原终态，后续清理沿用备份记录的到期策略
+    async fn fail_uploaded_task(
+        &self,
+        record: &BackupRecord,
+        config: &BackupStorageConfig,
+        mut error: BackupError,
+    ) -> Result<(), WorkerTaskError> {
+        if let Err(cleanup) = self
+            .object_store
+            .delete_object(config, &record.object_key)
+            .await
+        {
+            error =
+                error.with_cleanup_failure("DeleteObject", &cleanup, record.expires_at.is_some());
+        }
+        self.fail_task(record, error.code(), error.message()).await
+    }
+
    /// 把活跃任务写入失败终态并清理暂存
    async fn fail_task(
        &self,
@@ -35,7 +35,7 @@ pub use use_case::{
    client_keys::ClientKeyService,
    credentials::{CredentialsService, ProviderCredentials},
    import_tasks::ImportTasksService,
-    observability::ObservabilityService,
+    observability::{ObservabilityService, ProviderUsageBillingProjector},
    proxies::ProxiesService,
    settings::SettingsService,
    system::SystemService,
@@ -405,9 +405,7 @@ async fn initialize_inner(
    let registry = providers;

    let auth = Arc::new(DefaultAuthService::new(
-        config.default_username,
-        config.session_ttl_minutes,
-        config.session_absolute_ttl_minutes,
+        &config,
        client_config.session_ttl_minutes,
        store.auth(),
        client_key_verifier.clone(),
@@ -441,11 +439,14 @@ async fn initialize_inner(
        plugin_inspector.clone(),
    ));
    let system = Arc::new(DefaultSystemService::new(system, system_preflight));
+    let observations: Arc<dyn ports::store::ObservabilityStore> = Arc::new(
+        use_case::observability::CachedObservabilityStore::new(store.observability()),
+    );
    let key_usage = Arc::new(use_case::key_usage::DefaultKeyUsageService::new(
        auth.clone(),
        client_key_verifier,
        store.client_keys(),
-        store.observability(),
+        observations.clone(),
        system.clone(),
        timezone,
    ));
@@ -506,7 +507,7 @@ async fn initialize_inner(
        )),
        client_distribution: Arc::new(DefaultClientDistributionService::new(client_distribution)),
        observability: Arc::new(DefaultObservabilityService::new(
-            store.observability(),
+            observations.clone(),
            store.accounts(),
            store.settings(),
            registry.clone(),
@@ -66,7 +66,7 @@ pub struct AccountGroupCapacity {
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct AccountGroupUsage {
    pub today_usd: DecimalAmount,
-    /// 当前 usage retention 窗口内、按请求发生时 routing group 快照归属的累计成本
+    /// 当前 usage retention 窗口内、当前组成员实际完成请求的累计成本
    pub retained_total_usd: DecimalAmount,
 }

@@ -126,6 +126,16 @@ pub struct AccountGroupPage {
    pub page_size: u16,
 }

+/// 分组选择器使用的轻量分页结果
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct AccountGroupOptionsPage {
+    pub config_revision: Revision,
+    pub items: Vec<AccountGroupRef>,
+    pub total: u64,
+    pub page: u32,
+    pub page_size: u16,
+}
+
 /// 创建账号分组
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct CreateAccountGroup {
@@ -146,9 +146,9 @@ pub struct AccountUsage {
    pub success_count: u64,
    pub input_tokens: Option<u64>,
    pub output_tokens: Option<u64>,
-    pub cached_tokens: Option<u64>,
-    pub cache_write_tokens: Option<u64>,
-    pub reasoning_tokens: Option<u64>,
+    pub cached_input_tokens: Option<u64>,
+    pub cache_write_input_tokens: Option<u64>,
+    pub reasoning_output_tokens: Option<u64>,
    pub image_input_tokens: Option<u64>,
    pub image_output_tokens: Option<u64>,
    pub image_request_count: u64,
@@ -0,0 +1,65 @@
+//! 统计投影的新鲜度、覆盖范围与预计算费用合同
+
+use chrono::{DateTime, Utc};
+
+use super::observability::{DecimalAmount, RequestMetricPoint, UsageOverview};
+
+/// 数据可见性状态，不以缺失投影冒充零统计
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
+pub enum AnalyticsState {
+    Ready,
+    #[default]
+    Building,
+    Lagging,
+    Stale,
+}
+
+impl AnalyticsState {
+    #[must_use]
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::Ready => "ready",
+            Self::Building => "building",
+            Self::Lagging => "lagging",
+            Self::Stale => "stale",
+        }
+    }
+}
+
+/// 与统计结果在同一读取快照内取得的覆盖和版本事实
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub struct AnalyticsMetadata {
+    pub coverage_start: Option<DateTime<Utc>>,
+    pub coverage_end: Option<DateTime<Utc>>,
+    pub generated_at: DateTime<Utc>,
+    pub lag_seconds: u64,
+    pub state: AnalyticsState,
+    pub percentiles_approximate: bool,
+    pub schema_version: u32,
+    pub histogram_version: u32,
+    /// 派生数据版本供缓存判断失效，不作为源事务提交顺序
+    pub generation: u64,
+}
+
+/// 单次请求经 Provider 费用合同确认后可累加的 USD 情景金额
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub struct UsageBillingProjection {
+    pub standard_amount: Option<DecimalAmount>,
+    pub no_cache_amount: Option<DecimalAmount>,
+}
+
+/// 时间桶内的情景费用，未知金额不改写为零
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct UsageProjectedCostPoint {
+    pub bucket_start: DateTime<Utc>,
+    pub standard_amount: Option<DecimalAmount>,
+    pub no_cache_amount: Option<DecimalAmount>,
+}
+
+/// 同一数据库快照内的完整洞察输入
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct UsageInsightsObservation {
+    pub overview: UsageOverview,
+    pub trend: Vec<RequestMetricPoint>,
+    pub costs: Vec<UsageProjectedCostPoint>,
+}
@@ -76,18 +76,23 @@ impl std::fmt::Debug for LoginCommand {
    }
 }

-/// 登录成功后返回的会话事实
+/// 登录或刷新后仅向当前浏览器交付的会话凭据
 #[derive(Clone, PartialEq, Eq)]
-pub struct LoginResult {
+pub struct SessionGrant {
    pub session_id: String,
+    pub refresh_token: Option<String>,
    pub session: AuthSession,
 }

-impl std::fmt::Debug for LoginResult {
+impl std::fmt::Debug for SessionGrant {
    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        formatter
-            .debug_struct("LoginResult")
+            .debug_struct("SessionGrant")
            .field("session_id", &"[REDACTED]")
+            .field(
+                "refresh_token",
+                &self.refresh_token.as_ref().map(|_| "[REDACTED]"),
+            )
            .field("session", &self.session)
            .finish()
    }
@@ -138,12 +143,41 @@ impl std::fmt::Debug for ChangePassword {
    }
 }

-/// 会话有效期与管理员续期上限；没有上限字段的旧会话保持固定有效期
+/// 访问有效期与逻辑会话；没有续期凭据的会话保持固定期限
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct AuthSession {
    pub subject: SessionSubject,
    pub expires_at: DateTime<Utc>,
    pub absolute_expires_at: Option<DateTime<Utc>>,
+    pub renewal: Option<SessionRenewal>,
+}
+
+/// 长效登录的凭据摘要与续期窗口；访问到期不删除整段登录
+#[derive(Debug, Clone, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct SessionRenewal {
+    pub expires_at: DateTime<Utc>,
+    pub access_digest: [u8; 32],
+    pub refresh_digest: [u8; 32],
+    pub previous: Option<SessionRefreshReplay>,
+}
+
+/// 仅保存上一代摘要及派生盐；响应丢失时须持有上一代凭据才能重建同一响应
+#[derive(Debug, Clone, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct SessionRefreshReplay {
+    pub digest: [u8; 32],
+    pub salt: [u8; 32],
+    pub expires_at: DateTime<Utc>,
+}
+
+impl AuthSession {
+    #[must_use]
+    pub fn retained_until(&self) -> DateTime<Utc> {
+        self.renewal
+            .as_ref()
+            .map_or(self.expires_at, |renewal| renewal.expires_at)
+    }
 }

 /// 安全审计事件类型
@@ -474,6 +474,26 @@ impl BackupError {
    pub fn message(&self) -> &str {
        &self.message
    }
+
+    /// 清理失败附加到原始终态，不覆盖上传失败或主动取消的分类
+    #[must_use]
+    pub fn with_cleanup_failure(
+        mut self,
+        stage: &'static str,
+        error: &Self,
+        retry_on_expiration: bool,
+    ) -> Self {
+        let recovery = if retry_on_expiration {
+            "等待备份到期清理"
+        } else {
+            "未安排自动重试"
+        };
+        self.message.push_str(&format!(
+            "；清理阶段 {stage} 失败（{}），{recovery}",
+            error.code()
+        ));
+        self
+    }
 }

 /// 构造稳定错误码常量
@@ -4,6 +4,7 @@ use std::num::{NonZeroU16, NonZeroU64};

 pub mod account_groups;
 pub mod accounts;
+pub mod analytics;
 pub mod audit;
 pub mod auth;
 pub mod backup;
@@ -5,6 +5,10 @@ use std::{num::NonZeroU16, str::FromStr};
 use chrono::{DateTime, TimeDelta, Utc};

 use super::AdminModelError;
+pub use super::analytics::{
+    AnalyticsMetadata, AnalyticsState, UsageBillingProjection, UsageInsightsObservation,
+    UsageProjectedCostPoint,
+};

 /// 观测记录查询的页大小，由 HTTP、管理用例和存储端口共同使用
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
@@ -48,7 +52,7 @@ impl CalendarPeriod {
 }

 /// 外部观测查询的 UTC 时间范围
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
 pub struct TimeRange {
    pub start: DateTime<Utc>,
    pub end: DateTime<Utc>,
@@ -89,7 +93,7 @@ impl TimeRange {
 }

 /// 请求结果状态
-#[derive(Debug, Clone, PartialEq, Eq)]
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
 pub enum RequestOutcome {
    Running,
    Succeeded,
@@ -100,7 +104,7 @@ pub enum RequestOutcome {
 }

 /// 未知但有界的请求结果值；私有字段禁止绕过 [`RequestOutcome::new`] 构造
-#[derive(Debug, Clone, PartialEq, Eq)]
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
 pub struct OtherRequestOutcome(String);

 impl RequestOutcome {
@@ -151,7 +155,7 @@ impl OtherRequestOutcome {
 }

 /// 用量记录过滤条件
-#[derive(Debug, Clone, Default, PartialEq, Eq)]
+#[derive(Debug, Clone, Default, PartialEq, Eq, Hash)]
 pub struct UsageFilter {
    pub client_api_key_ref: Option<String>,
    pub request_id: Option<String>,
@@ -178,7 +182,7 @@ pub struct UsageQuery {
 }

 /// Admin 确定概览的数量、趋势粒度及最近请求筛选，Store 只执行该选择
-#[derive(Debug, Clone, PartialEq, Eq)]
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
 pub struct DashboardQuery {
    pub range: TimeRange,
    pub granularity: Granularity,
@@ -230,7 +234,7 @@ pub struct OpsErrorQuery {
 }

 /// 用量诊断维度
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
 pub enum DiagnosticDimension {
    Provider,
    Model,
@@ -363,8 +367,8 @@ pub struct ProviderBillingInput {
    pub service_tier: Option<String>,
    pub input_tokens: Option<u64>,
    pub output_tokens: Option<u64>,
-    pub cached_tokens: Option<u64>,
-    pub cache_write_tokens: Option<u64>,
+    pub cached_input_tokens: Option<u64>,
+    pub cache_write_input_tokens: Option<u64>,
    pub total: CurrencyCost,
 }

@@ -380,8 +384,8 @@ pub struct UsageCalculatedBillingFact {
    pub service_tier: Option<String>,
    pub input_tokens: Option<u64>,
    pub output_tokens: Option<u64>,
-    pub cached_tokens: Option<u64>,
-    pub cache_write_tokens: Option<u64>,
+    pub cached_input_tokens: Option<u64>,
+    pub cache_write_input_tokens: Option<u64>,
    pub total: CurrencyCost,
 }

@@ -408,7 +412,7 @@ pub struct CalculatedBillingBreakdown {
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct ImageBillingBreakdown {
    pub input_tokens: u64,
-    pub cached_tokens: u64,
+    pub cached_input_tokens: u64,
    pub input_amount: CurrencyCost,
    pub cache_read_amount: CurrencyCost,
    pub input_price_per_million: CurrencyCost,
@@ -454,9 +458,9 @@ pub struct RequestMetrics {
    pub caller_error_count: u64,
    pub input_tokens: u64,
    pub output_tokens: u64,
-    pub cached_tokens: u64,
-    pub cache_write_tokens: u64,
-    pub reasoning_tokens: u64,
+    pub cached_input_tokens: u64,
+    pub cache_write_input_tokens: u64,
+    pub reasoning_output_tokens: u64,
    pub total_tokens: u64,
    pub first_token_latency_sum_ms: u64,
    pub first_token_latency_count: u64,
@@ -496,7 +500,7 @@ pub struct AttemptMetrics {
 }

 /// 时间序列粒度
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
 pub enum Granularity {
    FifteenMinutes,
    Hour,
@@ -556,9 +560,9 @@ pub struct AccountModelUsage {
    pub success_count: u64,
    pub input_tokens: Option<u64>,
    pub output_tokens: Option<u64>,
-    pub cached_tokens: Option<u64>,
-    pub cache_write_tokens: Option<u64>,
-    pub reasoning_tokens: Option<u64>,
+    pub cached_input_tokens: Option<u64>,
+    pub cache_write_input_tokens: Option<u64>,
+    pub reasoning_output_tokens: Option<u64>,
    pub image_input_tokens: Option<u64>,
    pub image_output_tokens: Option<u64>,
    pub image_request_count: u64,
@@ -591,9 +595,9 @@ pub struct DashboardAccountUsage {
    pub success_count: u64,
    pub input_tokens: Option<u64>,
    pub output_tokens: Option<u64>,
-    pub cached_tokens: Option<u64>,
-    pub cache_write_tokens: Option<u64>,
-    pub reasoning_tokens: Option<u64>,
+    pub cached_input_tokens: Option<u64>,
+    pub cache_write_input_tokens: Option<u64>,
+    pub reasoning_output_tokens: Option<u64>,
    pub image_input_tokens: Option<u64>,
    pub image_output_tokens: Option<u64>,
    pub image_request_count: u64,
@@ -628,7 +632,7 @@ pub struct DashboardRuntimeSlots {
 pub struct DashboardTotals {
    pub request_count: u64,
    pub input_tokens: u64,
-    pub cached_tokens: u64,
+    pub cached_input_tokens: u64,
    pub total_tokens: u64,
    pub billing_usd: Option<DecimalAmount>,
 }
@@ -636,6 +640,7 @@ pub struct DashboardTotals {
 /// 仪表盘所需的当前区间事实及全历史累计
 #[derive(Debug, Clone, PartialEq)]
 pub struct DashboardObservation {
+    pub analytics: AnalyticsMetadata,
    pub range: TimeRange,
    pub totals: DashboardTotals,
    pub provider_accounts: AccountPoolMetrics,
@@ -646,7 +651,7 @@ pub struct DashboardObservation {
 }

 /// 使用记录表格的窄读模型
-#[derive(Debug, Clone, PartialEq, Eq)]
+#[derive(Debug, Clone, PartialEq)]
 pub struct UsageListRecord {
    pub client_api_key_name: Option<String>,
    pub id: String,
@@ -657,9 +662,9 @@ pub struct UsageListRecord {
    pub provider_account_ref: Option<String>,
    pub provider_account_name: Option<String>,
    pub provider_account_email: Option<String>,
-    /// 账号当前备注，按内部账号 ID 关联，不属于请求历史快照
+    /// 请求选号时冻结的账号备注，未采集时保持未知
    pub provider_account_notes: Option<String>,
-    /// 账号当前套餐，不属于请求历史快照
+    /// 请求选号时冻结的账号套餐
    pub provider_account_plan_type: Option<String>,
    pub provider_account_plan_type_display: Option<String>,
    pub provider_account_authentication_kind: Option<String>,
@@ -669,9 +674,9 @@ pub struct UsageListRecord {
    pub service_tier: Option<String>,
    pub input_tokens: Option<u64>,
    pub output_tokens: Option<u64>,
-    pub cached_tokens: Option<u64>,
-    pub cache_write_tokens: Option<u64>,
-    pub reasoning_tokens: Option<u64>,
+    pub cached_input_tokens: Option<u64>,
+    pub cache_write_input_tokens: Option<u64>,
+    pub reasoning_output_tokens: Option<u64>,
    pub image_input_tokens: Option<u64>,
    pub image_output_tokens: Option<u64>,
    pub total_tokens: Option<u64>,
@@ -687,6 +692,13 @@ pub struct UsageListRecord {
    pub first_text_ms: Option<u64>,
    pub first_token_ms: Option<u64>,
    pub provider_processing_ms: Option<u64>,
+    pub upstream_response_ms: Option<u64>,
+    pub upstream_api_overhead_ms: Option<f64>,
+    pub upstream_engine_ms: Option<f64>,
+    pub upstream_engine_iapi_ttft_ms: Option<f64>,
+    pub upstream_engine_service_ttft_ms: Option<f64>,
+    pub upstream_engine_iapi_tbt_ms: Option<f64>,
+    pub upstream_engine_service_tbt_ms: Option<f64>,
    pub latency_ms: Option<u64>,
    pub admission_decision_ms: Option<u64>,
    pub account_selection_wait_ms: Option<u64>,
@@ -702,7 +714,7 @@ pub struct UsageListRecord {
 }

 /// 一次完整模型请求的公共观测记录
-#[derive(Debug, Clone, PartialEq, Eq)]
+#[derive(Debug, Clone, PartialEq)]
 pub struct UsageRecord {
    pub id: String,
    pub client_api_key_ref: String,
@@ -743,9 +755,9 @@ pub struct UsageRecord {
    pub retry_after_ms: Option<u64>,
    pub input_tokens: Option<u64>,
    pub output_tokens: Option<u64>,
-    pub cached_tokens: Option<u64>,
-    pub cache_write_tokens: Option<u64>,
-    pub reasoning_tokens: Option<u64>,
+    pub cached_input_tokens: Option<u64>,
+    pub cache_write_input_tokens: Option<u64>,
+    pub reasoning_output_tokens: Option<u64>,
    pub image_input_tokens: Option<u64>,
    pub image_output_tokens: Option<u64>,
    pub total_tokens: Option<u64>,
@@ -761,6 +773,13 @@ pub struct UsageRecord {
    pub first_text_ms: Option<u64>,
    pub first_token_ms: Option<u64>,
    pub provider_processing_ms: Option<u64>,
+    pub upstream_response_ms: Option<u64>,
+    pub upstream_api_overhead_ms: Option<f64>,
+    pub upstream_engine_ms: Option<f64>,
+    pub upstream_engine_iapi_ttft_ms: Option<f64>,
+    pub upstream_engine_service_ttft_ms: Option<f64>,
+    pub upstream_engine_iapi_tbt_ms: Option<f64>,
+    pub upstream_engine_service_tbt_ms: Option<f64>,
    pub latency_ms: Option<u64>,
    pub admission_decision_ms: Option<u64>,
    pub account_selection_wait_ms: Option<u64>,
@@ -781,7 +800,7 @@ pub struct UsageRecord {
 }

 /// 用量分页结果
-#[derive(Debug, Clone, PartialEq, Eq)]
+#[derive(Debug, Clone, PartialEq)]
 pub struct UsagePage {
    pub items: Vec<UsageListRecord>,
    pub current_page: u32,
@@ -816,9 +835,9 @@ pub struct UsageAttempt {
    pub message: Option<String>,
    pub input_tokens: Option<u64>,
    pub output_tokens: Option<u64>,
-    pub cached_tokens: Option<u64>,
-    pub cache_write_tokens: Option<u64>,
-    pub reasoning_tokens: Option<u64>,
+    pub cached_input_tokens: Option<u64>,
+    pub cache_write_input_tokens: Option<u64>,
+    pub reasoning_output_tokens: Option<u64>,
    pub total_tokens: Option<u64>,
    pub cost_source: Option<String>,
    pub cost_amount: Option<DecimalAmount>,
@@ -827,7 +846,7 @@ pub struct UsageAttempt {
 }

 /// 一条请求及其全部尝试
-#[derive(Debug, Clone, PartialEq, Eq)]
+#[derive(Debug, Clone, PartialEq)]
 pub struct UsageDetail {
    pub trace: Option<serde_json::Value>,
    pub related_requests: Vec<serde_json::Value>,
@@ -848,6 +867,7 @@ pub struct ProviderObservation {
 /// 用量总览
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct UsageOverview {
+    pub analytics: AnalyticsMetadata,
    pub range: TimeRange,
    pub requests: RequestMetrics,
    pub attempts: AttemptMetrics,
@@ -864,6 +884,7 @@ pub struct UsageSummary {
 /// 诊断聚合结果，分母包含截取展示项之前的全部匹配请求
 #[derive(Debug, Clone, Default, PartialEq, Eq)]
 pub struct DiagnosticsObservation {
+    pub analytics: AnalyticsMetadata,
    pub total_request_count: u64,
    pub items: Vec<DiagnosticObservation>,
 }
@@ -987,7 +1008,7 @@ pub struct TrendSummary {
    pub request_count: u64,
    pub input_tokens: u64,
    pub output_tokens: u64,
-    pub cached_tokens: u64,
+    pub cached_input_tokens: u64,
    pub total_tokens: u64,
    pub service_failure_count: u64,
    pub average_latency_ms: Option<u64>,
@@ -1005,6 +1026,7 @@ pub struct TrendSummary {
 /// 趋势结果；API 再决定图表标签与数字格式
 #[derive(Debug, Clone, PartialEq)]
 pub struct Trend {
+    pub analytics: AnalyticsMetadata,
    pub kind: TrendKind,
    pub points: Vec<TrendPoint>,
    pub summary: TrendSummary,
@@ -1120,7 +1142,7 @@ pub struct DashboardPeriodMetrics {
    pub request_count: u64,
    pub input_tokens: u64,
    pub output_tokens: u64,
-    pub cached_tokens: u64,
+    pub cached_input_tokens: u64,
    pub total_tokens: u64,
    pub cached_token_rate: f64,
    pub observed_cached_token_rate: Option<f64>,
@@ -1210,7 +1232,7 @@ pub struct UsageInsightsCostPoint {
    pub bucket_start: DateTime<Utc>,
    pub input_tokens: u64,
    pub output_tokens: u64,
-    pub cached_tokens: u64,
+    pub cached_input_tokens: u64,
    pub total_tokens: u64,
    pub estimated_cost: Option<DecimalAmount>,
    pub standard_cost: Option<DecimalAmount>,
@@ -1235,7 +1257,7 @@ pub struct UsageInsightsCost {
    pub cache_hit_request_rate: Option<f64>,
    pub input_tokens: u64,
    pub output_tokens: u64,
-    pub cached_tokens: u64,
+    pub cached_input_tokens: u64,
    pub total_tokens: u64,
    pub points: Vec<UsageInsightsCostPoint>,
    pub costs: Vec<CurrencyCost>,
@@ -1245,6 +1267,7 @@ pub struct UsageInsightsCost {
 /// 用量洞察的完整用例结果；API 只负责标签、时区与字符串格式化
 #[derive(Debug, Clone, PartialEq)]
 pub struct UsageInsights {
+    pub analytics: AnalyticsMetadata,
    pub granularity: Granularity,
    pub health: UsageInsightsHealth,
    pub performance: UsageInsightsPerformance,
@@ -1280,6 +1303,7 @@ pub struct DiagnosticsItem {
 /// 诊断结果
 #[derive(Debug, Clone, PartialEq)]
 pub struct DiagnosticsResult {
+    pub analytics: AnalyticsMetadata,
    pub dimension: DiagnosticDimension,
    pub items: Vec<DiagnosticsItem>,
 }
@@ -15,7 +15,7 @@ pub struct QuotaForecastUsage {
    pub tokens: u64,
    pub input_tokens: u64,
    pub output_tokens: u64,
-    pub cached_tokens: u64,
+    pub cached_input_tokens: u64,
    pub missing_token_count: u64,
    pub known_cost_count: u64,
    pub unavailable_cost_count: u64,
@@ -35,7 +35,9 @@ impl QuotaForecastUsage {
            tokens: self.tokens.checked_sub(baseline.tokens)?,
            input_tokens: self.input_tokens.checked_sub(baseline.input_tokens)?,
            output_tokens: self.output_tokens.checked_sub(baseline.output_tokens)?,
-            cached_tokens: self.cached_tokens.checked_sub(baseline.cached_tokens)?,
+            cached_input_tokens: self
+                .cached_input_tokens
+                .checked_sub(baseline.cached_input_tokens)?,
            missing_token_count: self
                .missing_token_count
                .checked_sub(baseline.missing_token_count)?,
@@ -140,7 +142,7 @@ pub fn select_forecast_sample(
    };
    history.push(current);
    // 重置边界不在查询起点时，从首个新观测重新计数，避免把旧周期累计带入总量
-    let mut cycle_baseline = interrupted.then(|| &history[0]);
+    let cycle_baseline = interrupted.then(|| &history[0]);
    let mut anchors: Vec<&QuotaForecastPoint> = Vec::new();
    let mut high_water: Option<&QuotaForecastPoint> = None;
    for point in &history {
@@ -153,9 +155,9 @@ pub fn select_forecast_sample(
                if previous.used_percent - point.used_percent <= 1.0 {
                    continue;
                }
+                // 同窗口回落不能证明周期重置，只重建采样并保留已记录累计
                sample.discontinuous = true;
                anchors.clear();
-                cycle_baseline = Some(point);
            }
        }
        high_water = Some(point);
@@ -45,12 +45,12 @@ pub use gateway_core::account::RotationStrategy;
 /// 运行设置的共同值；版本、Provider 画像更新和数据库秘密由外层类型拥有
 #[derive(Debug, Clone, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
 pub struct RuntimeSettingsValues {
+    pub codex_privacy_policy: gateway_core::settings::privacy::CodexPrivacyPolicy,
    pub request_location_enabled: bool,
    pub request_location: gateway_core::account::RequestLocation,
    pub refresh_margin_seconds: u64,
    pub refresh_concurrency: u32,
    pub max_concurrent_per_account: u32,
-    pub request_interval_ms: u64,
    pub max_waiting_per_key: u32,
    pub max_waiting_per_account: u32,
    pub concurrency_wait_timeout_seconds: u32,
@@ -211,10 +211,6 @@ impl RuntimeSettingsValues {
                "refresh_margin_seconds",
            ),
            (self.refresh_concurrency > 0, "refresh_concurrency"),
-            (
-                i64::try_from(self.request_interval_ms).is_ok(),
-                "request_interval_ms",
-            ),
        ] {
            if !valid {
                return Err(field);
@@ -175,12 +175,13 @@ pub trait PluginDistribution: Send + Sync {
 /// Runtime 只解释插件包格式；安装事务与来源选择归 Admin
 #[async_trait]
 pub trait PluginPackageInspector: Send + Sync {
-    /// 可解析但版本范围未经宿主承诺的诊断，不决定启动资格
+    /// 完整校验包并返回版本范围诊断；校验失败与可加载但未经宿主承诺的提醒分开
    async fn compatibility_warning(
        &self,
-        _archive: Arc<[u8]>,
-        _expected_sha256: String,
+        archive: Arc<[u8]>,
+        expected_sha256: String,
    ) -> Result<Option<String>, AdminError> {
+        self.inspect(archive, Some(expected_sha256)).await?;
        Ok(None)
    }

@@ -130,6 +130,32 @@ struct ProviderAdminDiagnostic {
 /// 运行时资源通知只在事务成功后发生
 #[async_trait]
 pub trait ProviderAdmin: Send + Sync {
+    fn compile_privacy_policy(
+        &self,
+        _policy: &gateway_core::settings::privacy::CodexPrivacyPolicy,
+    ) -> Result<
+        Arc<dyn gateway_core::settings::privacy::CompiledPrivacyPolicy>,
+        gateway_core::settings::privacy::PrivacyError,
+    > {
+        Err(gateway_core::settings::privacy::PrivacyError {
+            rule_index: 0,
+            reason: "Provider 不支持隐私策略",
+        })
+    }
+
+    fn preview_privacy_policy(
+        &self,
+        _request: gateway_core::settings::privacy::PrivacyPreviewRequest,
+    ) -> Result<
+        gateway_core::settings::privacy::PrivacyPreviewResult,
+        gateway_core::settings::privacy::PrivacyError,
+    > {
+        Err(gateway_core::settings::privacy::PrivacyError {
+            rule_index: 0,
+            reason: "Provider 不支持隐私策略",
+        })
+    }
+
    /// 只读内置价目；没有本地计价能力的 Provider 返回空目录
    fn pricing_catalog(&self) -> crate::model::pricing::ProviderPricingCatalog {
        Default::default()
@@ -6,14 +6,14 @@ use std::{collections::BTreeMap, net::IpAddr, sync::Arc, time::Duration};

 use async_trait::async_trait;
 use chrono::{DateTime, Utc};
-use futures::stream::BoxStream;

 use super::backup::BackupStorePorts;
 use crate::model::{
    MutationContext, Revision,
    account_groups::{
-        AccountGroupListQuery, AccountGroupMemberFact, AccountGroupMutation, AccountGroupPage,
-        DeleteAccountGroup, NewAccountGroup, SetAccountGroupEnabled, UpdateAccountGroup,
+        AccountGroupListQuery, AccountGroupMemberFact, AccountGroupMutation,
+        AccountGroupOptionsPage, AccountGroupPage, DeleteAccountGroup, NewAccountGroup,
+        SetAccountGroupEnabled, UpdateAccountGroup,
    },
    accounts::{
        AccountListQuery, AccountPage, AccountPageItem, AccountRuntimeSnapshot,
@@ -29,7 +29,8 @@ use crate::model::{
    observability::{
        DashboardObservation, DashboardQuery, DiagnosticDimension, DiagnosticsObservation,
        Granularity, OpsErrorPage, OpsErrorQuery, RequestMetricPoint, TimeRange,
-        UsageCalculatedBillingFact, UsageDetail, UsageFilter, UsageOverview, UsagePage, UsageQuery,
+        UsageBillingProjection, UsageCalculatedBillingFact, UsageDetail, UsageFilter,
+        UsageInsightsObservation, UsageOverview, UsagePage, UsageQuery,
    },
    provider_credentials::{
        AuthorizationCommit, CredentialDetails, CredentialImportCommit, CredentialImportResult,
@@ -293,12 +294,12 @@ pub trait AuthStore: Send + Sync {

    async fn store_session(&self, session_id: &str, session: &AuthSession) -> AdminStoreResult<()>;

-    /// 只延长仍存在且匹配的会话；并发续期返回当前值，已退出或过期时不重建
-    async fn renew_session(
+    /// 原子替换或撤销仍匹配的会话并返回当前值；过期或退出后不重新创建
+    async fn compare_exchange_session(
        &self,
        session_id: &str,
        expected: &AuthSession,
-        expires_at: chrono::DateTime<chrono::Utc>,
+        replacement: Option<&AuthSession>,
    ) -> AdminStoreResult<Option<AuthSession>>;

    async fn delete_session(&self, session_id: &str) -> AdminStoreResult<Option<AuthSession>>;
@@ -385,6 +386,11 @@ pub trait AccountGroupStore: Send + Sync {
        query: AccountGroupListQuery,
    ) -> AdminStoreResult<AccountGroupPage>;

+    async fn list_account_group_options(
+        &self,
+        query: AccountGroupListQuery,
+    ) -> AdminStoreResult<AccountGroupOptionsPage>;
+
    async fn load_account_group_members(
        &self,
        group_ids: &[gateway_core::routing::AccountGroupId],
@@ -415,13 +421,23 @@ pub trait AccountGroupStore: Send + Sync {
    ) -> AdminStoreResult<AccountGroupMutation>;
 }

-/// 逐条读取的已计算费用事实；消费结束或丢弃时释放查询资源
-pub type UsageCalculatedBillingStream<'a> =
-    BoxStream<'a, AdminStoreResult<UsageCalculatedBillingFact>>;
+/// 后台投影复用 Admin 与 Provider 的费用规则，Store 不重新解释价格
+pub trait UsageBillingProjector: Send + Sync {
+    fn project(
+        &self,
+        fact: &UsageCalculatedBillingFact,
+    ) -> Result<UsageBillingProjection, crate::model::AdminError>;
+}

 /// 用量、趋势、诊断与运维错误的只读能力
 #[async_trait]
 pub trait ObservabilityStore: Send + Sync {
+    /// 读取实现声明的总预算，缓存等待沿用同一配置，避免外层提前截断
+    fn query_timeout(&self) -> std::time::Duration;
+
+    /// 缓存必须与删除和后台投影提交的版本一致
+    async fn analytics_cache_generation(&self) -> AdminStoreResult<u64>;
+
    /// 返回历史统计区间和指定观测时刻下的实时账号状态
    async fn dashboard_summary(
        &self,
@@ -442,14 +458,13 @@ pub trait ObservabilityStore: Send + Sync {
        granularity: Granularity,
    ) -> AdminStoreResult<Vec<RequestMetricPoint>>;

-    /// 流式返回可由 Provider 重新校验的已计算费用事实，不保证顺序
-    /// 查询及解码错误由流返回；调用方应逐条聚合，避免收集整个区间
-    fn usage_calculated_billing_facts(
+    /// 同一读取快照中的汇总、趋势和已投影情景费用
+    async fn usage_insights_observation(
        &self,
        range: TimeRange,
        filter: UsageFilter,
        granularity: Granularity,
-    ) -> UsageCalculatedBillingStream<'_>;
+    ) -> AdminStoreResult<UsageInsightsObservation>;

    async fn list_usage_records(&self, query: UsageQuery) -> AdminStoreResult<UsagePage>;

@@ -25,6 +25,13 @@ pub(super) fn register(
        }};
    }
    register!(Load, load, (), ());
+    register!(
+        PreviewPrivacyPolicy,
+        preview_privacy_policy,
+        gateway_core::settings::privacy::PrivacyPreviewRequest,
+        request,
+        request
+    );
    register!(
        Replace,
        replace,
@@ -19,9 +19,9 @@ use crate::{
        AdminError, MutationContext,
        account_groups::{
            AccountGroupAccountSummary, AccountGroupCapacity, AccountGroupListQuery,
-            AccountGroupMemberFact, AccountGroupMutation, AccountGroupPage, AccountGroupRecord,
-            CreateAccountGroup, DeleteAccountGroup, NewAccountGroup, SetAccountGroupEnabled,
-            UpdateAccountGroup,
+            AccountGroupMemberFact, AccountGroupMutation, AccountGroupOptionsPage,
+            AccountGroupPage, AccountGroupRecord, CreateAccountGroup, DeleteAccountGroup,
+            NewAccountGroup, SetAccountGroupEnabled, UpdateAccountGroup,
        },
    },
    ports::store::{AccountGroupStore, AccountRuntimeStore},
@@ -33,6 +33,10 @@ use super::{map_store_error, publish_committed};
 #[async_trait]
 pub trait AccountGroupService: Send + Sync {
    async fn list(&self, query: AccountGroupListQuery) -> Result<AccountGroupPage, AdminError>;
+    async fn list_options(
+        &self,
+        query: AccountGroupListQuery,
+    ) -> Result<AccountGroupOptionsPage, AdminError>;
    async fn create(
        &self,
        context: &MutationContext,
@@ -130,6 +134,16 @@ impl AccountGroupService for DefaultAccountGroupService {
        Ok(page)
    }

+    async fn list_options(
+        &self,
+        query: AccountGroupListQuery,
+    ) -> Result<AccountGroupOptionsPage, AdminError> {
+        self.store
+            .list_account_group_options(query)
+            .await
+            .map_err(|error| map_store_error(error, "account group options"))
+    }
+
    async fn create(
        &self,
        context: &MutationContext,
@@ -0,0 +1,139 @@
+//! 控制面认证端口、会话策略与访问和续期共用的身份校验
+
+use std::{net::IpAddr, sync::Arc};
+
+use async_trait::async_trait;
+use base64::{Engine as _, engine::general_purpose::URL_SAFE_NO_PAD};
+use chrono::{Duration, Utc};
+use gateway_core::engine::execution::ClientKeyVerifier;
+use sha2::{Digest as _, Sha256};
+
+use super::map_store_error;
+use crate::{
+    model::{
+        AdminError,
+        auth::{
+            AuthSession, ChangePassword, LoginCommand, LoginError, SessionGrant, SessionSubject,
+        },
+    },
+    ports::store::AuthStore,
+};
+
+mod service;
+mod session;
+
+/// 所有控制面接口消费同一个会话服务，权限由服务端身份决定
+#[async_trait]
+pub trait AuthService: Send + Sync {
+    async fn change_password(
+        &self,
+        session_id: Option<&str>,
+        command: ChangePassword,
+        source_ip: IpAddr,
+    ) -> Result<(), AdminError>;
+    async fn ensure_default_admin(&self, password: &str) -> Result<bool, AdminError>;
+    async fn session(&self, session_id: Option<&str>) -> Result<Option<AuthSession>, AdminError>;
+    async fn renew_session(
+        &self,
+        refresh_token: Option<&str>,
+        access_token: Option<&str>,
+    ) -> Result<Option<SessionGrant>, AdminError>;
+    async fn resolve_admin_user_id(
+        &self,
+        session_id: Option<&str>,
+    ) -> Result<Option<String>, AdminError>;
+    async fn verify_admin_api_key(&self, key: &str) -> Result<bool, AdminError>;
+    async fn login(
+        &self,
+        command: LoginCommand,
+        source_ip: IpAddr,
+        previous_session_id: Option<&str>,
+    ) -> Result<SessionGrant, LoginError>;
+    async fn logout(&self, session_id: &str) -> Result<(), AdminError>;
+}
+
+const MAX_SESSION_TTL_MINUTES: i64 = 366 * 24 * 60;
+
+pub(crate) struct DefaultAuthService {
+    default_admin_user_id: String,
+    admin_access_ttl: Duration,
+    admin_session_ttl: Duration,
+    admin_session_absolute_ttl: Duration,
+    key_session_ttl: Duration,
+    store: Arc<dyn AuthStore>,
+    verifier: Arc<dyn ClientKeyVerifier>,
+}
+
+impl DefaultAuthService {
+    #[must_use]
+    pub(crate) fn new(
+        config: &crate::AdminConfig,
+        key_session_ttl_minutes: u64,
+        store: Arc<dyn AuthStore>,
+        verifier: Arc<dyn ClientKeyVerifier>,
+    ) -> Self {
+        let admin_session_ttl = session_ttl(config.session_ttl_minutes);
+        Self {
+            default_admin_user_id: config.default_username.clone(),
+            // 访问凭据最多有效 24 小时，较短的不活动期限也要留出续期窗口
+            admin_access_ttl: Duration::hours(24).min(admin_session_ttl / 4),
+            admin_session_ttl,
+            admin_session_absolute_ttl: session_ttl(config.session_absolute_ttl_minutes),
+            key_session_ttl: session_ttl(key_session_ttl_minutes),
+            store,
+            verifier,
+        }
+    }
+
+    async fn load_live_session(&self, id: &str) -> Result<Option<AuthSession>, AdminError> {
+        let Some(session) = self
+            .store
+            .load_session(id)
+            .await
+            .map_err(|error| map_store_error(error, "authentication session"))?
+        else {
+            return Ok(None);
+        };
+        if session.retained_until() <= Utc::now()
+            || session
+                .absolute_expires_at
+                .is_some_and(|expiry| expiry <= Utc::now())
+        {
+            return Ok(None);
+        }
+        let valid = match &session.subject {
+            SessionSubject::Admin {
+                admin_user_id,
+                credential_fingerprint,
+            } => self
+                .store
+                .load_password_hash(admin_user_id)
+                .await
+                .map_err(|error| map_store_error(error, "administrator session"))?
+                .is_some_and(|hash| password_fingerprint(&hash) == *credential_fingerprint),
+            SessionSubject::Key { client_key_id } => self
+                .store
+                .client_key_enabled(client_key_id)
+                .await
+                .map_err(|error| map_store_error(error, "session key"))?,
+        };
+        if !valid {
+            let _ = self.store.delete_session(id).await;
+            return Ok(None);
+        }
+        Ok(Some(session))
+    }
+}
+
+fn session_ttl(minutes: u64) -> Duration {
+    Duration::minutes(
+        i64::try_from(minutes)
+            .unwrap_or(MAX_SESSION_TTL_MINUTES)
+            .clamp(1, MAX_SESSION_TTL_MINUTES),
+    )
+}
+
+// 指纹只绑定已加盐的密码哈希，不把密码或原始哈希复制到 Redis 会话
+fn password_fingerprint(password_hash: &str) -> String {
+    URL_SAFE_NO_PAD.encode(Sha256::digest(password_hash.as_bytes()))
+}
@@ -1,93 +1,35 @@
-//! 控制面登录、会话恢复与身份校验的唯一 owner
+//! 管理员和 Key 的登录、退出、密码策略与会话访问

-use std::{net::IpAddr, sync::Arc, time::Duration as StdDuration};
+use std::{net::IpAddr, time::Duration as StdDuration};

 use argon2::{Argon2, PasswordHash, PasswordHasher, PasswordVerifier};
 use async_trait::async_trait;
 use base64::{Engine as _, engine::general_purpose::URL_SAFE_NO_PAD};
-use chrono::{Duration, Utc};
-use gateway_core::engine::execution::ClientKeyVerifier;
+use chrono::Utc;
 use rand_core::{OsRng, RngCore as _};
-use sha2::{Digest, Sha256};
 use subtle::ConstantTimeEq as _;
 use uuid::Uuid;

+use super::{
+    AuthService, DefaultAuthService, password_fingerprint,
+    session::{self, Credential, storage_id},
+};
 use crate::{
    model::{
        AdminError, AdminErrorKind,
        auth::{
            AdminAuditEvent, AuditActorKind, AuthSession, ChangePassword, LoginCommand, LoginError,
-            LoginResult, SessionSubject,
+            SessionGrant, SessionSubject,
        },
    },
-    ports::store::AuthStore,
+    use_case::map_store_error,
 };

-use super::map_store_error;
-
-/// 所有控制面接口消费同一个会话服务，权限由服务端身份决定
-#[async_trait]
-pub trait AuthService: Send + Sync {
-    async fn change_password(
-        &self,
-        session_id: Option<&str>,
-        command: ChangePassword,
-        source_ip: IpAddr,
-    ) -> Result<(), AdminError>;
-    async fn ensure_default_admin(&self, password: &str) -> Result<bool, AdminError>;
-    async fn session(&self, session_id: Option<&str>) -> Result<Option<AuthSession>, AdminError>;
-    async fn renew_session(
-        &self,
-        session_id: Option<&str>,
-    ) -> Result<Option<AuthSession>, AdminError>;
-    async fn resolve_admin_user_id(
-        &self,
-        session_id: Option<&str>,
-    ) -> Result<Option<String>, AdminError>;
-    async fn verify_admin_api_key(&self, key: &str) -> Result<bool, AdminError>;
-    async fn login(
-        &self,
-        command: LoginCommand,
-        source_ip: IpAddr,
-        previous_session_id: Option<&str>,
-    ) -> Result<LoginResult, LoginError>;
-    async fn logout(&self, session_id: &str) -> Result<(), AdminError>;
-}
-
-const MAX_SESSION_TTL_MINUTES: i64 = 366 * 24 * 60;
 const LOGIN_WINDOW: StdDuration = StdDuration::from_secs(60);
 const LOGIN_ATTEMPTS_PER_SOURCE: u32 = 10;
 const LOGIN_ATTEMPTS_GLOBAL: u32 = 200;

-pub(crate) struct DefaultAuthService {
-    default_admin_user_id: String,
-    admin_session_ttl: Duration,
-    admin_session_absolute_ttl: Duration,
-    key_session_ttl: Duration,
-    store: Arc<dyn AuthStore>,
-    verifier: Arc<dyn ClientKeyVerifier>,
-}
-
 impl DefaultAuthService {
-    #[must_use]
-    pub(crate) fn new(
-        default_admin_user_id: impl Into<String>,
-        admin_session_ttl_minutes: u64,
-        admin_session_absolute_ttl_minutes: u64,
-        key_session_ttl_minutes: u64,
-        store: Arc<dyn AuthStore>,
-        verifier: Arc<dyn ClientKeyVerifier>,
-    ) -> Self {
-        Self {
-            default_admin_user_id: default_admin_user_id.into(),
-            admin_session_ttl: session_ttl(admin_session_ttl_minutes),
-            admin_session_absolute_ttl: session_ttl(admin_session_absolute_ttl_minutes),
-            key_session_ttl: session_ttl(key_session_ttl_minutes),
-            store,
-            verifier,
-        }
-    }
-
    fn auth_audit(&self, action: &str, admin_user_id: &str) -> AdminAuditEvent {
        AdminAuditEvent {
            id: format!("audit_{}", Uuid::now_v7().simple()),
@@ -228,50 +170,23 @@ impl AuthService for DefaultAuthService {
    }

    async fn session(&self, session_id: Option<&str>) -> Result<Option<AuthSession>, AdminError> {
-        let Some(session_id) = session_id.filter(|value| !value.is_empty()) else {
+        let Some(raw) = session_id.filter(|value| !value.is_empty()) else {
            return Ok(None);
        };
-        let Some(session) = self
-            .store
-            .load_session(session_id)
-            .await
-            .map_err(|error| map_store_error(error, "authentication session"))?
-        else {
+        let Some(session) = self.load_live_session(storage_id(raw)).await? else {
            return Ok(None);
        };
-        if session.expires_at <= Utc::now()
-            || session
-                .absolute_expires_at
-                .is_some_and(|expiry| expiry <= Utc::now())
-        {
-            // Redis 的 TTL 负责过期清理，避免旧读取删除另一个请求刚续期的会话
+        if session.expires_at <= Utc::now() {
            return Ok(None);
        }
-        if let SessionSubject::Admin {
-            admin_user_id,
-            credential_fingerprint,
-        } = &session.subject
-        {
-            let password_hash = self
-                .store
-                .load_password_hash(admin_user_id)
-                .await
-                .map_err(|error| map_store_error(error, "administrator session"))?;
-            if password_hash
-                .is_none_or(|hash| password_fingerprint(&hash) != *credential_fingerprint)
-            {
-                let _ = self.store.delete_session(session_id).await;
+        if let Some(renewal) = &session.renewal {
+            let Some(credential) = Credential::parse(raw).filter(|value| !value.refresh) else {
+                return Ok(None);
+            };
+            if !credential.owns(renewal) {
                return Ok(None);
            }
-        }
-        if let SessionSubject::Key { client_key_id } = &session.subject
-            && !self
-                .store
-                .client_key_enabled(client_key_id)
-                .await
-                .map_err(|error| map_store_error(error, "session key"))?
-        {
-            let _ = self.store.delete_session(session_id).await;
+        } else if Credential::parse(raw).is_some() {
            return Ok(None);
        }
        Ok(Some(session))
@@ -279,33 +194,25 @@ impl AuthService for DefaultAuthService {

    async fn renew_session(
        &self,
-        session_id: Option<&str>,
-    ) -> Result<Option<AuthSession>, AdminError> {
-        let Some(session_id) = session_id else {
-            return Ok(None);
-        };
-        let Some(session) = self.session(Some(session_id)).await? else {
-            return Ok(None);
-        };
-        // Key 与升级前的会话保留原有期限，不能凭续期获得新的最长登录窗口
-        let Some(absolute) = session
-            .absolute_expires_at
-            .filter(|_| matches!(session.subject, SessionSubject::Admin { .. }))
-        else {
-            return Ok(Some(session));
-        };
-        let now = Utc::now();
-        let expires_at = (now + self.admin_session_ttl).min(absolute);
-        let interval = (self.admin_session_ttl / 4).min(Duration::minutes(1));
-        if expires_at <= session.expires_at
-            || session.expires_at - now > self.admin_session_ttl - interval
-        {
-            return Ok(Some(session));
+        refresh_token: Option<&str>,
+        access_token: Option<&str>,
+    ) -> Result<Option<SessionGrant>, AdminError> {
+        if let Some(refresh) = refresh_token {
+            return self.refresh(refresh).await;
        }
-        self.store
-            .renew_session(session_id, &session, expires_at)
-            .await
-            .map_err(|error| map_store_error(error, "authentication session renewal"))
+        // Key 与升级前的单凭据仅返回仍有效的原会话，不授予新的续期能力
+        let Some(session) = self
+            .session(access_token)
+            .await?
+            .filter(|session| session.renewal.is_none())
+        else {
+            return Ok(None);
+        };
+        Ok(Some(SessionGrant {
+            session_id: access_token.unwrap_or_default().to_owned(),
+            refresh_token: None,
+            session,
+        }))
    }

    async fn resolve_admin_user_id(
@@ -346,7 +253,7 @@ impl AuthService for DefaultAuthService {
        command: LoginCommand,
        source_ip: IpAddr,
        previous_session_id: Option<&str>,
-    ) -> Result<LoginResult, LoginError> {
+    ) -> Result<SessionGrant, LoginError> {
        if let Some(retry_after) = self
            .store
            .consume_login_attempt(
@@ -370,14 +277,31 @@ impl AuthService for DefaultAuthService {
        let now = Utc::now();
        let absolute_expires_at = matches!(subject, SessionSubject::Admin { .. })
            .then_some(now + self.admin_session_absolute_ttl);
-        let session = AuthSession {
-            subject,
-            expires_at: (now + ttl).min(absolute_expires_at.unwrap_or(now + ttl)),
-            absolute_expires_at,
+        let refresh_expiry = (now + ttl).min(absolute_expires_at.unwrap_or(now + ttl));
+        let grant = if let Some(absolute) = absolute_expires_at {
+            session::issue(
+                subject,
+                (now + self.admin_access_ttl).min(refresh_expiry),
+                refresh_expiry,
+                absolute,
+            )
+            .map_err(|_| LoginError::Unavailable)?
+        } else {
+            SessionGrant {
+                session_id: random_session_token(),
+                refresh_token: None,
+                session: AuthSession {
+                    subject,
+                    expires_at: refresh_expiry,
+                    absolute_expires_at: None,
+                    renewal: None,
+                },
+            }
        };
-        let session_id = random_session_token();
+        let session_id = storage_id(&grant.session_id);
+        let session = &grant.session;
        self.store
-            .store_session(&session_id, &session)
+            .store_session(session_id, session)
            .await
            .map_err(|_| LoginError::Unavailable)?;
        if let SessionSubject::Admin { admin_user_id, .. } = &session.subject
@@ -387,26 +311,39 @@ impl AuthService for DefaultAuthService {
                .await
                .is_err()
        {
-            let _ = self.store.delete_session(&session_id).await;
+            let _ = self.store.delete_session(session_id).await;
            return Err(LoginError::Unavailable);
        }
        // 新身份验证成功后才撤销旧会话；撤销失败时不向浏览器提交新会话
        if let Some(previous) = previous_session_id.filter(|value| !value.is_empty())
            && self.logout(previous).await.is_err()
        {
-            let _ = self.store.delete_session(&session_id).await;
+            let _ = self.store.delete_session(session_id).await;
            return Err(LoginError::Unavailable);
        }
-        Ok(LoginResult {
-            session_id,
-            session,
-        })
+        Ok(grant)
    }

    async fn logout(&self, session_id: &str) -> Result<(), AdminError> {
+        let id = storage_id(session_id);
+        let Some(stored) = self
+            .store
+            .load_session(id)
+            .await
+            .map_err(|error| map_store_error(error, "authentication session"))?
+        else {
+            return Ok(());
+        };
+        if let Some(renewal) = &stored.renewal {
+            if !Credential::parse(session_id).is_some_and(|credential| credential.owns(renewal)) {
+                return Ok(());
+            }
+        } else if Credential::parse(session_id).is_some() {
+            return Ok(());
+        }
        let session = self
            .store
-            .delete_session(session_id)
+            .delete_session(id)
            .await
            .map_err(|error| map_store_error(error, "authentication session"))?;
        if let Some(AuthSession {
@@ -423,14 +360,6 @@ impl AuthService for DefaultAuthService {
    }
 }

-fn session_ttl(minutes: u64) -> Duration {
-    Duration::minutes(
-        i64::try_from(minutes)
-            .unwrap_or(MAX_SESSION_TTL_MINUTES)
-            .clamp(1, MAX_SESSION_TTL_MINUTES),
-    )
-}
-
 fn validate_new_password(password: &str) -> Result<(), AdminError> {
    if password.trim().chars().count() < 12
        || password.len() > 1024
@@ -470,8 +399,3 @@ fn valid_admin_api_key_shape(value: &str) -> bool {
        && value.starts_with("admin-")
        && value[6..].bytes().all(|byte| byte.is_ascii_hexdigit())
 }
-
-// 指纹只绑定已加盐的密码哈希，不把密码或原始哈希复制到 Redis 会话
-fn password_fingerprint(password_hash: &str) -> String {
-    URL_SAFE_NO_PAD.encode(Sha256::digest(password_hash.as_bytes()))
-}
@@ -0,0 +1,214 @@
+//! 双凭据会话的签发、摘要校验与短窗口重试，不持久化可直接使用的凭据
+
+use base64::{Engine as _, engine::general_purpose::URL_SAFE_NO_PAD};
+use chrono::{DateTime, Duration, Utc};
+use rand_core::{OsRng, RngCore as _};
+use sha2::{Digest as _, Sha256};
+use subtle::ConstantTimeEq as _;
+
+use super::DefaultAuthService;
+use crate::{
+    model::{
+        AdminError, AdminErrorKind,
+        auth::{AuthSession, SessionGrant, SessionRefreshReplay, SessionRenewal, SessionSubject},
+    },
+    use_case::map_store_error,
+};
+
+const REPLAY_WINDOW: Duration = Duration::seconds(30);
+
+pub(super) struct Credential<'a> {
+    pub id: &'a str,
+    pub secret: &'a str,
+    pub refresh: bool,
+}
+
+impl<'a> Credential<'a> {
+    pub fn parse(value: &'a str) -> Option<Self> {
+        let mut parts = value.split('.');
+        let refresh = match parts.next()? {
+            "a2" => false,
+            "r2" => true,
+            _ => return None,
+        };
+        let id = parts.next()?;
+        let secret = parts.next()?;
+        if parts.next().is_some() || !valid_secret(id) || !valid_secret(secret) {
+            return None;
+        }
+        Some(Self {
+            id,
+            secret,
+            refresh,
+        })
+    }
+
+    pub fn digest(&self) -> [u8; 32] {
+        digest(self.secret)
+    }
+
+    pub fn owns(&self, renewal: &SessionRenewal) -> bool {
+        if self.refresh {
+            matches_digest(&renewal.refresh_digest, &self.digest())
+                || renewal
+                    .previous
+                    .as_ref()
+                    .is_some_and(|previous| matches_digest(&previous.digest, &self.digest()))
+        } else {
+            matches_digest(&renewal.access_digest, &self.digest())
+        }
+    }
+}
+
+fn valid_secret(value: &str) -> bool {
+    value.len() == 43
+        && URL_SAFE_NO_PAD
+            .decode(value)
+            .is_ok_and(|bytes| bytes.len() == 32)
+}
+
+pub(super) fn storage_id(value: &str) -> &str {
+    Credential::parse(value).map_or(value, |credential| credential.id)
+}
+
+fn matches_digest(left: &[u8; 32], right: &[u8; 32]) -> bool {
+    bool::from(left.ct_eq(right))
+}
+
+fn digest(secret: &str) -> [u8; 32] {
+    Sha256::digest(secret.as_bytes()).into()
+}
+
+fn random_bytes() -> [u8; 32] {
+    let mut bytes = [0; 32];
+    OsRng.fill_bytes(&mut bytes);
+    bytes
+}
+
+// 使用标准 HKDF 的独立用途标签；只有盐和摘要留在 Store，重试仍须持有原始凭据
+fn derive(secret: &str, salt: Option<&[u8]>, purpose: &[u8]) -> Result<String, AdminError> {
+    let mut output = [0; 32];
+    hkdf::Hkdf::<Sha256>::new(salt, secret.as_bytes())
+        .expand(purpose, &mut output)
+        .map_err(|_| AdminError::internal("会话凭据派生失败"))?;
+    Ok(URL_SAFE_NO_PAD.encode(output))
+}
+
+fn access_secret(refresh: &str) -> Result<String, AdminError> {
+    derive(refresh, None, b"cpr-session-v2/access")
+}
+
+pub(super) fn issue(
+    subject: SessionSubject,
+    access_expiry: DateTime<Utc>,
+    refresh_expiry: DateTime<Utc>,
+    absolute: DateTime<Utc>,
+) -> Result<SessionGrant, AdminError> {
+    let id = URL_SAFE_NO_PAD.encode(random_bytes());
+    let secret = URL_SAFE_NO_PAD.encode(random_bytes());
+    let session = AuthSession {
+        subject,
+        expires_at: access_expiry,
+        absolute_expires_at: Some(absolute),
+        renewal: Some(SessionRenewal {
+            expires_at: refresh_expiry,
+            access_digest: digest(&access_secret(&secret)?),
+            refresh_digest: digest(&secret),
+            previous: None,
+        }),
+    };
+    grant(&id, &secret, session)
+}
+
+fn grant(id: &str, refresh: &str, session: AuthSession) -> Result<SessionGrant, AdminError> {
+    Ok(SessionGrant {
+        session_id: format!("a2.{id}.{}", access_secret(refresh)?),
+        refresh_token: Some(format!("r2.{id}.{refresh}")),
+        session,
+    })
+}
+
+impl DefaultAuthService {
+    pub(super) async fn refresh(&self, raw: &str) -> Result<Option<SessionGrant>, AdminError> {
+        let Some(credential) = Credential::parse(raw).filter(|value| value.refresh) else {
+            return Ok(None);
+        };
+        let mut current = self.load_live_session(credential.id).await?;
+        // CAS 冲突只重新解释同一请求的凭据，不对并发退出进行补建
+        for _ in 0..3 {
+            let Some(session) = current else {
+                return Ok(None);
+            };
+            let Some(renewal) = &session.renewal else {
+                return Ok(None);
+            };
+            let now = Utc::now();
+            if session.retained_until() <= now
+                || session.absolute_expires_at.is_none_or(|limit| limit <= now)
+            {
+                return Ok(None);
+            }
+            if matches_digest(&renewal.refresh_digest, &credential.digest()) {
+                // 其他标签页已经刷新或客户端重试时复用当前代，避免 Cookie 响应相互覆盖
+                if session.expires_at > now {
+                    return grant(credential.id, credential.secret, session).map(Some);
+                }
+                let absolute = session
+                    .absolute_expires_at
+                    .ok_or_else(|| AdminError::internal("缺少会话最长有效期"))?;
+                let salt = random_bytes();
+                let next_secret =
+                    derive(credential.secret, Some(&salt), b"cpr-session-v2/refresh")?;
+                let refresh_expiry = (now + self.admin_session_ttl).min(absolute);
+                let access_expiry = (now + self.admin_access_ttl).min(refresh_expiry);
+                let replacement = AuthSession {
+                    expires_at: access_expiry,
+                    renewal: Some(SessionRenewal {
+                        expires_at: refresh_expiry,
+                        access_digest: digest(&access_secret(&next_secret)?),
+                        refresh_digest: digest(&next_secret),
+                        previous: Some(SessionRefreshReplay {
+                            digest: credential.digest(),
+                            salt,
+                            expires_at: (now + REPLAY_WINDOW).min(access_expiry),
+                        }),
+                    }),
+                    ..session.clone()
+                };
+                current = self
+                    .store
+                    .compare_exchange_session(credential.id, &session, Some(&replacement))
+                    .await
+                    .map_err(|error| map_store_error(error, "authentication session rotation"))?;
+                if current.as_ref() == Some(&replacement) {
+                    return grant(credential.id, &next_secret, replacement).map(Some);
+                }
+            } else if let Some(previous) = renewal
+                .previous
+                .as_ref()
+                .filter(|previous| matches_digest(&previous.digest, &credential.digest()))
+            {
+                if previous.expires_at > now {
+                    let secret = derive(
+                        credential.secret,
+                        Some(&previous.salt),
+                        b"cpr-session-v2/refresh",
+                    )?;
+                    return grant(credential.id, &secret, session).map(Some);
+                }
+                // 已知上一代在重试窗口外再次使用，原子撤销整个会话
+                current = self
+                    .store
+                    .compare_exchange_session(credential.id, &session, None)
+                    .await
+                    .map_err(|error| map_store_error(error, "authentication session revocation"))?;
+            } else {
+                return Ok(None);
+            }
+        }
+        Err(AdminError::new(
+            AdminErrorKind::Unavailable,
+            "会话正在变更，请重试",
+        ))
+    }
+}
@@ -192,10 +192,12 @@ impl KeyUsageService for DefaultKeyUsageService {
                .ok_or_else(|| AdminError::internal("时间超出支持范围"))?,
            end: now,
        };
-        let (overview, trend, health_points) = futures::try_join!(
-            self.observations.usage_summary(query.range, filter.clone()),
-            self.observations
-                .usage_trend(query.range, filter, Granularity::for_range(query.range)),
+        let (observation, health_points) = futures::try_join!(
+            self.observations.usage_insights_observation(
+                query.range,
+                filter,
+                Granularity::for_range(query.range)
+            ),
            self.observations.usage_trend(
                today,
                usage_filter(&id, None),
@@ -205,8 +207,8 @@ impl KeyUsageService for DefaultKeyUsageService {
        .map_err(|error| map_store_error(error, "key usage overview"))?;
        Ok(Some(KeyUsageOverview {
            key,
-            overview,
-            trend,
+            overview: observation.overview,
+            trend: observation.trend,
            health_timeline: health_timeline_at(&health_points, now, self.timezone)?,
        }))
    }
@@ -4,12 +4,10 @@ use std::{
    collections::{BTreeMap, HashMap, btree_map::Entry},
    str::FromStr,
    sync::Arc,
-    time::{Duration as StdDuration, Instant},
 };

 use async_trait::async_trait;
 use chrono::{DateTime, Duration, Utc};
-use futures::TryStreamExt;
 use gateway_core::{account::ProviderAccountId, routing::ProviderKind};

 use crate::{
@@ -21,16 +19,16 @@ use crate::{
            DiagnosticDimension, DiagnosticsItem, DiagnosticsResult, Granularity, HealthStatus,
            HealthTimeline, HealthTimelinePoint, OpsErrorPage, OpsErrorQuery, ProviderBillingInput,
            RequestMetricPoint, RequestMetrics, TimeRange, Trend, TrendKind, TrendPoint,
-            TrendSummary, UsageBilling, UsageCalculatedBillingFact, UsageDetail, UsageFilter,
-            UsageInsights, UsageInsightsCost, UsageInsightsCostPoint, UsageInsightsHealth,
-            UsageInsightsHealthPoint, UsageInsightsPerformance, UsageInsightsPerformancePoint,
-            UsageOverview, UsagePage, UsageQuery, UsageSummary,
+            TrendSummary, UsageBilling, UsageBillingProjection, UsageCalculatedBillingFact,
+            UsageDetail, UsageFilter, UsageInsights, UsageInsightsCost, UsageInsightsCostPoint,
+            UsageInsightsHealth, UsageInsightsHealthPoint, UsageInsightsPerformance,
+            UsageInsightsPerformancePoint, UsageOverview, UsagePage, UsageQuery, UsageSummary,
        },
        provider_credentials::ProviderQuotaRequest,
    },
    ports::{
        provider::{ProviderAdminErrorKind, ProviderAdminRegistry},
-        store::{AccountStore, ObservabilityStore, SettingsStore, UsageCalculatedBillingStream},
+        store::{AccountStore, ObservabilityStore, SettingsStore, UsageBillingProjector},
    },
 };

@@ -39,59 +37,9 @@ use super::{map_provider_error, map_store_error};
 const HEALTH_TIMELINE_SLOT_MINUTES: i64 = 15;
 const HEALTH_TIMELINE_MIN_SAMPLE_SIZE: u64 = 10;
 const HEALTH_TIMELINE_UNAVAILABLE_FAILURE_THRESHOLD: u64 = 3;
-const HEALTH_TIMELINE_STABLE_RELIABILITY: f64 = 99.0;
-const DASHBOARD_QUERY_BUCKET_SECONDS: i64 = 2;
-const DASHBOARD_QUERY_CACHE_RETENTION: StdDuration = StdDuration::from_secs(2);
-
-#[derive(Clone, Copy, PartialEq, Eq, Hash)]
-struct DashboardQueryKey {
-    start: DateTime<Utc>,
-    end_bucket: i64,
-}
-
-impl DashboardQueryKey {
-    fn new(range: TimeRange) -> Self {
-        Self {
-            start: range.start,
-            end_bucket: range
-                .end
-                .timestamp()
-                .div_euclid(DASHBOARD_QUERY_BUCKET_SECONDS),
-        }
-    }
-}
-
-struct DashboardQueryEntry {
-    created_at: Instant,
-    result: Arc<tokio::sync::OnceCell<Result<DashboardResult, AdminError>>>,
-}
-
-#[derive(Default)]
-struct DashboardQueryCache {
-    entries: tokio::sync::Mutex<HashMap<DashboardQueryKey, DashboardQueryEntry>>,
-}
-
-impl DashboardQueryCache {
-    async fn result_cell(
-        &self,
-        key: DashboardQueryKey,
-    ) -> Arc<tokio::sync::OnceCell<Result<DashboardResult, AdminError>>> {
-        let now = Instant::now();
-        let mut entries = self.entries.lock().await;
-        entries.retain(|_, entry| {
-            now.duration_since(entry.created_at) < DASHBOARD_QUERY_CACHE_RETENTION
-        });
-        Arc::clone(
-            &entries
-                .entry(key)
-                .or_insert_with(|| DashboardQueryEntry {
-                    created_at: now,
-                    result: Arc::new(tokio::sync::OnceCell::new()),
-                })
-                .result,
-        )
-    }
-}
+const HEALTH_TIMELINE_STABLE_RELIABILITY: f64 = 95.0;
+mod store_cache;
+pub(crate) use store_cache::CachedObservabilityStore;

 /// API 消费的观测控制面服务
 #[async_trait]
@@ -130,7 +78,6 @@ pub(crate) struct DefaultObservabilityService {
    accounts: Arc<dyn AccountStore>,
    settings: Arc<dyn SettingsStore>,
    providers: ProviderAdminRegistry,
-    dashboard_queries: DashboardQueryCache,
 }

 impl DefaultObservabilityService {
@@ -148,7 +95,6 @@ impl DefaultObservabilityService {
            accounts,
            settings,
            providers,
-            dashboard_queries: DashboardQueryCache::default(),
        }
    }

@@ -185,7 +131,7 @@ impl DefaultObservabilityService {
        let yesterday = dashboard_period_metrics(&observation.trend, yesterday_start, today_start);
        let total_billing_usd = observation.totals.billing_usd.clone();
        let total_cached_token_rate = rate_or_zero(
-            observation.totals.cached_tokens,
+            observation.totals.cached_input_tokens,
            observation.totals.input_tokens,
        );
        let (first_token_latency_sum_ms, first_token_latency_count) = observation
@@ -199,7 +145,11 @@ impl DefaultObservabilityService {
            });
        let average_first_token_latency_ms =
            average(first_token_latency_sum_ms, first_token_latency_count);
-        let trend = trend(TrendKind::Usage, observation.trend.clone())?;
+        let trend = trend(
+            TrendKind::Usage,
+            observation.trend.clone(),
+            observation.analytics.clone(),
+        )?;
        let health_timeline =
            health_timeline_at(&observation.trend, observation.range.end, self.timezone)?;
        let wire_profiles = self
@@ -247,15 +197,12 @@ impl ObservabilityService for DefaultObservabilityService {
        range: TimeRange,
        kind: TrendKind,
    ) -> Result<DashboardResult, AdminError> {
-        let cell = self
-            .dashboard_queries
-            .result_cell(DashboardQueryKey::new(range))
-            .await;
-        let mut result = cell
-            .get_or_init(|| self.load_dashboard_summary(range))
-            .await
-            .clone()?;
-        result.trend = trend(kind, result.observation.trend.clone())?;
+        let mut result = self.load_dashboard_summary(range).await?;
+        result.trend = trend(
+            kind,
+            result.observation.trend.clone(),
+            result.observation.analytics.clone(),
+        )?;
        Ok(result)
    }

@@ -264,12 +211,16 @@ impl ObservabilityService for DefaultObservabilityService {
        range: TimeRange,
        kind: TrendKind,
    ) -> Result<Trend, AdminError> {
-        let points = self
+        let observation = self
            .store
-            .dashboard_trend(range, Granularity::for_range(range))
+            .usage_insights_observation(
+                range,
+                UsageFilter::default(),
+                Granularity::for_range(range),
+            )
            .await
            .map_err(|error| map_store_error(error, "dashboard trend"))?;
-        trend(kind, points)
+        trend(kind, observation.trend, observation.overview.analytics)
    }

    async fn usage_records(&self, query: UsageQuery) -> Result<UsagePage, AdminError> {
@@ -321,21 +272,22 @@ impl ObservabilityService for DefaultObservabilityService {
        filter: UsageFilter,
    ) -> Result<UsageInsights, AdminError> {
        let granularity = Granularity::for_range(range);
-        let aggregates = async {
-            futures::try_join!(
-                self.store.usage_summary(range, filter.clone()),
-                self.store.usage_trend(range, filter.clone(), granularity),
-            )
-            .map_err(|error| map_store_error(error, "usage insights"))
-        };
-        let ((overview, trend), standard_costs) = futures::try_join!(
-            aggregates,
-            recover_standard_costs(
-                &self.providers,
-                self.store
-                    .usage_calculated_billing_facts(range, filter.clone(), granularity),
-            ),
-        )?;
+        let observation = self
+            .store
+            .usage_insights_observation(range, filter, granularity)
+            .await
+            .map_err(|error| map_store_error(error, "usage insights"))?;
+        let mut standard_costs = UsageCostScenarios::default();
+        for point in observation.costs {
+            if let Some(amount) = point.standard_amount {
+                standard_costs.standard.add(point.bucket_start, amount)?;
+            }
+            if let Some(amount) = point.no_cache_amount {
+                standard_costs.no_cache.add(point.bucket_start, amount)?;
+            }
+        }
+        let overview = observation.overview;
+        let trend = observation.trend;
        build_usage_insights(overview, trend, standard_costs)
    }

@@ -389,7 +341,11 @@ impl ObservabilityService for DefaultObservabilityService {
                }
            })
            .collect::<Vec<_>>();
-        Ok(DiagnosticsResult { dimension, items })
+        Ok(DiagnosticsResult {
+            analytics: observation.analytics,
+            dimension,
+            items,
+        })
    }

    async fn ops_errors(&self, query: OpsErrorQuery) -> Result<OpsErrorPage, AdminError> {
@@ -423,8 +379,9 @@ fn build_usage_insights(
    }

    let requests = &overview.requests;
-    let failed_requests = service_failure_count(requests);
-    let health_requests = requests.success_count.saturating_add(failed_requests);
+    let health_window = HealthWindow::from_metrics(requests);
+    let failed_requests = health_window.failed_requests;
+    let health_requests = health_window.eligible_requests();
    let health = UsageInsightsHealth {
        total_requests: requests.request_count,
        success_requests: requests.success_count,
@@ -442,17 +399,19 @@ fn build_usage_insights(
        points: trend
            .iter()
            .map(|point| {
-                let failed_requests = service_failure_count(&point.metrics);
-                let health_requests = point.metrics.success_count.saturating_add(failed_requests);
+                let health_window = HealthWindow::from_metrics(&point.metrics);
                UsageInsightsHealthPoint {
                    total_requests: point.metrics.request_count,
                    bucket_start: point.bucket_start,
                    success_requests: point.metrics.success_count,
-                    failed_requests,
+                    failed_requests: health_window.failed_requests,
                    cancelled_requests: point.metrics.cancelled_count,
                    incomplete_requests: point.metrics.incomplete_count,
                    caller_error_requests: point.metrics.caller_error_count,
-                    error_rate: rate_or_zero(failed_requests, health_requests),
+                    error_rate: rate_or_zero(
+                        health_window.non_success_requests(),
+                        health_window.eligible_requests(),
+                    ),
                }
            })
            .collect(),
@@ -533,14 +492,14 @@ fn build_usage_insights(
        tier_premium,
        tokens_per_request: rate_or_zero(requests.total_tokens, requests.request_count),
        cost_per_successful_request,
-        cached_token_rate: rate_or_zero(requests.cached_tokens, requests.input_tokens),
+        cached_token_rate: rate_or_zero(requests.cached_input_tokens, requests.input_tokens),
        cache_hit_request_rate: ratio(
            requests.cache_hit_request_count,
            requests.cache_eligible_request_count,
        ),
        input_tokens: requests.input_tokens,
        output_tokens: requests.output_tokens,
-        cached_tokens: requests.cached_tokens,
+        cached_input_tokens: requests.cached_input_tokens,
        total_tokens: requests.total_tokens,
        points: trend
            .iter()
@@ -548,7 +507,7 @@ fn build_usage_insights(
                bucket_start: point.bucket_start,
                input_tokens: point.metrics.input_tokens,
                output_tokens: point.metrics.output_tokens,
-                cached_tokens: point.metrics.cached_tokens,
+                cached_input_tokens: point.metrics.cached_input_tokens,
                total_tokens: point.metrics.total_tokens,
                estimated_cost: usd_cost(&point.costs),
                standard_cost: standard_costs_by_bucket.get(&point.bucket_start).cloned(),
@@ -558,7 +517,7 @@ fn build_usage_insights(
                    usd_cost(&point.costs).as_ref(),
                ),
                cached_token_rate: rate_or_zero(
-                    point.metrics.cached_tokens,
+                    point.metrics.cached_input_tokens,
                    point.metrics.input_tokens,
                ),
                cache_hit_request_rate: ratio(
@@ -571,6 +530,7 @@ fn build_usage_insights(
        coverage: overview.attempts.cost_coverage.clone(),
    };
    Ok(UsageInsights {
+        analytics: overview.analytics,
        granularity,
        health,
        performance,
@@ -620,58 +580,65 @@ struct UsageCostScenarios {
    no_cache: ScenarioCosts,
 }

-async fn recover_standard_costs(
-    providers: &ProviderAdminRegistry,
-    mut facts: UsageCalculatedBillingStream<'_>,
-) -> Result<UsageCostScenarios, AdminError> {
-    let mut scenarios = UsageCostScenarios::default();
-    while let Some(mut fact) = facts
-        .try_next()
-        .await
-        .map_err(|error| map_store_error(error, "usage billing facts"))?
-    {
+/// 在后台投影时恢复费用场景，查询不再逐请求读取计费快照
+pub struct ProviderUsageBillingProjector {
+    providers: ProviderAdminRegistry,
+}
+
+impl ProviderUsageBillingProjector {
+    #[must_use]
+    pub fn new(providers: ProviderAdminRegistry) -> Self {
+        Self { providers }
+    }
+}
+
+impl UsageBillingProjector for ProviderUsageBillingProjector {
+    fn project(
+        &self,
+        fact: &UsageCalculatedBillingFact,
+    ) -> Result<UsageBillingProjection, AdminError> {
        let Ok(provider_kind) = ProviderKind::new(fact.provider_kind.clone()) else {
-            continue;
+            return Ok(UsageBillingProjection::default());
        };
        let input = ProviderBillingInput {
            upstream_model_id: fact.upstream_model_id.clone(),
            service_tier: fact.service_tier.clone(),
            input_tokens: fact.input_tokens,
            output_tokens: fact.output_tokens,
-            cached_tokens: fact.cached_tokens,
-            cache_write_tokens: fact.cache_write_tokens,
+            cached_input_tokens: fact.cached_input_tokens,
+            cache_write_input_tokens: fact.cache_write_input_tokens,
            total: fact.total.clone(),
        };
        let breakdown = match fact
            .breakdown
-            .take()
-            .filter(|b| b.total_amount == input.total)
+            .as_ref()
+            .filter(|breakdown| breakdown.total_amount == input.total)
+            .cloned()
            .map_or_else(
-                || providers.calculated_billing(&provider_kind, &input),
-                |b| Ok(Some(b)),
+                || self.providers.calculated_billing(&provider_kind, &input),
+                |breakdown| Ok(Some(breakdown)),
            ) {
            Ok(breakdown) => breakdown,
-            Err(error) if error.kind() == ProviderAdminErrorKind::Unsupported => continue,
+            Err(error) if error.kind() == ProviderAdminErrorKind::Unsupported => {
+                return Ok(UsageBillingProjection::default());
+            }
            Err(error) => return Err(map_provider_error(error, "usage billing")),
        };
        let Some(breakdown) = breakdown else {
-            continue;
+            return Ok(UsageBillingProjection::default());
        };
        if !breakdown
            .standard_amount
            .currency
            .eq_ignore_ascii_case("USD")
        {
-            continue;
-        }
-        scenarios
-            .standard
-            .add(fact.bucket_start, breakdown.standard_amount.amount.clone())?;
-        if let Some(no_cache_cost) = no_cache_cost(&fact, &breakdown) {
-            scenarios.no_cache.add(fact.bucket_start, no_cache_cost)?;
+            return Ok(UsageBillingProjection::default());
        }
+        Ok(UsageBillingProjection {
+            standard_amount: Some(breakdown.standard_amount.amount.clone()),
+            no_cache_amount: no_cache_cost(fact, &breakdown),
+        })
    }
-    Ok(scenarios)
 }

 fn no_cache_cost(
@@ -682,19 +649,21 @@ fn no_cache_cost(
    let input_tokens = fact
        .input_tokens?
        .checked_sub(image.map_or(0, |i| i.input_tokens))?;
-    let cached_tokens = fact
-        .cached_tokens
+    let cached_input_tokens = fact
+        .cached_input_tokens
        .unwrap_or_default()
-        .checked_sub(image.map_or(0, |i| i.cached_tokens))?
+        .checked_sub(image.map_or(0, |i| i.cached_input_tokens))?
        .min(input_tokens);
-    let cache_write_tokens = fact
-        .cache_write_tokens
+    let cache_write_input_tokens = fact
+        .cache_write_input_tokens
        .unwrap_or_default()
-        .min(input_tokens.saturating_sub(cached_tokens));
+        .min(input_tokens.saturating_sub(cached_input_tokens));
    let input_rate = decimal(&breakdown.input_price_per_million.amount)?;
    let replaced_input_amount = input_rate
        .scaled()
-        .checked_mul(u128::from(cached_tokens.saturating_add(cache_write_tokens)))?
+        .checked_mul(u128::from(
+            cached_input_tokens.saturating_add(cache_write_input_tokens),
+        ))?
        .checked_div(1_000_000)?;
    let mut total = decimal(&breakdown.total_amount.amount)?
        .scaled()
@@ -704,7 +673,7 @@ fn no_cache_cost(
    if let Some(image) = image {
        let image_no_cache = decimal(&image.input_price_per_million.amount)?
            .scaled()
-            .checked_mul(u128::from(image.cached_tokens))?
+            .checked_mul(u128::from(image.cached_input_tokens))?
            .checked_div(1_000_000)?;
        total = total
            .checked_sub(decimal(&image.cache_read_amount.amount)?.scaled())?
@@ -829,8 +798,8 @@ impl DefaultObservabilityService {
                service_tier: record.service_tier.clone(),
                input_tokens: record.input_tokens,
                output_tokens: record.output_tokens,
-                cached_tokens: record.cached_tokens,
-                cache_write_tokens: record.cache_write_tokens,
+                cached_input_tokens: record.cached_input_tokens,
+                cache_write_input_tokens: record.cache_write_input_tokens,
                total: total.clone(),
            };
            if let Ok(Some(breakdown)) = self.providers.calculated_billing(&provider_kind, &input) {
@@ -861,8 +830,8 @@ impl DefaultObservabilityService {
                service_tier: record.service_tier.clone(),
                input_tokens: record.input_tokens,
                output_tokens: record.output_tokens,
-                cached_tokens: record.cached_tokens,
-                cache_write_tokens: record.cache_write_tokens,
+                cached_input_tokens: record.cached_input_tokens,
+                cache_write_input_tokens: record.cache_write_input_tokens,
                total: total.clone(),
            };
            if let Ok(Some(breakdown)) = self.providers.calculated_billing(&provider_kind, &input) {
@@ -951,7 +920,11 @@ pub(super) fn health_timeline_at(
    })
 }

-fn trend(kind: TrendKind, points: Vec<RequestMetricPoint>) -> Result<Trend, AdminError> {
+fn trend(
+    kind: TrendKind,
+    points: Vec<RequestMetricPoint>,
+    analytics: crate::model::analytics::AnalyticsMetadata,
+) -> Result<Trend, AdminError> {
    let mut metrics = RequestMetrics::default();
    let mut coverage = CostCoverage::default();
    let mut costs = BTreeMap::<String, DecimalAmount>::new();
@@ -986,7 +959,7 @@ fn trend(kind: TrendKind, points: Vec<RequestMetricPoint>) -> Result<Trend, Admi
    let service_failure_count = service_failure_count(&metrics);
    let success_rate = ratio(
        metrics.success_count,
-        metrics.success_count.saturating_add(service_failure_count),
+        HealthWindow::from_metrics(&metrics).eligible_requests(),
    );
    let cache_hit_request_rate = ratio(
        metrics.cache_hit_request_count,
@@ -1007,13 +980,14 @@ fn trend(kind: TrendKind, points: Vec<RequestMetricPoint>) -> Result<Trend, Admi
        .filter_map(|point| point.metrics.output_throughput_p50)
        .min();
    Ok(Trend {
+        analytics,
        kind,
        points: points.into_iter().map(trend_point).collect(),
        summary: TrendSummary {
            request_count: metrics.request_count,
            input_tokens: metrics.input_tokens,
            output_tokens: metrics.output_tokens,
-            cached_tokens: metrics.cached_tokens,
+            cached_input_tokens: metrics.cached_input_tokens,
            total_tokens: metrics.total_tokens,
            service_failure_count,
            average_latency_ms,
@@ -1044,12 +1018,18 @@ fn trend_point(point: RequestMetricPoint) -> TrendPoint {
            point.metrics.first_token_latency_sum_ms,
            point.metrics.first_token_latency_count,
        ),
-        cached_token_rate: rate_or_zero(point.metrics.cached_tokens, point.metrics.input_tokens),
+        cached_token_rate: rate_or_zero(
+            point.metrics.cached_input_tokens,
+            point.metrics.input_tokens,
+        ),
        cache_hit_request_rate: ratio(
            point.metrics.cache_hit_request_count,
            point.metrics.cache_eligible_request_count,
        ),
-        success_rate: ratio(point.metrics.success_count, point.metrics.request_count),
+        success_rate: ratio(
+            point.metrics.success_count,
+            HealthWindow::from_metrics(&point.metrics).eligible_requests(),
+        ),
        metrics: point.metrics,
        cost_coverage: point.cost_coverage,
        costs: point.costs,
@@ -1070,11 +1050,13 @@ fn dashboard_period_metrics(
        result.request_count = result.request_count.saturating_add(metrics.request_count);
        result.input_tokens = result.input_tokens.saturating_add(metrics.input_tokens);
        result.output_tokens = result.output_tokens.saturating_add(metrics.output_tokens);
-        result.cached_tokens = result.cached_tokens.saturating_add(metrics.cached_tokens);
+        result.cached_input_tokens = result
+            .cached_input_tokens
+            .saturating_add(metrics.cached_input_tokens);
        result.total_tokens = result.total_tokens.saturating_add(metrics.total_tokens);
    }
-    result.cached_token_rate = rate_or_zero(result.cached_tokens, result.input_tokens);
-    result.observed_cached_token_rate = ratio(result.cached_tokens, result.input_tokens);
+    result.cached_token_rate = rate_or_zero(result.cached_input_tokens, result.input_tokens);
+    result.observed_cached_token_rate = ratio(result.cached_input_tokens, result.input_tokens);
    result
 }

@@ -1091,13 +1073,15 @@ fn add_request_metrics(total: &mut RequestMetrics, value: &RequestMetrics) {
        .saturating_add(value.caller_error_count);
    total.input_tokens = total.input_tokens.saturating_add(value.input_tokens);
    total.output_tokens = total.output_tokens.saturating_add(value.output_tokens);
-    total.cached_tokens = total.cached_tokens.saturating_add(value.cached_tokens);
-    total.cache_write_tokens = total
-        .cache_write_tokens
-        .saturating_add(value.cache_write_tokens);
-    total.reasoning_tokens = total
-        .reasoning_tokens
-        .saturating_add(value.reasoning_tokens);
+    total.cached_input_tokens = total
+        .cached_input_tokens
+        .saturating_add(value.cached_input_tokens);
+    total.cache_write_input_tokens = total
+        .cache_write_input_tokens
+        .saturating_add(value.cache_write_input_tokens);
+    total.reasoning_output_tokens = total
+        .reasoning_output_tokens
+        .saturating_add(value.reasoning_output_tokens);
    total.total_tokens = total.total_tokens.saturating_add(value.total_tokens);
    total.first_token_latency_sum_ms = total
        .first_token_latency_sum_ms
@@ -1145,20 +1129,29 @@ struct HealthWindow {
 }

 impl HealthWindow {
+    fn from_metrics(metrics: &RequestMetrics) -> Self {
+        Self {
+            success_requests: metrics.success_count,
+            failed_requests: service_failure_count(metrics),
+            cancelled_requests: metrics.cancelled_count,
+            incomplete_requests: metrics.incomplete_count,
+            caller_error_requests: metrics.caller_error_count,
+        }
+    }
+
+    // 未完成保留交付终态，但上游失败、超时和进程中断都不能视为服务成功
+    fn non_success_requests(self) -> u64 {
+        self.failed_requests
+            .saturating_add(self.incomplete_requests)
+    }
+
+    fn eligible_requests(self) -> u64 {
+        self.success_requests
+            .saturating_add(self.non_success_requests())
+    }
+
    fn add_metrics(&mut self, metrics: &RequestMetrics) {
-        self.success_requests = self.success_requests.saturating_add(metrics.success_count);
-        self.failed_requests = self
-            .failed_requests
-            .saturating_add(service_failure_count(metrics));
-        self.cancelled_requests = self
-            .cancelled_requests
-            .saturating_add(metrics.cancelled_count);
-        self.incomplete_requests = self
-            .incomplete_requests
-            .saturating_add(metrics.incomplete_count);
-        self.caller_error_requests = self
-            .caller_error_requests
-            .saturating_add(metrics.caller_error_count);
+        self.add_window(Self::from_metrics(metrics));
    }

    fn add_window(&mut self, other: Self) {
@@ -1177,15 +1170,13 @@ impl HealthWindow {
 }

 fn health_status(bucket: HealthWindow, is_future: bool) -> HealthStatus {
-    let eligible_requests = bucket
-        .success_requests
-        .saturating_add(bucket.failed_requests);
+    let eligible_requests = bucket.eligible_requests();
    if is_future {
        HealthStatus::Future
    } else if eligible_requests == 0 {
        HealthStatus::NoData
    } else if bucket.success_requests == 0
-        && bucket.failed_requests >= HEALTH_TIMELINE_UNAVAILABLE_FAILURE_THRESHOLD
+        && bucket.non_success_requests() >= HEALTH_TIMELINE_UNAVAILABLE_FAILURE_THRESHOLD
    {
        HealthStatus::Unavailable
    } else if eligible_requests < HEALTH_TIMELINE_MIN_SAMPLE_SIZE {
@@ -1200,9 +1191,7 @@ fn health_status(bucket: HealthWindow, is_future: bool) -> HealthStatus {
 }

 fn health_reliability(bucket: HealthWindow) -> Option<f64> {
-    let eligible_requests = bucket
-        .success_requests
-        .saturating_add(bucket.failed_requests);
+    let eligible_requests = bucket.eligible_requests();
    (eligible_requests > 0)
        .then(|| bucket.success_requests as f64 / eligible_requests as f64 * 100.0)
 }
@@ -0,0 +1,292 @@
+//! 有界统计缓存：身份和完整筛选参与键，删除版本阻止旧数据复活
+
+use crate::model::observability::*;
+use crate::ports::store::{
+    AdminStoreError, AdminStoreErrorKind, AdminStoreResult, ObservabilityStore,
+};
+use async_trait::async_trait;
+use chrono::{DateTime, Utc};
+use std::{collections::HashMap, future::Future, hash::Hash, sync::Arc, time::Duration};
+use tokio::{sync::Mutex, time::Instant};
+
+const CAPACITY: usize = 64;
+const TTL: Duration = Duration::from_secs(15);
+const MAX_STALE: Duration = Duration::from_secs(60);
+
+type Slot<T> = Arc<Mutex<Option<Cached<T>>>>;
+struct Cached<T> {
+    value: T,
+    created: Instant,
+}
+struct Entry<T> {
+    slot: Slot<T>,
+    touched: Instant,
+}
+struct Cache<K, T> {
+    entries: Mutex<HashMap<K, Entry<T>>>,
+}
+impl<K, T> Default for Cache<K, T> {
+    fn default() -> Self {
+        Self {
+            entries: Mutex::new(HashMap::new()),
+        }
+    }
+}
+
+trait AnalyticsValue: Clone {
+    fn metadata(&mut self) -> &mut AnalyticsMetadata;
+}
+impl AnalyticsValue for DashboardObservation {
+    fn metadata(&mut self) -> &mut AnalyticsMetadata {
+        &mut self.analytics
+    }
+}
+impl AnalyticsValue for UsageOverview {
+    fn metadata(&mut self) -> &mut AnalyticsMetadata {
+        &mut self.analytics
+    }
+}
+impl AnalyticsValue for UsageInsightsObservation {
+    fn metadata(&mut self) -> &mut AnalyticsMetadata {
+        &mut self.overview.analytics
+    }
+}
+impl AnalyticsValue for DiagnosticsObservation {
+    fn metadata(&mut self) -> &mut AnalyticsMetadata {
+        &mut self.analytics
+    }
+}
+
+impl<K: Eq + Hash, T: AnalyticsValue> Cache<K, T> {
+    async fn get<F, Fut>(
+        &self,
+        key: K,
+        store: &dyn ObservabilityStore,
+        ttl: Duration,
+        load: F,
+    ) -> AdminStoreResult<T>
+    where
+        F: FnOnce() -> Fut,
+        Fut: Future<Output = AdminStoreResult<T>>,
+    {
+        // 刷新失败后的同键等待也计入预算，避免串行重试把延迟放大为队列长度倍数
+        tokio::time::timeout(
+            store.query_timeout(),
+            self.get_within_budget(key, store, ttl, load),
+        )
+        .await
+        .map_err(|source| {
+            AdminStoreError::new(
+                AdminStoreErrorKind::Unavailable,
+                "observability cache",
+                "observability cache execution budget is exhausted",
+            )
+            .with_source(source)
+        })?
+    }
+
+    async fn get_within_budget<F, Fut>(
+        &self,
+        key: K,
+        store: &dyn ObservabilityStore,
+        ttl: Duration,
+        load: F,
+    ) -> AdminStoreResult<T>
+    where
+        F: FnOnce() -> Fut,
+        Fut: Future<Output = AdminStoreResult<T>>,
+    {
+        let slot = {
+            let mut entries = self.entries.lock().await;
+            if !entries.contains_key(&key) && entries.len() >= CAPACITY {
+                let oldest = entries
+                    .iter()
+                    .filter(|(_, entry)| Arc::strong_count(&entry.slot) == 1)
+                    .min_by_key(|(_, entry)| entry.touched)
+                    .map(|(_, entry)| entry.touched);
+                if let Some(oldest) = oldest {
+                    entries.retain(|_, entry| entry.touched != oldest);
+                }
+            }
+            if !entries.contains_key(&key) && entries.len() >= CAPACITY {
+                drop(entries);
+                return load().await;
+            }
+            let entry = entries.entry(key).or_insert_with(|| Entry {
+                slot: Arc::new(Mutex::new(None)),
+                touched: Instant::now(),
+            });
+            entry.touched = Instant::now();
+            entry.slot.clone()
+        };
+        // 同键刷新只执行一次；失败不会缓存成成功，也不延长旧结果寿命
+        let mut cached = slot.lock().await;
+        // 等锁期间代次可能推进；取得同键锁后再核对，失败时也不能回用已删除事实
+        let generation = store.analytics_cache_generation().await?;
+        if let Some(entry) = cached.as_mut()
+            && entry.value.metadata().generation == generation
+            && entry.created.elapsed() < ttl
+        {
+            return Ok(with_age(entry.value.clone(), false));
+        }
+        match load().await {
+            Ok(value) => {
+                *cached = Some(Cached {
+                    value: value.clone(),
+                    created: Instant::now(),
+                });
+                Ok(value)
+            }
+            Err(error) => {
+                if ttl == TTL
+                    && error.kind() == AdminStoreErrorKind::Unavailable
+                    && let Some(entry) = cached.as_mut()
+                    && entry.created.elapsed() <= MAX_STALE
+                    && Utc::now()
+                        .signed_duration_since(entry.value.metadata().generated_at)
+                        .to_std()
+                        .unwrap_or_default()
+                        <= MAX_STALE
+                    && entry.value.metadata().state != AnalyticsState::Building
+                    && entry.value.metadata().generation
+                        == store.analytics_cache_generation().await?
+                {
+                    return Ok(with_age(entry.value.clone(), true));
+                }
+                Err(error)
+            }
+        }
+    }
+}
+
+fn with_age<T: AnalyticsValue>(mut value: T, stale: bool) -> T {
+    let metadata = value.metadata();
+    metadata.lag_seconds = metadata.lag_seconds.saturating_add(
+        Utc::now()
+            .signed_duration_since(metadata.generated_at)
+            .num_seconds()
+            .max(0) as u64,
+    );
+    if stale {
+        metadata.state = AnalyticsState::Stale;
+    }
+    value
+}
+
+type UsageKey = (TimeRange, UsageFilter);
+pub(crate) struct CachedObservabilityStore {
+    inner: Arc<dyn ObservabilityStore>,
+    dashboard: Cache<DashboardQuery, DashboardObservation>,
+    summaries: Cache<UsageKey, UsageOverview>,
+    insights: Cache<(UsageKey, Granularity), UsageInsightsObservation>,
+    diagnostics: Cache<(UsageKey, DiagnosticDimension, u16), DiagnosticsObservation>,
+}
+impl CachedObservabilityStore {
+    pub(crate) fn new(inner: Arc<dyn ObservabilityStore>) -> Self {
+        Self {
+            inner,
+            dashboard: Cache::default(),
+            summaries: Cache::default(),
+            insights: Cache::default(),
+            diagnostics: Cache::default(),
+        }
+    }
+}
+
+#[async_trait]
+impl ObservabilityStore for CachedObservabilityStore {
+    fn query_timeout(&self) -> Duration {
+        self.inner.query_timeout()
+    }
+
+    async fn analytics_cache_generation(&self) -> AdminStoreResult<u64> {
+        self.inner.analytics_cache_generation().await
+    }
+    async fn dashboard_summary(
+        &self,
+        query: DashboardQuery,
+        observed_at: DateTime<Utc>,
+    ) -> AdminStoreResult<DashboardObservation> {
+        // 复合概览还包含账号容量和最近请求，保持原有两秒实时刷新上限
+        self.dashboard
+            .get(
+                query.clone(),
+                self.inner.as_ref(),
+                Duration::from_secs(2),
+                || self.inner.dashboard_summary(query, observed_at),
+            )
+            .await
+    }
+    async fn dashboard_trend(
+        &self,
+        range: TimeRange,
+        granularity: Granularity,
+    ) -> AdminStoreResult<Vec<RequestMetricPoint>> {
+        self.inner.dashboard_trend(range, granularity).await
+    }
+    async fn usage_trend(
+        &self,
+        range: TimeRange,
+        filter: UsageFilter,
+        granularity: Granularity,
+    ) -> AdminStoreResult<Vec<RequestMetricPoint>> {
+        self.inner.usage_trend(range, filter, granularity).await
+    }
+    async fn usage_insights_observation(
+        &self,
+        range: TimeRange,
+        filter: UsageFilter,
+        granularity: Granularity,
+    ) -> AdminStoreResult<UsageInsightsObservation> {
+        self.insights
+            .get(
+                ((range, filter.clone()), granularity),
+                self.inner.as_ref(),
+                TTL,
+                || {
+                    self.inner
+                        .usage_insights_observation(range, filter, granularity)
+                },
+            )
+            .await
+    }
+    async fn usage_summary(
+        &self,
+        range: TimeRange,
+        filter: UsageFilter,
+    ) -> AdminStoreResult<UsageOverview> {
+        self.summaries
+            .get((range, filter.clone()), self.inner.as_ref(), TTL, || {
+                self.inner.usage_summary(range, filter)
+            })
+            .await
+    }
+    async fn usage_diagnostics(
+        &self,
+        range: TimeRange,
+        filter: UsageFilter,
+        dimension: DiagnosticDimension,
+        limit: u16,
+    ) -> AdminStoreResult<DiagnosticsObservation> {
+        self.diagnostics
+            .get(
+                ((range, filter.clone()), dimension, limit),
+                self.inner.as_ref(),
+                TTL,
+                || {
+                    self.inner
+                        .usage_diagnostics(range, filter, dimension, limit)
+                },
+            )
+            .await
+    }
+    async fn list_usage_records(&self, query: UsageQuery) -> AdminStoreResult<UsagePage> {
+        self.inner.list_usage_records(query).await
+    }
+    async fn usage_record_detail(&self, request_id: &str) -> AdminStoreResult<UsageDetail> {
+        self.inner.usage_record_detail(request_id).await
+    }
+    async fn list_ops_errors(&self, query: OpsErrorQuery) -> AdminStoreResult<OpsErrorPage> {
+        self.inner.list_ops_errors(query).await
+    }
+}
@@ -2,7 +2,10 @@

 use std::collections::{BTreeMap, BTreeSet};

-use gateway_core::{policy::ClientApiKeyId, routing::AccountGroupId};
+use gateway_core::{
+    policy::ClientApiKeyId,
+    routing::{AccountGroupId, extensions::ExtensionSetReference},
+};
 use secrecy::ExposeSecret;

 use super::PluginsService;
@@ -41,14 +44,11 @@ impl PluginsService {
            .map_err(|error| map_store_error(error, "plugin"))?;
        let warning = match self
            .inspector
-            .inspect(artifact.archive.clone(), Some(digest.to_owned()))
+            .compatibility_warning(artifact.archive, digest.to_owned())
            .await
        {
-            Ok(_) => PackageStatus {
-                warning: self
-                    .inspector
-                    .compatibility_warning(artifact.archive, digest.to_owned())
-                    .await?,
+            Ok(warning) => PackageStatus {
+                warning,
                load_error: None,
            },
            Err(error) if error.kind() == AdminErrorKind::Invalid => PackageStatus {
@@ -368,25 +368,8 @@ impl PluginsService {
            )
            .await
            .map_err(|e| map_store_error(e, "plugin"))?;
-        let prepared = if result.config_revision == candidate_revision
-            && result.instance.revision == candidate_revision
-        {
-            prepared
-        } else {
-            snapshot.config_revision = result.config_revision;
-            snapshot
-                .instances
-                .retain(|item| item.id != result.instance.id);
-            snapshot.instances.push(result.instance.clone());
-            apply_replacements(&mut snapshot, &replacements);
-            self.preparation.prepare(snapshot).await?
-        };
-        self.preparation
-            .activate_state(&prepared, &result.instance)
+        self.publish_instance(snapshot, prepared, &result, &replacements)
            .await?;
-        // prepared 的强引用跨过提交与唯一发布入口，防止候选在被读取之前回收
-        publish_committed(self.snapshots.as_ref(), result.config_revision).await?;
-        drop(prepared);
        Ok(result)
    }

@@ -463,48 +446,45 @@ impl PluginsService {
                    .await);
            }
        };
-        if let Err(error) = self
-            .preparation
-            .migrate_state(&migration_prepared, transition.clone())
-            .await
-        {
-            return Err(self
-                .recover_failed_state_transition(
-                    Some(&transition.id),
-                    &previous,
-                    &previous_state,
-                    disabled_revision,
+        // 迁移开始后的所有提交前失败都走同一恢复出口；提交成功后不再回滚旧配置
+        let committed = async {
+            self.preparation
+                .migrate_state(&migration_prepared, transition.clone())
+                .await?;
+            let mut current = self
+                .store
+                .load_instances()
+                .await
+                .map_err(|error| map_store_error(error, "plugin"))?;
+            if current.config_revision != expected_revision {
+                return Err(AdminError::conflict("迁移期间插件配置已发生变化"));
+            }
+            let candidate_revision = next_revision(expected_revision)?;
+            target.revision = candidate_revision;
+            current.instances.retain(|item| item.id != target.id);
+            current.instances.push(target.clone());
+            current.config_revision = candidate_revision;
+            apply_replacements(&mut current, replacements);
+            let prepared = self.preparation.prepare(current.clone()).await?;
+            let result = self
+                .store
+                .save_instance_replacing(
+                    target,
+                    expected_revision,
+                    PluginStateCommit {
+                        configuration: target_state,
+                        transition_id: Some(transition.id.clone()),
+                    },
+                    replacements,
                    context,
-                    error,
                )
-                .await);
+                .await
+                .map_err(|error| map_store_error(error, "plugin"))?;
+            Ok((current, prepared, result))
        }
-
-        let mut current = self
-            .store
-            .load_instances()
-            .await
-            .map_err(|error| map_store_error(error, "plugin"))?;
-        if current.config_revision != expected_revision {
-            return Err(self
-                .recover_failed_state_transition(
-                    Some(&transition.id),
-                    &previous,
-                    &previous_state,
-                    disabled_revision,
-                    context,
-                    AdminError::conflict("迁移期间插件配置已发生变化"),
-                )
-                .await);
-        }
-        let candidate_revision = next_revision(expected_revision)?;
-        target.revision = candidate_revision;
-        current.instances.retain(|item| item.id != target.id);
-        current.instances.push(target.clone());
-        current.config_revision = candidate_revision;
-        apply_replacements(&mut current, replacements);
-        let prepared = match self.preparation.prepare(current.clone()).await {
-            Ok(prepared) => prepared,
+        .await;
+        let (current, prepared, result) = match committed {
+            Ok(committed) => committed,
            Err(error) => {
                return Err(self
                    .recover_failed_state_transition(
@@ -518,53 +498,9 @@ impl PluginsService {
                    .await);
            }
        };
-        let result = match self
-            .store
-            .save_instance_replacing(
-                target,
-                expected_revision,
-                PluginStateCommit {
-                    configuration: target_state,
-                    transition_id: Some(transition.id.clone()),
-                },
-                replacements,
-                context,
-            )
-            .await
-        {
-            Ok(result) => result,
-            Err(error) => {
-                return Err(self
-                    .recover_failed_state_transition(
-                        Some(&transition.id),
-                        &previous,
-                        &previous_state,
-                        disabled_revision,
-                        context,
-                        map_store_error(error, "plugin"),
-                    )
-                    .await);
-            }
-        };
-        let prepared = if result.config_revision == candidate_revision
-            && result.instance.revision == candidate_revision
-        {
-            prepared
-        } else {
-            current.config_revision = result.config_revision;
-            current
-                .instances
-                .retain(|item| item.id != result.instance.id);
-            current.instances.push(result.instance.clone());
-            apply_replacements(&mut current, replacements);
-            self.preparation.prepare(current).await?
-        };
-        self.preparation
-            .activate_state(&prepared, &result.instance)
+        self.publish_instance(current, prepared, &result, replacements)
            .await?;
-        publish_committed(self.snapshots.as_ref(), result.config_revision).await?;
        drop(migration_prepared);
-        drop(prepared);
        Ok(result)
    }

@@ -615,22 +551,8 @@ impl PluginsService {
                )
                .await
                .map_err(|error| map_store_error(error, "plugin"))?;
-            let prepared = if mutation.config_revision == candidate_revision
-                && mutation.instance.revision == candidate_revision
-            {
-                prepared
-            } else {
-                snapshot.config_revision = mutation.config_revision;
-                snapshot
-                    .instances
-                    .retain(|item| item.id != mutation.instance.id);
-                snapshot.instances.push(mutation.instance.clone());
-                self.preparation.prepare(snapshot).await?
-            };
-            self.preparation
-                .activate_state(&prepared, &mutation.instance)
+            self.publish_instance(snapshot, prepared, &mutation, &[])
                .await?;
-            publish_committed(self.snapshots.as_ref(), mutation.config_revision).await?;
            Ok::<(), AdminError>(())
        }
        .await;
@@ -646,6 +568,35 @@ impl PluginsService {
        }
    }

+    /// 以事务返回的版本激活并发布，候选强引用必须覆盖整个提交后阶段
+    async fn publish_instance(
+        &self,
+        mut snapshot: PluginInstanceSnapshot,
+        prepared: ExtensionSetReference,
+        mutation: &PluginInstanceMutation,
+        replacements: &[PluginInstanceReplacement],
+    ) -> Result<(), AdminError> {
+        let prepared = if mutation.config_revision == snapshot.config_revision
+            && mutation.instance.revision == snapshot.config_revision
+        {
+            prepared
+        } else {
+            snapshot.config_revision = mutation.config_revision;
+            snapshot
+                .instances
+                .retain(|item| item.id != mutation.instance.id);
+            snapshot.instances.push(mutation.instance.clone());
+            apply_replacements(&mut snapshot, replacements);
+            self.preparation.prepare(snapshot).await?
+        };
+        self.preparation
+            .activate_state(&prepared, &mutation.instance)
+            .await?;
+        publish_committed(self.snapshots.as_ref(), mutation.config_revision).await?;
+        drop(prepared);
+        Ok(())
+    }
+
    pub async fn delete_instance(
        &self,
        id: &str,
@@ -22,6 +22,13 @@ use super::{map_store_error, publish_committed};
 /// API 消费的 Runtime settings 管理服务
 #[async_trait]
 pub trait SettingsService: Send + Sync {
+    async fn preview_privacy_policy(
+        &self,
+        _request: gateway_core::settings::privacy::PrivacyPreviewRequest,
+    ) -> Result<gateway_core::settings::privacy::PrivacyPreviewResult, AdminError> {
+        Err(AdminError::invalid("隐私预览不可用"))
+    }
+
    async fn preview_pricing_sync(
        &self,
    ) -> Result<crate::model::pricing::PricingSyncPreview, AdminError>;
@@ -117,6 +124,21 @@ fn validate_settings(command: &ReplaceRuntimeSettings) -> Result<(), AdminError>

 #[async_trait]
 impl SettingsService for DefaultSettingsService {
+    async fn preview_privacy_policy(
+        &self,
+        request: gateway_core::settings::privacy::PrivacyPreviewRequest,
+    ) -> Result<gateway_core::settings::privacy::PrivacyPreviewResult, AdminError> {
+        self.profile_provider("openai")?
+            .preview_privacy_policy(request)
+            .map_err(|error| {
+                AdminError::invalid(format!(
+                    "第 {} 条规则：{}",
+                    error.rule_index + 1,
+                    error.reason
+                ))
+            })
+    }
+
    async fn preview_pricing_sync(
        &self,
    ) -> Result<crate::model::pricing::PricingSyncPreview, AdminError> {
@@ -238,10 +260,12 @@ impl SettingsService for DefaultSettingsService {
            PricingChange::Replace(pricing) => {
                pricing.validate().map_err(AdminError::invalid)?;
                if command.provider == "xai"
-                    && pricing
-                        .bands
-                        .keys()
-                        .any(|band| matches!(band.as_str(), "image" | "flex" | "long_flex"))
+                    && pricing.bands.keys().any(|band| {
+                        matches!(
+                            band.as_str(),
+                            "image" | "flex" | "long_flex" | "ultrafast" | "long_ultrafast"
+                        )
+                    })
                {
                    return Err(AdminError::invalid("xAI 不支持此价格档位"));
                }
@@ -342,6 +366,17 @@ impl SettingsService for DefaultSettingsService {
        mut command: ReplaceRuntimeSettings,
    ) -> Result<RuntimeSettings, AdminError> {
        validate_settings(&command)?;
+        if command.values.codex_privacy_policy != Default::default() {
+            self.profile_provider("openai")?
+                .compile_privacy_policy(&command.values.codex_privacy_policy)
+                .map_err(|error| {
+                    AdminError::invalid(format!(
+                        "第 {} 条规则：{}",
+                        error.rule_index + 1,
+                        error.reason
+                    ))
+                })?;
+        }
        if command
            .request_profile_updates
            .values()
@@ -536,6 +536,9 @@ impl DatabaseDumpPort for FakeDumpPort {
 pub(crate) struct FakeObjectStore {
    pub(crate) objects: Mutex<std::collections::HashMap<String, Vec<u8>>>,
    upload_error: Option<BackupError>,
+    head_error: Option<BackupError>,
+    delete_error: Option<BackupError>,
+    connection_error: Option<BackupError>,
 }

 impl FakeObjectStore {
@@ -543,6 +546,9 @@ impl FakeObjectStore {
        Self {
            objects: Mutex::new(std::collections::HashMap::new()),
            upload_error: None,
+            head_error: None,
+            delete_error: None,
+            connection_error: None,
        }
    }

@@ -552,6 +558,21 @@ impl FakeObjectStore {
        self
    }

+    pub(crate) fn fail_head(mut self, code: &'static str) -> Self {
+        self.head_error = Some(BackupError::new(code, "HEAD failed".into()));
+        self
+    }
+
+    pub(crate) fn fail_delete(mut self, code: &'static str) -> Self {
+        self.delete_error = Some(BackupError::new(code, "DELETE failed".into()));
+        self
+    }
+
+    pub(crate) fn fail_connection(mut self, code: &'static str) -> Self {
+        self.connection_error = Some(BackupError::new(code, "DELETE failed".into()));
+        self
+    }
+
    pub(crate) fn object(&self, key: &str) -> Option<Vec<u8>> {
        self.objects.lock().expect("objects").get(key).cloned()
    }
@@ -563,6 +584,14 @@ impl BackupObjectStorePort for FakeObjectStore {
        &self,
        _config: &BackupStorageConfig,
    ) -> Result<ConnectionTestResult, gateway_admin::model::backup::BackupError> {
+        if let Some(error) = &self.connection_error {
+            return Ok(ConnectionTestResult {
+                ok: false,
+                stage: "deleteObject",
+                code: Some(error.code()),
+                message: error.message().into(),
+            });
+        }
        Ok(ConnectionTestResult {
            ok: true,
            stage: "deleteObject",
@@ -597,6 +626,9 @@ impl BackupObjectStorePort for FakeObjectStore {
        _config: &BackupStorageConfig,
        object_key: &str,
    ) -> Result<Option<BackupObjectMetadata>, gateway_admin::model::backup::BackupError> {
+        if let Some(error) = &self.head_error {
+            return Err(error.clone());
+        }
        let Some(content) = self.object(object_key) else {
            return Ok(None);
        };
@@ -613,6 +645,9 @@ impl BackupObjectStorePort for FakeObjectStore {
        _config: &BackupStorageConfig,
        object_key: &str,
    ) -> Result<(), gateway_admin::model::backup::BackupError> {
+        if let Some(error) = &self.delete_error {
+            return Err(error.clone());
+        }
        self.objects.lock().expect("objects").remove(object_key);
        Ok(())
    }
@@ -690,11 +725,11 @@ impl AuthStore for FakeAuthStore {
    ) -> AdminStoreResult<()> {
        Ok(())
    }
-    async fn renew_session(
+    async fn compare_exchange_session(
        &self,
        _: &str,
        _: &gateway_admin::model::auth::AuthSession,
-        _: chrono::DateTime<chrono::Utc>,
+        _: Option<&gateway_admin::model::auth::AuthSession>,
    ) -> AdminStoreResult<Option<gateway_admin::model::auth::AuthSession>> {
        Ok(None)
    }
@@ -324,3 +324,58 @@ async fn completed_recovery_removes_staging_for_dumping_and_uploading_tasks() {
        );
    }
 }
+
+#[tokio::test]
+async fn manual_backup_preserves_primary_and_final_delete_failures() {
+    for (upload_fails, expiring) in [(false, false), (true, false), (false, true)] {
+        let repository = Arc::new(FakeBackupRepository::new(configured_settings()));
+        let dump = Arc::new(FakeDumpPort::new());
+        let store = FakeObjectStore::new().fail_delete(code::S3_PERMISSION_DENIED);
+        let store = Arc::new(if upload_fails {
+            store.fail_upload(code::S3_UPLOAD_FAILED, "上传失败")
+        } else {
+            store.fail_head(code::REMOTE_VERIFICATION_FAILED)
+        });
+        let seed = BackupRecordSeed {
+            id: backup_id("cleanup-failure"),
+            trigger_kind: BackupTriggerKind::Manual,
+            scheduled_at: None,
+            object_key: "codex/cleanup-failure.dump".into(),
+            expires_at: expiring.then(|| Utc::now() + Duration::hours(1)),
+        };
+        repository.insert_backup_record(seed.clone()).await.unwrap();
+        let task = BackupTask::new(repository.clone(), dump.clone(), store.clone());
+        task.run_cycle(&CancellationToken::new()).await.unwrap();
+        let records = repository.all_records();
+        let record = &records[0];
+        assert_eq!(record.status, BackupStatus::Failed);
+        assert_eq!(
+            record.error_code.as_deref(),
+            Some(if upload_fails {
+                code::S3_UPLOAD_FAILED
+            } else {
+                code::REMOTE_VERIFICATION_FAILED
+            })
+        );
+        let message = record.error_message.as_deref().unwrap();
+        assert!(message.contains(if upload_fails {
+            "上传失败"
+        } else {
+            "HEAD failed"
+        }));
+        assert!(message.contains("DeleteObject"));
+        assert!(message.contains(code::S3_PERMISSION_DENIED));
+        assert!(message.contains(if expiring {
+            "等待备份到期清理"
+        } else {
+            "未安排自动重试"
+        }));
+        assert_eq!(store.object(&seed.object_key).is_some(), !upload_fails);
+        assert!(dump.inspect_staging(&seed.id).await.unwrap().is_none());
+        task.run_cycle(&CancellationToken::new()).await.unwrap();
+        assert_eq!(
+            repository.all_records()[0].error_message,
+            record.error_message
+        );
+    }
+}
@@ -170,9 +170,9 @@ fn usage_window_should_not_use_daily_rolling_usage_for_weekly_statistics() {
        success_count: 5,
        input_tokens: Some(100),
        output_tokens: Some(20),
-        cached_tokens: Some(80),
-        cache_write_tokens: Some(0),
-        reasoning_tokens: Some(0),
+        cached_input_tokens: Some(80),
+        cache_write_input_tokens: Some(0),
+        reasoning_output_tokens: Some(0),
        image_input_tokens: Some(0),
        image_output_tokens: Some(0),
        image_request_count: 0,
@@ -115,9 +115,9 @@ fn usage_window(key: &str, group: &str, seconds: u64) -> ProviderQuotaWindow {
            success_count: 0,
            input_tokens: None,
            output_tokens: None,
-            cached_tokens: None,
-            cache_write_tokens: None,
-            reasoning_tokens: None,
+            cached_input_tokens: None,
+            cache_write_input_tokens: None,
+            reasoning_output_tokens: None,
            image_input_tokens: None,
            image_output_tokens: None,
            image_request_count: 0,
@@ -32,9 +32,9 @@ fn window(key: &str, days: u64) -> ProviderQuotaWindow {
            success_count: 10,
            input_tokens: Some(900),
            output_tokens: Some(100),
-            cached_tokens: Some(800),
-            cache_write_tokens: None,
-            reasoning_tokens: None,
+            cached_input_tokens: Some(800),
+            cache_write_input_tokens: None,
+            reasoning_output_tokens: None,
            image_input_tokens: None,
            image_output_tokens: None,
            image_request_count: 0,
@@ -84,7 +84,7 @@ fn samples(quota: &ProviderQuota) -> Vec<QuotaForecastSample> {
                tokens: usage.total_tokens.unwrap_or(0),
                input_tokens: usage.input_tokens.unwrap_or(0),
                output_tokens: usage.output_tokens.unwrap_or(0),
-                cached_tokens: usage.cached_tokens.unwrap_or(0),
+                cached_input_tokens: usage.cached_input_tokens.unwrap_or(0),
                missing_token_count: u64::from(usage.total_tokens.is_none()),
                known_cost_count: if usd.is_some() {
                    usage.cost_coverage.known_count()
@@ -73,14 +73,14 @@ fn snapshot_at_a_block_boundary_keeps_only_three_recent_blocks() {
 }

 #[test]
-fn large_percentage_reversal_restarts_sampling_without_crossing_old_consumption() {
+fn large_percentage_reversal_restarts_only_sampling_without_crossing_old_consumption() {
    let sample = select(
        vec![point(1, 40.0, 100), point(2, 50.0, 200), point(3, 1.0, 210)],
        point(4, 8.0, 280),
    );
    assert_eq!(sample.baseline_percent, 1.0);
    assert_eq!(sample.usage.tokens, 70);
-    assert_eq!(sample.cycle_usage.tokens, 70);
+    assert_eq!(sample.cycle_usage.tokens, 280);
    assert_eq!(sample.sampled_percent, 7.0);
    assert!(!sample.discontinuous);
    let waiting = select(
@@ -90,6 +90,30 @@ fn large_percentage_reversal_restarts_sampling_without_crossing_old_consumption(
    assert!(waiting.discontinuous);
 }

+#[test]
+fn same_window_reversal_preserves_all_recorded_cycle_usage() {
+    let current = point(3, 35.0, 140);
+    let recorded = current.usage.clone();
+    let sample = select(vec![point(1, 32.0, 100), point(2, 30.0, 120)], current);
+    assert_eq!(sample.cycle_usage, recorded);
+    assert_eq!(sample.usage.tokens, 20);
+    assert!((sample.usage.usd - 0.02).abs() < 1e-10);
+    assert!(!sample.discontinuous);
+}
+
+#[test]
+fn small_reversals_after_full_usage_preserve_cycle_totals_and_cumulative_forecasts() {
+    let current = point(3, 99.5, 10_020);
+    let recorded = current.usage.clone();
+    let sample = select(
+        vec![point(1, 100.0, 10_000), point(2, 99.0, 10_010)],
+        current,
+    );
+    assert_eq!(sample.cycle_usage, recorded);
+    assert_eq!(sample.method, QuotaForecastMethod::Cumulative);
+    assert!(!sample.discontinuous);
+}
+
 #[test]
 fn one_point_reversal_is_skipped_without_counting_an_extra_block() {
    let sample = select(
@@ -128,17 +152,41 @@ fn counter_regressions_fail_closed_and_future_points_are_not_used() {
 }

 #[test]
-fn exhausted_history_is_retained_to_detect_a_reset_with_an_unchanged_deadline() {
+fn same_window_recovery_restarts_sampling_but_preserves_recorded_cycle_usage() {
    let sample = select(
        vec![point(1, 100.0, 10_000), point(2, 0.0, 10_000)],
        point(3, 10.0, 10_100),
    );
-    assert_eq!(sample.cycle_usage.tokens, 100);
+    assert_eq!(sample.cycle_usage.tokens, 10_100);
+    assert!((sample.cycle_usage.usd - 10.1).abs() < 1e-10);
    assert_eq!(sample.usage.tokens, 100);
    assert_eq!(sample.sampled_percent, 10.0);
    assert!(!sample.discontinuous);
 }

+#[test]
+fn a_single_non_exhausted_observation_does_not_restart_cycle_usage() {
+    let sample = select(vec![point(1, 100.0, 10_000)], point(2, 0.0, 10_000));
+    assert_eq!(sample.cycle_usage.tokens, 10_000);
+    assert!(sample.discontinuous);
+}
+
+#[test]
+fn repeated_same_window_recoveries_preserve_recorded_cycle_usage() {
+    let sample = select(
+        vec![
+            point(1, 100.0, 10_000),
+            point(2, 0.0, 10_000),
+            point(3, 100.0, 10_100),
+            point(4, 0.0, 10_100),
+        ],
+        point(5, 10.0, 10_200),
+    );
+    assert_eq!(sample.cycle_usage.tokens, 10_200);
+    assert_eq!(sample.usage.tokens, 100);
+    assert!(!sample.discontinuous);
+}
+
 #[test]
 fn changed_window_restarts_cycle_totals_at_first_matching_observation() {
    let sample = select_forecast_sample(
@@ -10,12 +10,13 @@ use async_trait::async_trait;
 use chrono::{DateTime, Duration, Utc};
 use gateway_admin::{
    model::{
-        MutationContext, PageSize, Revision,
+        AdminErrorKind, MutationContext, PageSize, Revision,
        account_groups::{
            AccountGroupAccountSummary, AccountGroupCapacity, AccountGroupColor,
-            AccountGroupListQuery, AccountGroupMemberFact, AccountGroupMutation, AccountGroupPage,
-            AccountGroupRecord, AccountGroupUsage, DeleteAccountGroup, NewAccountGroup,
-            SetAccountGroupEnabled, UpdateAccountGroup,
+            AccountGroupListQuery, AccountGroupMemberFact, AccountGroupMutation,
+            AccountGroupOptionsPage, AccountGroupPage, AccountGroupRecord, AccountGroupRef,
+            AccountGroupUsage, DeleteAccountGroup, NewAccountGroup, SetAccountGroupEnabled,
+            UpdateAccountGroup,
        },
        accounts::AccountRuntimeSnapshot,
        observability::DecimalAmount,
@@ -90,6 +91,62 @@ async fn group_query_service_enriches_only_current_page_members_with_runtime_fac
    );
 }

+#[tokio::test]
+async fn group_options_query_should_skip_member_and_runtime_enrichment() {
+    let groups = Arc::new(FakeGroupStore::default());
+    let runtime = Arc::new(FakeRuntimeStore::default());
+    let service = AdminHarness::new()
+        .account_groups(groups.clone())
+        .account_runtime(runtime.clone())
+        .build()
+        .await;
+
+    let page = service
+        .account_groups()
+        .list_options(AccountGroupListQuery {
+            page: 1,
+            page_size: PageSize::new(20).expect("page size"),
+            search: None,
+            enabled: None,
+        })
+        .await
+        .expect("list account group options");
+
+    assert_eq!(page.items[0].id.as_str(), GROUP_ID);
+    assert!(
+        groups
+            .requested_groups
+            .lock()
+            .expect("requested groups")
+            .is_empty()
+    );
+    assert!(
+        runtime
+            .requested_accounts
+            .lock()
+            .expect("requested accounts")
+            .is_empty()
+    );
+}
+
+#[tokio::test]
+async fn group_options_query_should_preserve_store_failures() {
+    let service = AdminHarness::new().build().await;
+
+    let error = service
+        .account_groups()
+        .list_options(AccountGroupListQuery {
+            page: 1,
+            page_size: PageSize::new(20).expect("page size"),
+            search: None,
+            enabled: None,
+        })
+        .await
+        .expect_err("unavailable options store must fail");
+
+    assert_eq!(error.kind(), AdminErrorKind::Unavailable);
+}
+
 #[derive(Default)]
 struct FakeGroupStore {
    requested_groups: Mutex<Vec<String>>,
@@ -144,6 +201,24 @@ impl AccountGroupStore for FakeGroupStore {
        })
    }

+    async fn list_account_group_options(
+        &self,
+        query: AccountGroupListQuery,
+    ) -> AdminStoreResult<AccountGroupOptionsPage> {
+        Ok(AccountGroupOptionsPage {
+            config_revision: Revision::new(1).expect("revision"),
+            items: vec![AccountGroupRef {
+                id: group_id(),
+                name: "Primary".to_owned(),
+                color: AccountGroupColor::parse("#2563EBFF").expect("color"),
+                enabled: true,
+            }],
+            total: 1,
+            page: query.page,
+            page_size: query.page_size.get(),
+        })
+    }
+
    async fn load_account_group_members(
        &self,
        group_ids: &[AccountGroupId],
@@ -300,7 +375,7 @@ fn unused() -> AdminStoreError {

 #[tokio::test]
 async fn invalid_group_fields_are_rejected_before_store_mutations() {
-    use gateway_admin::model::{AdminErrorKind, MutationActor, account_groups::CreateAccountGroup};
+    use gateway_admin::model::{MutationActor, account_groups::CreateAccountGroup};
    let service = AdminHarness::new()
        .account_groups(Arc::new(FakeGroupStore::default()))
        .build()
@@ -1115,12 +1115,12 @@ impl SettingsStore for StaticSettingsStore {
            rotation_strategy: RotationStrategy::Smart,
            updated_at: Utc::now(),
            values: gateway_admin::model::settings::RuntimeSettingsValues {
+                codex_privacy_policy: Default::default(),
                request_location_enabled: false,
                request_location: Default::default(),
                refresh_margin_seconds: 300,
                refresh_concurrency: 2,
                max_concurrent_per_account: 1,
-                request_interval_ms: 0,
                max_waiting_per_key: 0,
                max_waiting_per_account: 0,
                concurrency_wait_timeout_seconds: 30,
@@ -2398,6 +2398,93 @@ async fn quota_forecast_only_queries_the_two_selected_source_windows() {
    );
 }

+#[tokio::test]
+async fn quota_forecast_same_window_reversal_keeps_recorded_usage_in_the_report() {
+    use gateway_admin::model::quota_forecast_sampling::QuotaForecastHistoryPoint;
+
+    for (percents, tokens, expected_tokens, expected_usd) in [
+        ([32.0, 30.0, 35.0], [100, 120, 140], 400, 0.4),
+        (
+            [100.0, 99.0, 99.5],
+            [10_000, 10_010, 10_020],
+            10_070,
+            10.02 / 0.995,
+        ),
+    ] {
+        let now = Utc::now();
+        let observed = now - TimeDelta::minutes(1);
+        let reset = now + TimeDelta::days(1);
+        let provider = FakeProviderAdmin::new("openai", events());
+        provider.set_quota(ProviderQuota {
+            plan_type: Some("pro".to_owned()),
+            observed_at: Some(observed),
+            windows: vec![ProviderQuotaWindow {
+                key: "week".to_owned(),
+                group: "shortTerm".to_owned(),
+                label: "周额度".to_owned(),
+                limit_id: None,
+                limit_name: None,
+                role: None,
+                local_usage_attribution: QuotaLocalUsageAttribution::AccountWide,
+                window_seconds: Some(604_800),
+                used_percent: Some(percents[2]),
+                reset_at: Some(reset),
+                limit_reached: false,
+                local_usage: None,
+                provider_data: None,
+            }],
+            ..empty_quota()
+        });
+        let mut account = account_record("openai");
+        account.created_at = now - TimeDelta::days(7);
+        let store = FakeAccountStore::with_account(account, events());
+        let usage = |requests, tokens| QuotaForecastUsage {
+            request_count: requests,
+            tokens,
+            input_tokens: tokens,
+            known_cost_count: requests,
+            usd: tokens as f64 / 1_000.0,
+            ..Default::default()
+        };
+        *store.quota_forecast_history.lock().unwrap() = QuotaForecastHistory {
+            points: [(3, percents[0], tokens[0]), (2, percents[1], tokens[1])]
+                .into_iter()
+                .enumerate()
+                .map(
+                    |(index, (minutes, percent, tokens))| QuotaForecastHistoryPoint {
+                        started_at: now - TimeDelta::minutes(5),
+                        completed_at: now - TimeDelta::minutes(minutes),
+                        usage: usage(index as u64 + 1, tokens),
+                        provider_observation: ProviderDocument::new(OpaqueProviderData::new(
+                            serde_json::json!({
+                                "percent": percent, "reset": reset.to_rfc3339(), "plan": "pro",
+                            })
+                            .as_object()
+                            .unwrap()
+                            .clone(),
+                        )),
+                    },
+                )
+                .collect(),
+            usage: usage(3, tokens[2]),
+            pending_request_count: 0,
+        };
+        let services = accounts_service(provider, store).await;
+        let result = services
+            .accounts()
+            .quota_forecast(&ProviderAccountId::new("acct_test").unwrap())
+            .await
+            .unwrap();
+        let forecast = &result.forecasts[0];
+        let source = forecast.source.as_ref().unwrap();
+        assert_eq!(source.tokens, Some(tokens[2]));
+        assert!((source.usd.unwrap() - tokens[2] as f64 / 1_000.0).abs() < 1e-10);
+        assert_eq!(forecast.estimated_tokens, Some(expected_tokens));
+        assert!((forecast.estimated_usd.unwrap() - expected_usd).abs() < 1e-10);
+        assert!(forecast.unavailable_reason.is_none());
+    }
+}
+
 #[tokio::test]
 async fn quota_forecast_mid_cycle_sampling_accepts_small_reset_jitter_but_not_a_changed_bucket() {
    use gateway_admin::model::quota_forecast_sampling::QuotaForecastHistoryPoint;
@@ -3031,9 +3118,9 @@ fn quota_local_usage(account_id: &str, total_tokens: u64) -> AccountUsage {
        success_count: 1,
        input_tokens: Some(total_tokens),
        output_tokens: Some(0),
-        cached_tokens: Some(0),
-        cache_write_tokens: Some(0),
-        reasoning_tokens: Some(0),
+        cached_input_tokens: Some(0),
+        cache_write_input_tokens: Some(0),
+        reasoning_output_tokens: Some(0),
        image_input_tokens: Some(0),
        image_output_tokens: Some(0),
        image_request_count: 0,
@@ -1,4 +1,4 @@
-//! 验证管理员认证、密码变更、会话绑定与限流行为
+//! 验证管理员认证、密码变更与限流，提供会话轮换的内存存储辅助

 use std::{collections::BTreeMap, sync::Mutex};

@@ -69,6 +69,7 @@ async fn password_change_obeys_rate_limit_and_rejects_unbound_legacy_sessions()
                admin_user_id: "admin".into(),
                credential_fingerprint: String::new(),
            },
+            renewal: None,
            absolute_expires_at: None,
            expires_at: Utc::now() + TimeDelta::hours(1),
        },
@@ -138,19 +139,24 @@ impl AuthStore for MemoryAuthStore {
        Ok(())
    }

-    async fn renew_session(
+    async fn compare_exchange_session(
        &self,
        session_id: &str,
        expected: &AuthSession,
-        expires_at: chrono::DateTime<chrono::Utc>,
+        replacement: Option<&AuthSession>,
    ) -> AdminStoreResult<Option<AuthSession>> {
        let mut sessions = self.sessions.lock().unwrap();
        if let Some(session) = sessions.get_mut(session_id) {
-            if session.expires_at <= chrono::Utc::now() {
+            if session.retained_until() <= chrono::Utc::now() {
                return Ok(None);
            }
            if session == expected {
-                session.expires_at = expires_at;
+                if let Some(replacement) = replacement {
+                    *session = replacement.clone();
+                } else {
+                    sessions.remove(session_id);
+                    return Ok(None);
+                }
            }
            return Ok(Some(session.clone()));
        }
@@ -190,8 +196,13 @@ impl AuthStore for MemoryAuthStore {
 #[tokio::test]
 async fn successful_login_should_create_expiring_session_and_audit() {
    let store = std::sync::Arc::new(MemoryAuthStore::default());
-    let services = super::AdminHarness::new().auth(store.clone()).build().await;
+    let services = super::AdminHarness::new()
+        .session_ttl_minutes(7 * 24 * 60)
+        .auth(store.clone())
+        .build()
+        .await;

+    let before = Utc::now();
    let result = services
        .auth()
        .login(
@@ -205,6 +216,17 @@ async fn successful_login_should_create_expiring_session_and_audit() {
        .await
        .expect("login");

+    let after = Utc::now();
+    for (expiry, ttl) in [
+        (result.session.expires_at, TimeDelta::hours(24)),
+        (result.session.retained_until(), TimeDelta::days(7)),
+        (
+            result.session.absolute_expires_at.unwrap(),
+            TimeDelta::days(30),
+        ),
+    ] {
+        assert!((before + ttl..=after + ttl).contains(&expiry));
+    }
    assert!(
        services
            .auth()
@@ -293,6 +315,7 @@ async fn expired_sessions_are_rejected_and_store_outages_are_not_treated_as_logo
                credential_fingerprint: String::new(),
                admin_user_id: "admin".to_owned(),
            },
+            renewal: None,
            absolute_expires_at: None,
            expires_at: Utc::now() - TimeDelta::seconds(1),
        },
@@ -362,7 +385,7 @@ async fn failed_rotation_discards_the_new_session_and_leaves_the_old_session_ret
        .await
        .unwrap();
    assert!(!format!("{original:?}").contains(&original.session_id));
-    *store.reject_delete.lock().unwrap() = Some(original.session_id.clone());
+    *store.reject_delete.lock().unwrap() = Some(stored_id(&original.session_id).to_owned());
    assert_eq!(
        services
            .auth()
@@ -391,109 +414,23 @@ async fn failed_rotation_discards_the_new_session_and_leaves_the_old_session_ret
    assert!(store.sessions.lock().unwrap().is_empty());
 }

-#[tokio::test]
-async fn renewal_is_throttled_and_capped_by_the_original_absolute_expiry() {
-    let store = std::sync::Arc::new(MemoryAuthStore::default());
-    let services = super::AdminHarness::new()
-        .auth(store.clone())
-        .session_ttl_minutes(60)
-        .build()
-        .await;
-    let auth = services.auth();
-    let login = auth
-        .login(
-            LoginCommand::Admin {
-                username: None,
-                password: "strong-test-password".into(),
-            },
-            std::net::Ipv4Addr::LOCALHOST.into(),
-            None,
-        )
-        .await
-        .unwrap();
-    assert_eq!(
-        auth.renew_session(Some(&login.session_id)).await.unwrap(),
-        Some(login.session.clone())
-    );
-    let limit = Utc::now() + TimeDelta::minutes(30);
-    {
-        let mut sessions = store.sessions.lock().unwrap();
-        let session = sessions.get_mut(&login.session_id).unwrap();
-        session.expires_at = Utc::now() + TimeDelta::minutes(1);
-        session.absolute_expires_at = Some(limit);
-    }
-    let renewed = auth
-        .renew_session(Some(&login.session_id))
-        .await
-        .unwrap()
-        .unwrap();
-    assert_eq!(renewed.expires_at, limit);
-    assert_eq!(renewed.absolute_expires_at, Some(limit));
-    assert_eq!(
-        auth.renew_session(Some(&login.session_id)).await.unwrap(),
-        Some(renewed)
-    );
+fn stored_id(token: &str) -> &str {
+    token.split('.').nth(1).unwrap_or(token)
 }

-#[tokio::test]
-async fn renewal_never_revives_expired_revoked_or_legacy_sessions() {
-    let store = std::sync::Arc::new(MemoryAuthStore::default());
-    let services = super::AdminHarness::new().auth(store.clone()).build().await;
-    let auth = services.auth();
-    let login = auth
-        .login(
-            LoginCommand::Admin {
-                username: None,
-                password: "strong-test-password".into(),
-            },
-            std::net::Ipv4Addr::LOCALHOST.into(),
-            None,
-        )
-        .await
-        .unwrap();
-    let mut session = login.session.clone();
-    session.absolute_expires_at = None;
-    session.expires_at = Utc::now() + TimeDelta::seconds(30);
-    store
-        .sessions
-        .lock()
-        .unwrap()
-        .insert(login.session_id.clone(), session.clone());
-    assert_eq!(
-        auth.renew_session(Some(&login.session_id)).await.unwrap(),
-        Some(session.clone())
-    );
-    session.expires_at = Utc::now() - TimeDelta::seconds(1);
-    store
-        .sessions
-        .lock()
-        .unwrap()
-        .insert(login.session_id.clone(), session);
-    assert!(
-        auth.renew_session(Some(&login.session_id))
-            .await
-            .unwrap()
-            .is_none()
-    );
-    let mut session = login.session;
-    session.absolute_expires_at = Some(Utc::now() - TimeDelta::seconds(1));
-    store
-        .sessions
-        .lock()
-        .unwrap()
-        .insert(login.session_id.clone(), session);
-    assert!(
-        auth.renew_session(Some(&login.session_id))
-            .await
-            .unwrap()
-            .is_none()
-    );
-    auth.logout(&login.session_id).await.unwrap();
-    assert!(
-        auth.renew_session(Some(&login.session_id))
-            .await
-            .unwrap()
-            .is_none()
-    );
-    assert!(store.sessions.lock().unwrap().is_empty());
+async fn admin_login(
+    auth: &dyn gateway_admin::AuthService,
+) -> gateway_admin::model::auth::SessionGrant {
+    auth.login(
+        LoginCommand::Admin {
+            username: None,
+            password: "strong-test-password".into(),
+        },
+        std::net::Ipv4Addr::LOCALHOST.into(),
+        None,
+    )
+    .await
+    .unwrap()
 }
+
+mod session;
@@ -0,0 +1,268 @@
+//! 验证双凭据续期、响应重试、并发撤销与固定期限边界
+
+use super::super::AdminHarness;
+use super::{MemoryAuthStore, admin_login, stored_id};
+use chrono::{TimeDelta, Utc};
+use gateway_admin::model::auth::AuthSession;
+
+#[tokio::test]
+async fn expired_access_is_restored_by_refresh_and_duplicate_refresh_replays_the_same_grant() {
+    let store = std::sync::Arc::new(MemoryAuthStore::default());
+    let services = AdminHarness::new().auth(store.clone()).build().await;
+    let auth = services.auth();
+    let login = admin_login(auth).await;
+    let refresh = login.refresh_token.as_deref().unwrap();
+    assert!(auth.session(Some(refresh)).await.unwrap().is_none());
+    assert!(
+        auth.renew_session(Some(&login.session_id), None)
+            .await
+            .unwrap()
+            .is_none()
+    );
+    assert!(
+        auth.renew_session(None, Some(&login.session_id))
+            .await
+            .unwrap()
+            .is_none()
+    );
+    assert_eq!(
+        auth.renew_session(Some(refresh), None).await.unwrap(),
+        Some(login.clone())
+    );
+    store
+        .sessions
+        .lock()
+        .unwrap()
+        .get_mut(stored_id(&login.session_id))
+        .unwrap()
+        .expires_at = Utc::now() - TimeDelta::seconds(1);
+    assert!(
+        auth.session(Some(&login.session_id))
+            .await
+            .unwrap()
+            .is_none()
+    );
+    let (first, concurrent) = tokio::join!(
+        auth.renew_session(Some(refresh), None),
+        auth.renew_session(Some(refresh), None)
+    );
+    let first = first.unwrap().unwrap();
+    assert_eq!(concurrent.unwrap().as_ref(), Some(&first));
+    assert_ne!(first.session_id, login.session_id);
+    assert_ne!(first.refresh_token, login.refresh_token);
+    assert_eq!(
+        first.session.absolute_expires_at,
+        login.session.absolute_expires_at
+    );
+    assert!(
+        auth.session(Some(&first.session_id))
+            .await
+            .unwrap()
+            .is_some()
+    );
+    assert_eq!(
+        auth.renew_session(first.refresh_token.as_deref(), None)
+            .await
+            .unwrap(),
+        Some(first.clone())
+    );
+    assert_eq!(
+        auth.renew_session(Some(refresh), None).await.unwrap(),
+        Some(first.clone())
+    );
+    let persisted = format!("{:?}", store.sessions.lock().unwrap());
+    for token in [
+        &first.session_id,
+        first.refresh_token.as_ref().unwrap(),
+        &login.session_id,
+        login.refresh_token.as_ref().unwrap(),
+    ] {
+        assert!(!persisted.contains(token));
+        assert!(!persisted.contains(token.rsplit('.').next().unwrap()));
+    }
+}
+
+#[tokio::test]
+async fn late_refresh_reuse_revokes_the_family_but_unknown_secrets_do_not() {
+    let store = std::sync::Arc::new(MemoryAuthStore::default());
+    let services = AdminHarness::new().auth(store.clone()).build().await;
+    let auth = services.auth();
+    let login = admin_login(auth).await;
+    store
+        .sessions
+        .lock()
+        .unwrap()
+        .get_mut(stored_id(&login.session_id))
+        .unwrap()
+        .expires_at = Utc::now() - TimeDelta::seconds(1);
+    let next = auth
+        .renew_session(login.refresh_token.as_deref(), None)
+        .await
+        .unwrap()
+        .unwrap();
+    let unknown = format!("r2.{}.{}", stored_id(&login.session_id), "A".repeat(43));
+    assert!(
+        auth.renew_session(Some(&unknown), None)
+            .await
+            .unwrap()
+            .is_none()
+    );
+    auth.logout(&unknown).await.unwrap();
+    auth.logout(stored_id(&login.session_id)).await.unwrap();
+    assert!(
+        auth.session(Some(&next.session_id))
+            .await
+            .unwrap()
+            .is_some()
+    );
+    store
+        .sessions
+        .lock()
+        .unwrap()
+        .get_mut(stored_id(&login.session_id))
+        .unwrap()
+        .renewal
+        .as_mut()
+        .unwrap()
+        .previous
+        .as_mut()
+        .unwrap()
+        .expires_at = Utc::now() - TimeDelta::seconds(1);
+    assert!(
+        auth.renew_session(login.refresh_token.as_deref(), None)
+            .await
+            .unwrap()
+            .is_none()
+    );
+    assert!(
+        auth.session(Some(&next.session_id))
+            .await
+            .unwrap()
+            .is_none()
+    );
+    assert!(
+        auth.renew_session(next.refresh_token.as_deref(), None)
+            .await
+            .unwrap()
+            .is_none()
+    );
+}
+
+#[tokio::test]
+async fn refresh_respects_idle_and_absolute_expiry_and_logout_after_access_expiry() {
+    let store = std::sync::Arc::new(MemoryAuthStore::default());
+    let services = AdminHarness::new().auth(store.clone()).build().await;
+    let auth = services.auth();
+    for absolute in [false, true] {
+        let login = admin_login(auth).await;
+        {
+            let mut sessions = store.sessions.lock().unwrap();
+            let session = sessions.get_mut(stored_id(&login.session_id)).unwrap();
+            if absolute {
+                session.absolute_expires_at = Some(Utc::now() - TimeDelta::seconds(1));
+            } else {
+                session.renewal.as_mut().unwrap().expires_at = Utc::now() - TimeDelta::seconds(1);
+            }
+        }
+        assert!(
+            auth.renew_session(login.refresh_token.as_deref(), None)
+                .await
+                .unwrap()
+                .is_none()
+        );
+        assert!(
+            auth.session(Some(&login.session_id))
+                .await
+                .unwrap()
+                .is_none()
+        );
+    }
+    let login = admin_login(auth).await;
+    store
+        .sessions
+        .lock()
+        .unwrap()
+        .get_mut(stored_id(&login.session_id))
+        .unwrap()
+        .expires_at = Utc::now() - TimeDelta::seconds(1);
+    auth.logout(login.refresh_token.as_deref().unwrap())
+        .await
+        .unwrap();
+    assert!(
+        auth.renew_session(login.refresh_token.as_deref(), None)
+            .await
+            .unwrap()
+            .is_none()
+    );
+}
+
+#[tokio::test]
+async fn refreshed_expiry_is_capped_and_store_outages_preserve_the_session() {
+    let store = std::sync::Arc::new(MemoryAuthStore::default());
+    let services = AdminHarness::new().auth(store.clone()).build().await;
+    let auth = services.auth();
+    let login = admin_login(auth).await;
+    let limit = Utc::now() + TimeDelta::minutes(1);
+    {
+        let mut sessions = store.sessions.lock().unwrap();
+        let session = sessions.get_mut(stored_id(&login.session_id)).unwrap();
+        session.absolute_expires_at = Some(limit);
+        session.expires_at = Utc::now() - TimeDelta::seconds(1);
+    }
+    store
+        .unavailable
+        .store(true, std::sync::atomic::Ordering::SeqCst);
+    assert!(
+        auth.renew_session(login.refresh_token.as_deref(), None)
+            .await
+            .is_err()
+    );
+    store
+        .unavailable
+        .store(false, std::sync::atomic::Ordering::SeqCst);
+    let refreshed = auth
+        .renew_session(login.refresh_token.as_deref(), None)
+        .await
+        .unwrap()
+        .unwrap();
+    assert_eq!(refreshed.session.expires_at, limit);
+    assert_eq!(refreshed.session.retained_until(), limit);
+    assert_eq!(refreshed.session.absolute_expires_at, Some(limit));
+}
+
+#[tokio::test]
+async fn fixed_sessions_cannot_acquire_refresh_credentials() {
+    let store = std::sync::Arc::new(MemoryAuthStore::default());
+    let services = AdminHarness::new().auth(store.clone()).build().await;
+    let auth = services.auth();
+    let login = admin_login(auth).await;
+    let fixed = AuthSession {
+        renewal: None,
+        ..login.session
+    };
+    store
+        .sessions
+        .lock()
+        .unwrap()
+        .insert("fixed".into(), fixed.clone());
+    let grant = auth
+        .renew_session(None, Some("fixed"))
+        .await
+        .unwrap()
+        .unwrap();
+    assert_eq!(grant.session, fixed);
+    assert!(grant.refresh_token.is_none());
+    store
+        .sessions
+        .lock()
+        .unwrap()
+        .get_mut("fixed")
+        .unwrap()
+        .expires_at = Utc::now() - TimeDelta::seconds(1);
+    assert!(
+        auth.renew_session(None, Some("fixed"))
+            .await
+            .unwrap()
+            .is_none()
+    );
+}
@@ -285,19 +285,24 @@ impl AuthStore for MemoryKeyAuthStore {
        Ok(())
    }

-    async fn renew_session(
+    async fn compare_exchange_session(
        &self,
        session_id: &str,
        expected: &AuthSession,
-        expires_at: chrono::DateTime<chrono::Utc>,
+        replacement: Option<&AuthSession>,
    ) -> AdminStoreResult<Option<AuthSession>> {
        let mut sessions = self.sessions.lock().unwrap();
        if let Some(session) = sessions.get_mut(session_id) {
-            if session.expires_at <= chrono::Utc::now() {
+            if session.retained_until() <= chrono::Utc::now() {
                return Ok(None);
            }
            if session == expected {
-                session.expires_at = expires_at;
+                if let Some(replacement) = replacement {
+                    *session = replacement.clone();
+                } else {
+                    sessions.remove(session_id);
+                    return Ok(None);
+                }
            }
            return Ok(Some(session.clone()));
        }
@@ -102,3 +102,51 @@ async fn backup_service_rejects_download_of_non_completed_record() {
        .expect_err("non-completed record must be rejected");
    assert_eq!(error.kind(), gateway_admin::model::AdminErrorKind::Conflict);
 }
+
+#[tokio::test]
+async fn failed_delete_probe_does_not_refresh_verification() {
+    use gateway_admin::{model::backup::code, ports::backup::BackupRepository as _};
+    for succeeds in [false, true] {
+        let mut settings = configured_settings();
+        settings.last_verified_at = None;
+        let repository = Arc::new(FakeBackupRepository::new(settings));
+        let auth = Arc::new(FakeAuthStore::new());
+        let store = FakeObjectStore::new();
+        let store = if succeeds {
+            store
+        } else {
+            store.fail_connection(code::S3_PERMISSION_DENIED)
+        };
+        let services = AdminHarness::new()
+            .auth(auth.clone())
+            .backup(BackupStorePorts::new(
+                repository.clone(),
+                Arc::new(FakeDumpPort::new()),
+                Arc::new(store),
+            ))
+            .build()
+            .await;
+        let result = services
+            .backups()
+            .test_connection(&system_context())
+            .await
+            .unwrap();
+        assert_eq!(result.ok, succeeds);
+        assert_eq!(
+            repository
+                .load_settings()
+                .await
+                .unwrap()
+                .last_verified_at
+                .is_some(),
+            succeeds
+        );
+        assert_eq!(
+            auth.audit_actions()
+                .iter()
+                .filter(|action| action.as_str() == "backup.s3_connection_tested")
+                .count(),
+            1
+        );
+    }
+}
@@ -32,12 +32,12 @@ fn runtime_settings(enabled: bool, probe_enabled: bool, adaptive: bool) -> Runti
        rotation_strategy: gateway_admin::model::settings::RotationStrategy::Smart,
        updated_at: Utc::now(),
        values: gateway_admin::model::settings::RuntimeSettingsValues {
+            codex_privacy_policy: Default::default(),
            request_location_enabled: false,
            request_location: Default::default(),
            refresh_margin_seconds: 300,
            refresh_concurrency: 2,
            max_concurrent_per_account: 5,
-            request_interval_ms: 0,
            max_waiting_per_key: 0,
            max_waiting_per_account: 0,
            concurrency_wait_timeout_seconds: 30,
@@ -29,8 +29,9 @@ use gateway_admin::{
    model::{
        MutationContext, Revision,
        account_groups::{
-            AccountGroupListQuery, AccountGroupMemberFact, AccountGroupMutation, AccountGroupPage,
-            DeleteAccountGroup, NewAccountGroup, SetAccountGroupEnabled, UpdateAccountGroup,
+            AccountGroupListQuery, AccountGroupMemberFact, AccountGroupMutation,
+            AccountGroupOptionsPage, AccountGroupPage, DeleteAccountGroup, NewAccountGroup,
+            SetAccountGroupEnabled, UpdateAccountGroup,
        },
        accounts::{
            AccountListQuery, AccountPage, AccountRuntimeSnapshot, AccountUpdateResult,
@@ -368,11 +369,11 @@ impl AuthStore for BootstrapAuthStore {
        Err(unavailable("admin session"))
    }

-    async fn renew_session(
+    async fn compare_exchange_session(
        &self,
        _: &str,
        _: &gateway_admin::model::auth::AuthSession,
-        _: chrono::DateTime<chrono::Utc>,
+        _: Option<&gateway_admin::model::auth::AuthSession>,
    ) -> AdminStoreResult<Option<gateway_admin::model::auth::AuthSession>> {
        Ok(None)
    }
@@ -424,6 +425,13 @@ impl AccountGroupStore for UnavailableAccountGroupStore {
        Err(unavailable("account groups"))
    }

+    async fn list_account_group_options(
+        &self,
+        _: AccountGroupListQuery,
+    ) -> AdminStoreResult<AccountGroupOptionsPage> {
+        Err(unavailable("account group options"))
+    }
+
    async fn load_account_group_members(
        &self,
        _: &[gateway_core::routing::AccountGroupId],
@@ -739,6 +747,10 @@ impl ClientKeyStore for UnavailableStore {

 #[async_trait]
 impl ObservabilityStore for UnavailableStore {
+    fn query_timeout(&self) -> std::time::Duration {
+        std::time::Duration::from_secs(10)
+    }
+
    async fn dashboard_summary(
        &self,
        _: DashboardQuery,
@@ -764,15 +776,17 @@ impl ObservabilityStore for UnavailableStore {
        Err(unavailable("usage trend"))
    }

-    fn usage_calculated_billing_facts(
+    async fn analytics_cache_generation(&self) -> AdminStoreResult<u64> {
+        Err(unavailable("analytics generation"))
+    }
+
+    async fn usage_insights_observation(
        &self,
        _: TimeRange,
        _: UsageFilter,
        _: Granularity,
-    ) -> gateway_admin::ports::store::UsageCalculatedBillingStream<'_> {
-        Box::pin(futures::stream::once(async {
-            Err(unavailable("usage billing facts"))
-        }))
+    ) -> AdminStoreResult<gateway_admin::model::observability::UsageInsightsObservation> {
+        Err(unavailable("usage insights"))
    }

    async fn list_usage_records(&self, _: UsageQuery) -> AdminStoreResult<UsagePage> {
@@ -17,13 +17,13 @@ use gateway_admin::{
    model::{
        MutationContext, Revision,
        observability::{
-            AccountPoolMetrics, AttemptMetrics, CostCoverage, CurrencyCost, DashboardAccountUsage,
-            DashboardObservation, DashboardQuery, DashboardRuntimeSlots, DiagnosticDimension,
-            DiagnosticObservation, DiagnosticsObservation, Granularity, HealthStatus,
-            LatencyPercentiles, ObservabilityPageSize, OpsErrorPage, OpsErrorQuery,
+            AccountPoolMetrics, AnalyticsState, AttemptMetrics, CostCoverage, CurrencyCost,
+            DashboardAccountUsage, DashboardObservation, DashboardQuery, DashboardRuntimeSlots,
+            DiagnosticDimension, DiagnosticObservation, DiagnosticsObservation, Granularity,
+            HealthStatus, LatencyPercentiles, ObservabilityPageSize, OpsErrorPage, OpsErrorQuery,
            PercentileMilliseconds, RequestMetricPoint, RequestMetrics, TimeRange, TrendKind,
-            UsageBilling, UsageCalculatedBillingFact, UsageDetail, UsageFilter, UsageListRecord,
-            UsageOverview, UsagePage, UsageQuery,
+            UsageBilling, UsageDetail, UsageFilter, UsageInsightsObservation, UsageListRecord,
+            UsageOverview, UsagePage, UsageProjectedCostPoint, UsageQuery,
        },
        settings::{
            AdminApiKey, AdminApiKeyMutation, ReplaceRuntimeSettings, RotationStrategy,
@@ -148,7 +148,7 @@ async fn dashboard_summary_should_derive_first_token_average_from_trend() {
 }

 #[tokio::test]
-async fn health_timeline_should_match_legacy_status_precedence_and_thresholds() {
+async fn health_timeline_should_apply_status_precedence_and_thresholds() {
    let now = Utc::now();
    let current_slot = quarter_hour_start(now);
    let store = Arc::new(FixtureObservabilityStore::new(observation_range(now)));
@@ -158,13 +158,28 @@ async fn health_timeline_should_match_legacy_status_precedence_and_thresholds()
            RequestMetrics {
                failure_count: 1,
                cancelled_count: 1,
-                incomplete_count: 1,
                caller_error_count: 1,
                ..RequestMetrics::default()
            },
            HealthStatus::NoData,
            None,
        ),
+        (
+            RequestMetrics {
+                incomplete_count: 1,
+                ..RequestMetrics::default()
+            },
+            HealthStatus::LowSample,
+            Some(0.0),
+        ),
+        (
+            RequestMetrics {
+                incomplete_count: 3,
+                ..RequestMetrics::default()
+            },
+            HealthStatus::Unavailable,
+            Some(0.0),
+        ),
        (
            RequestMetrics {
                failure_count: 3,
@@ -184,21 +199,21 @@ async fn health_timeline_should_match_legacy_status_precedence_and_thresholds()
        ),
        (
            RequestMetrics {
-                success_count: 98,
-                failure_count: 2,
+                success_count: 94,
+                failure_count: 6,
                ..RequestMetrics::default()
            },
            HealthStatus::Unstable,
-            Some(98.0),
+            Some(94.0),
        ),
        (
            RequestMetrics {
-                success_count: 99,
-                failure_count: 1,
+                success_count: 95,
+                incomplete_count: 5,
                ..RequestMetrics::default()
            },
            HealthStatus::Stable,
-            Some(99.0),
+            Some(95.0),
        ),
    ];

@@ -224,6 +239,92 @@ async fn health_timeline_should_match_legacy_status_precedence_and_thresholds()
    }
 }

+#[tokio::test]
+async fn health_views_should_include_incomplete_and_keep_final_outcomes_separate() {
+    let now = Utc::now();
+    let current_slot = quarter_hour_start(now);
+    let store = Arc::new(FixtureObservabilityStore::new(observation_range(now)));
+    let services = observability_services(store.clone()).await;
+    let fixtures = [
+        (162, 0, 2, 0, 0, 98.780_487_804_878_05),
+        (297, 0, 2, 5, 0, 99.331_103_678_929_76),
+        (467, 1, 5, 0, 0, 98.731_501_057_082_45),
+        (95, 2, 3, 4, 1, 95.0),
+        (100, 0, 0, 0, 0, 100.0),
+    ];
+
+    for (index, (success, failed, incomplete, cancelled, caller_error, expected_percent)) in
+        fixtures.into_iter().enumerate()
+    {
+        let range = observation_range(
+            now + Duration::seconds(i64::try_from(index).expect("fixture index fits i64") * 2),
+        );
+        let metrics = RequestMetrics {
+            request_count: success + failed + incomplete + cancelled + caller_error,
+            success_count: success,
+            failure_count: failed + caller_error,
+            incomplete_count: incomplete,
+            cancelled_count: cancelled,
+            caller_error_count: caller_error,
+            ..RequestMetrics::default()
+        };
+        store.replace_trend(vec![health_metric_point(current_slot, metrics.clone())]);
+        store.replace_overview(UsageOverview {
+            analytics: Default::default(),
+            range,
+            requests: metrics,
+            // 中间尝试失败不会增加最终失败请求数
+            attempts: AttemptMetrics {
+                failure_count: 2,
+                ..AttemptMetrics::default()
+            },
+            providers: Vec::new(),
+        });
+
+        let dashboard = services
+            .observability()
+            .dashboard_summary(range, TrendKind::Usage)
+            .await
+            .expect("dashboard summary");
+        let timeline = dashboard.health_timeline;
+        let point = timeline
+            .points
+            .iter()
+            .find(|point| point.bucket_start == current_slot)
+            .expect("current health slot");
+        assert_eq!(point.status, HealthStatus::Stable);
+        assert_eq!(point.failed_requests, failed);
+        assert_eq!(point.incomplete_requests, incomplete);
+        assert_eq!(point.cancelled_requests, cancelled);
+        assert_eq!(point.caller_error_requests, caller_error);
+        for reliability in [timeline.reliability_percent, point.reliability_percent] {
+            assert!((reliability.expect("health reliability") - expected_percent).abs() < 1e-10);
+        }
+        for success_rate in [
+            dashboard.trend.summary.success_rate,
+            dashboard.trend.points[0].success_rate,
+        ] {
+            assert!(
+                (success_rate.expect("trend success rate") * 100.0 - expected_percent).abs()
+                    < 1e-10
+            );
+        }
+
+        let insights = services
+            .observability()
+            .usage_insights(range, UsageFilter::default())
+            .await
+            .expect("usage insights");
+        assert_eq!(insights.health.failed_requests, failed);
+        assert_eq!(insights.health.incomplete_requests, incomplete);
+        assert!((insights.health.success_rate * 100.0 - expected_percent).abs() < 1e-10);
+        assert!(
+            (insights.health.points[0].error_rate * 100.0 - (100.0 - expected_percent)).abs()
+                < 1e-10
+        );
+    }
+}
+
 #[tokio::test]
 async fn dashboard_summary_should_project_rebuildable_runtime_slots() {
    let now = Utc::now();
@@ -300,7 +401,7 @@ async fn dashboard_summary_should_observe_current_accounts_for_a_historical_rang
 }

 #[tokio::test]
-async fn dashboard_summary_should_coalesce_concurrent_requests_in_one_short_window() {
+async fn dashboard_summary_should_keep_distinct_exact_ranges_in_one_short_window() {
    let end_bucket = Utc::now().timestamp().div_euclid(2) * 2;
    let first_end = DateTime::from_timestamp(end_bucket, 100_000_000).expect("first end");
    let second_end = DateTime::from_timestamp(end_bucket, 900_000_000).expect("second end");
@@ -330,7 +431,7 @@ async fn dashboard_summary_should_coalesce_concurrent_requests_in_one_short_wind

    first.expect("first dashboard summary");
    second.expect("second dashboard summary");
-    assert_eq!(store.dashboard_summary_calls(), 1);
+    assert_eq!(store.dashboard_summary_calls(), 2);
 }

 #[tokio::test]
@@ -403,6 +504,7 @@ async fn observability_services_should_calculate_usage_insights_and_diagnostic_s
        ..RequestMetrics::default()
    };
    store.replace_overview(UsageOverview {
+        analytics: Default::default(),
        range,
        requests: metrics.clone(),
        attempts: AttemptMetrics {
@@ -431,23 +533,13 @@ async fn observability_services_should_calculate_usage_insights_and_diagnostic_s
                .expect("bucket USD cost"),
        }],
    }]);
-    store.replace_calculated_billing_facts(vec![UsageCalculatedBillingFact {
-        breakdown: None,
+    store.replace_projected_costs(vec![UsageProjectedCostPoint {
        bucket_start: quarter_hour_start(now),
-        provider_kind: "openai".to_owned(),
-        upstream_model_id: "gpt-5.5".to_owned(),
-        service_tier: None,
-        input_tokens: Some(800),
-        output_tokens: Some(200),
-        cached_tokens: Some(0),
-        cache_write_tokens: Some(0),
-        total: CurrencyCost {
-            currency: "USD".to_owned(),
-            amount: gateway_admin::model::observability::DecimalAmount::from_str("1.25")
-                .expect("calculated total"),
-        },
+        standard_amount: Some("1".parse().expect("standard cost")),
+        no_cache_amount: Some("1.25".parse().expect("no-cache cost")),
    }]);
    store.replace_diagnostics(DiagnosticsObservation {
+        analytics: Default::default(),
        total_request_count: 4,
        items: vec![diagnostic("openai", 3), diagnostic("xai", 1)],
    });
@@ -543,6 +635,7 @@ async fn diagnostics_should_preserve_request_order_when_a_small_sample_fails() {
    failure.success_count = 0;
    failure.failure_count = 1;
    store.replace_diagnostics(DiagnosticsObservation {
+        analytics: Default::default(),
        total_request_count: 101,
        items: vec![success, failure],
    });
@@ -566,6 +659,7 @@ async fn diagnostics_should_use_the_total_before_truncating_groups() {
    let range = observation_range(Utc::now());
    let store = Arc::new(FixtureObservabilityStore::new(range));
    store.replace_diagnostics(DiagnosticsObservation {
+        analytics: Default::default(),
        total_request_count: 200,
        items: (0..100)
            .map(|index| diagnostic(&format!("model-{index}"), 1))
@@ -591,6 +685,7 @@ async fn diagnostics_should_count_each_retried_request_once() {
    item.retry_count = 6;
    item.retried_request_count = 2;
    store.replace_diagnostics(DiagnosticsObservation {
+        analytics: Default::default(),
        total_request_count: 8,
        items: vec![item],
    });
@@ -691,26 +786,16 @@ async fn usage_records_should_enrich_provider_reported_totals_when_pricing_match
 }

 #[tokio::test]
-async fn usage_insights_should_reject_partial_costs_when_billing_stream_fails() {
+async fn usage_insights_should_reject_partial_costs_when_insights_fail() {
    let now = Utc::now();
    let range = observation_range(now);
    let store = Arc::new(FixtureObservabilityStore::new(range));
-    store.replace_calculated_billing_facts(vec![UsageCalculatedBillingFact {
-        breakdown: None,
+    store.replace_projected_costs(vec![UsageProjectedCostPoint {
        bucket_start: quarter_hour_start(now),
-        provider_kind: "openai".to_owned(),
-        upstream_model_id: "gpt-5.5".to_owned(),
-        service_tier: None,
-        input_tokens: Some(800),
-        output_tokens: Some(200),
-        cached_tokens: Some(0),
-        cache_write_tokens: Some(0),
-        total: CurrencyCost {
-            currency: "USD".to_owned(),
-            amount: "1.25".parse().expect("cost"),
-        },
+        standard_amount: Some("1".parse().expect("standard cost")),
+        no_cache_amount: Some("1.25".parse().expect("no-cache cost")),
    }]);
-    store.billing_stream_fails.store(true, Ordering::SeqCst);
+    store.insights_fail.store(true, Ordering::SeqCst);
    let services = observability_services_with_calculated_billing(store).await;
    assert!(
        services
@@ -741,9 +826,9 @@ async fn dashboard_should_preserve_provider_plan_names() {
            success_count: 0,
            input_tokens: None,
            output_tokens: None,
-            cached_tokens: None,
-            cache_write_tokens: None,
-            reasoning_tokens: None,
+            cached_input_tokens: None,
+            cache_write_input_tokens: None,
+            reasoning_output_tokens: None,
            image_input_tokens: None,
            image_output_tokens: None,
            image_request_count: 0,
@@ -783,8 +868,9 @@ async fn dashboard_should_preserve_provider_plan_names() {
 struct FixtureObservabilityStore {
    trend: Mutex<Vec<RequestMetricPoint>>,
    overview: Mutex<UsageOverview>,
-    calculated_billing_facts: Mutex<Vec<UsageCalculatedBillingFact>>,
-    billing_stream_fails: AtomicBool,
+    projected_costs: Mutex<Vec<UsageProjectedCostPoint>>,
+    insights_fail: AtomicBool,
+    summary_fail: AtomicBool,
    diagnostics: Mutex<DiagnosticsObservation>,
    runtime_slots: Mutex<Option<DashboardRuntimeSlots>>,
    summary_observed_at: Mutex<Option<DateTime<Utc>>>,
@@ -794,6 +880,7 @@ struct FixtureObservabilityStore {
    account_usage: Mutex<Vec<DashboardAccountUsage>>,
    dashboard_delay: Mutex<StdDuration>,
    dashboard_summary_calls: AtomicUsize,
+    usage_summary_filters: Mutex<Vec<UsageFilter>>,
 }

 impl FixtureObservabilityStore {
@@ -801,13 +888,15 @@ impl FixtureObservabilityStore {
        Self {
            trend: Mutex::new(Vec::new()),
            overview: Mutex::new(UsageOverview {
+                analytics: Default::default(),
                range,
                requests: RequestMetrics::default(),
                attempts: AttemptMetrics::default(),
                providers: Vec::new(),
            }),
-            calculated_billing_facts: Mutex::new(Vec::new()),
-            billing_stream_fails: AtomicBool::new(false),
+            projected_costs: Mutex::new(Vec::new()),
+            insights_fail: AtomicBool::new(false),
+            summary_fail: AtomicBool::new(false),
            diagnostics: Mutex::new(DiagnosticsObservation::default()),
            runtime_slots: Mutex::new(None),
            summary_observed_at: Mutex::new(None),
@@ -817,6 +906,7 @@ impl FixtureObservabilityStore {
            account_usage: Mutex::new(Vec::new()),
            dashboard_delay: Mutex::new(StdDuration::ZERO),
            dashboard_summary_calls: AtomicUsize::new(0),
+            usage_summary_filters: Mutex::new(Vec::new()),
        }
    }

@@ -836,11 +926,8 @@ impl FixtureObservabilityStore {
        *self.overview.lock().expect("overview") = overview;
    }

-    fn replace_calculated_billing_facts(&self, facts: Vec<UsageCalculatedBillingFact>) {
-        *self
-            .calculated_billing_facts
-            .lock()
-            .expect("calculated billing facts") = facts;
+    fn replace_projected_costs(&self, facts: Vec<UsageProjectedCostPoint>) {
+        *self.projected_costs.lock().expect("projected costs") = facts;
    }

    fn replace_diagnostics(&self, diagnostics: DiagnosticsObservation) {
@@ -858,6 +945,10 @@ impl FixtureObservabilityStore {

 #[async_trait]
 impl ObservabilityStore for FixtureObservabilityStore {
+    fn query_timeout(&self) -> std::time::Duration {
+        std::time::Duration::from_secs(10)
+    }
+
    async fn dashboard_summary(
        &self,
        query: DashboardQuery,
@@ -874,6 +965,7 @@ impl ObservabilityStore for FixtureObservabilityStore {
            tokio::time::sleep(dashboard_delay).await;
        }
        Ok(DashboardObservation {
+            analytics: self.overview.lock().expect("overview").analytics.clone(),
            range: query.range,
            totals: Default::default(),
            provider_accounts: AccountPoolMetrics::default(),
@@ -902,25 +994,29 @@ impl ObservabilityStore for FixtureObservabilityStore {
        Ok(self.trend.lock().expect("trend").clone())
    }

-    fn usage_calculated_billing_facts(
+    async fn analytics_cache_generation(&self) -> AdminStoreResult<u64> {
+        Ok(self.overview.lock().expect("overview").analytics.generation)
+    }
+
+    async fn usage_insights_observation(
        &self,
        _: TimeRange,
        _: UsageFilter,
        granularity: Granularity,
-    ) -> gateway_admin::ports::store::UsageCalculatedBillingStream<'_> {
+    ) -> AdminStoreResult<UsageInsightsObservation> {
        self.usage_granularities.lock().unwrap().push(granularity);
-        let facts = self
-            .calculated_billing_facts
-            .lock()
-            .expect("calculated billing facts")
-            .clone();
-        let error = self
-            .billing_stream_fails
-            .load(Ordering::SeqCst)
-            .then(|| Err(super::unavailable("billing stream failed")));
-        Box::pin(futures::stream::iter(
-            facts.into_iter().map(Ok).chain(error),
-        ))
+        if self.insights_fail.load(Ordering::SeqCst) {
+            return Err(super::unavailable("projection read failed"));
+        }
+        Ok(UsageInsightsObservation {
+            overview: self.overview.lock().expect("overview").clone(),
+            trend: self.trend.lock().expect("trend").clone(),
+            costs: self
+                .projected_costs
+                .lock()
+                .expect("projected costs")
+                .clone(),
+        })
    }

    async fn list_usage_records(&self, query: UsageQuery) -> AdminStoreResult<UsagePage> {
@@ -938,8 +1034,26 @@ impl ObservabilityStore for FixtureObservabilityStore {
        Err(super::unavailable("usage detail"))
    }

-    async fn usage_summary(&self, _: TimeRange, _: UsageFilter) -> AdminStoreResult<UsageOverview> {
-        Ok(self.overview.lock().expect("overview").clone())
+    async fn usage_summary(
+        &self,
+        range: TimeRange,
+        filter: UsageFilter,
+    ) -> AdminStoreResult<UsageOverview> {
+        self.usage_summary_filters
+            .lock()
+            .expect("summary filters")
+            .push(filter);
+        let delay = *self.dashboard_delay.lock().expect("query delay");
+        if !delay.is_zero() {
+            tokio::time::sleep(delay).await;
+        }
+        if self.summary_fail.load(Ordering::SeqCst) {
+            return Err(super::unavailable("projection summary failed"));
+        }
+        Ok(UsageOverview {
+            range,
+            ..self.overview.lock().expect("overview").clone()
+        })
    }

    async fn usage_diagnostics(
@@ -988,12 +1102,12 @@ impl SettingsStore for FixtureSettingsStore {
            rotation_strategy: RotationStrategy::Smart,
            updated_at: Utc::now(),
            values: gateway_admin::model::settings::RuntimeSettingsValues {
+                codex_privacy_policy: Default::default(),
                request_location_enabled: false,
                request_location: Default::default(),
                refresh_margin_seconds: 300,
                refresh_concurrency: 2,
                max_concurrent_per_account: self.max_concurrent_per_account,
-                request_interval_ms: 0,
                max_waiting_per_key: 0,
                max_waiting_per_account: 0,
                concurrency_wait_timeout_seconds: 30,
@@ -1113,9 +1227,9 @@ fn total_record(
        service_tier: None,
        input_tokens: Some(800),
        output_tokens: Some(200),
-        cached_tokens: Some(0),
-        cache_write_tokens: Some(0),
-        reasoning_tokens: Some(0),
+        cached_input_tokens: Some(0),
+        cache_write_input_tokens: Some(0),
+        reasoning_output_tokens: Some(0),
        image_input_tokens: None,
        image_output_tokens: None,
        total_tokens: Some(1_000),
@@ -1138,6 +1252,13 @@ fn total_record(
        first_text_ms: None,
        first_token_ms: None,
        provider_processing_ms: None,
+        upstream_response_ms: None,
+        upstream_api_overhead_ms: None,
+        upstream_engine_ms: None,
+        upstream_engine_iapi_ttft_ms: None,
+        upstream_engine_service_ttft_ms: None,
+        upstream_engine_iapi_tbt_ms: None,
+        upstream_engine_service_tbt_ms: None,
        latency_ms: Some(100),
        admission_decision_ms: None,
        account_selection_wait_ms: None,
@@ -1221,9 +1342,204 @@ async fn admin_selects_dashboard_defaults_and_matching_usage_buckets_at_range_bo
            .usage_insights(range, UsageFilter::default())
            .await
            .unwrap();
-        assert_eq!(
-            *store.usage_granularities.lock().unwrap(),
-            vec![expected, expected]
+        assert_eq!(*store.usage_granularities.lock().unwrap(), vec![expected]);
+    }
+}
+
+#[tokio::test]
+async fn usage_summary_cache_should_coalesce_identical_queries_and_invalidate_deleted_generation() {
+    let range = observation_range(Utc::now());
+    let store = Arc::new(FixtureObservabilityStore::new(range));
+    store.set_dashboard_delay(StdDuration::from_millis(20));
+    let services = observability_services(store.clone()).await;
+    let service = services.observability();
+    let filter = UsageFilter {
+        client_api_key_ref: Some("deleted-key".to_owned()),
+        ..Default::default()
+    };
+    let (first, second) = tokio::join!(
+        service.usage_summary(range, filter.clone()),
+        service.usage_summary(range, filter.clone()),
+    );
+    first.expect("first summary");
+    second.expect("coalesced summary");
+    assert_eq!(store.usage_summary_filters.lock().unwrap().len(), 1);
+    {
+        let mut overview = store.overview.lock().unwrap();
+        overview.analytics.generation = 1;
+        overview.requests.request_count = 7;
+    }
+    let refreshed = service
+        .usage_summary(range, filter)
+        .await
+        .expect("generation refresh");
+    assert_eq!(refreshed.overview.analytics.generation, 1);
+    assert_eq!(refreshed.overview.requests.request_count, 7);
+    assert_eq!(store.usage_summary_filters.lock().unwrap().len(), 2);
+}
+
+#[tokio::test(start_paused = true)]
+async fn usage_summary_cache_should_coalesce_when_generation_advances_during_the_first_load() {
+    let range = observation_range(Utc::now());
+    let store = Arc::new(FixtureObservabilityStore::new(range));
+    store.set_dashboard_delay(StdDuration::from_millis(20));
+    let services = observability_services(store.clone()).await;
+    let service = services.observability();
+    let (first, second, ()) = tokio::join!(
+        service.usage_summary(range, UsageFilter::default()),
+        service.usage_summary(range, UsageFilter::default()),
+        async {
+            tokio::time::sleep(StdDuration::from_millis(5)).await;
+            store.overview.lock().unwrap().analytics.generation = 1;
+        },
+    );
+    assert_eq!(
+        first.expect("first summary").overview.analytics.generation,
+        1
+    );
+    assert_eq!(
+        second
+            .expect("coalesced summary")
+            .overview
+            .analytics
+            .generation,
+        1
+    );
+    assert_eq!(store.usage_summary_filters.lock().unwrap().len(), 1);
+}
+
+#[tokio::test]
+async fn usage_summary_cache_should_isolate_key_identity_and_filters() {
+    let range = observation_range(Utc::now());
+    let store = Arc::new(FixtureObservabilityStore::new(range));
+    let services = observability_services(store.clone()).await;
+    let service = services.observability();
+    for (key, model) in [
+        ("key-a", None),
+        ("key-a", None),
+        ("key-b", None),
+        ("key-a", Some("model-a")),
+    ] {
+        service
+            .usage_summary(
+                range,
+                UsageFilter {
+                    client_api_key_ref: Some(key.to_owned()),
+                    model: model.map(str::to_owned),
+                    ..Default::default()
+                },
+            )
+            .await
+            .expect("isolated summary");
+    }
+    let calls = store.usage_summary_filters.lock().unwrap();
+    assert_eq!(calls.len(), 3);
+    assert_eq!(calls[0].client_api_key_ref.as_deref(), Some("key-a"));
+    assert_eq!(calls[1].client_api_key_ref.as_deref(), Some("key-b"));
+    assert_eq!(calls[2].model.as_deref(), Some("model-a"));
+}
+
+#[tokio::test(start_paused = true)]
+async fn usage_summary_cache_should_bound_waiting_after_failed_refresh_and_allow_recovery() {
+    let range = observation_range(Utc::now());
+    let store = Arc::new(FixtureObservabilityStore::new(range));
+    store.set_dashboard_delay(store.query_timeout().mul_f64(0.7));
+    store.summary_fail.store(true, Ordering::SeqCst);
+    let services = observability_services(store.clone()).await;
+    let service = services.observability();
+    let started = tokio::time::Instant::now();
+    let (first, second, third, fourth) = tokio::join!(
+        service.usage_summary(range, UsageFilter::default()),
+        service.usage_summary(range, UsageFilter::default()),
+        service.usage_summary(range, UsageFilter::default()),
+        service.usage_summary(range, UsageFilter::default()),
+    );
+    assert!(first.is_err() && second.is_err() && third.is_err() && fourth.is_err());
+    assert!(
+        started.elapsed() <= store.query_timeout(),
+        "同键失败不能使后续请求逐个等待完整数据库超时: {:?}",
+        started.elapsed()
+    );
+
+    store.summary_fail.store(false, Ordering::SeqCst);
+    store.set_dashboard_delay(StdDuration::ZERO);
+    service
+        .usage_summary(range, UsageFilter::default())
+        .await
+        .expect("cancelled cache refresh releases its slot for recovery");
+}
+
+#[tokio::test(start_paused = true)]
+async fn insights_cache_should_bound_stale_lifetime_without_renewing_failed_refreshes() {
+    let range = observation_range(Utc::now());
+    let store = Arc::new(FixtureObservabilityStore::new(range));
+    {
+        let mut overview = store.overview.lock().unwrap();
+        overview.analytics.state = AnalyticsState::Ready;
+        overview.analytics.generated_at = Utc::now();
+        overview.analytics.lag_seconds = 7;
+        overview.requests.request_count = 19;
+    }
+    let services = observability_services(store.clone()).await;
+    let service = services.observability();
+    service
+        .usage_insights(range, UsageFilter::default())
+        .await
+        .unwrap();
+    store.insights_fail.store(true, Ordering::SeqCst);
+    tokio::time::advance(StdDuration::from_secs(16)).await;
+    let stale = service
+        .usage_insights(range, UsageFilter::default())
+        .await
+        .unwrap();
+    assert_eq!(stale.analytics.state, AnalyticsState::Stale);
+    assert!(stale.analytics.lag_seconds >= 7);
+    assert_eq!(stale.health.total_requests, 19);
+    tokio::time::advance(StdDuration::from_secs(45)).await;
+    assert!(
+        service
+            .usage_insights(range, UsageFilter::default())
+            .await
+            .is_err()
+    );
+}
+
+#[tokio::test(start_paused = true)]
+async fn insights_cache_should_reject_deleted_building_and_old_generation_times() {
+    for reason in ["deleted", "building", "generated-too-long-ago"] {
+        let range = observation_range(Utc::now());
+        let store = Arc::new(FixtureObservabilityStore::new(range));
+        {
+            let mut overview = store.overview.lock().unwrap();
+            overview.analytics.state = if reason == "building" {
+                AnalyticsState::Building
+            } else {
+                AnalyticsState::Ready
+            };
+            overview.analytics.generated_at = Utc::now()
+                - Duration::seconds(if reason == "generated-too-long-ago" {
+                    61
+                } else {
+                    0
+                });
+        }
+        let services = observability_services(store.clone()).await;
+        let service = services.observability();
+        service
+            .usage_insights(range, UsageFilter::default())
+            .await
+            .unwrap();
+        store.insights_fail.store(true, Ordering::SeqCst);
+        if reason == "deleted" {
+            store.overview.lock().unwrap().analytics.generation += 1;
+        }
+        tokio::time::advance(StdDuration::from_secs(16)).await;
+        assert!(
+            service
+                .usage_insights(range, UsageFilter::default())
+                .await
+                .is_err(),
+            "{reason}"
        );
    }
 }
@@ -85,9 +85,10 @@ impl gateway_admin::ports::plugins::PluginPackageInspector for LifecycleFixture
    }
    async fn compatibility_warning(
        &self,
-        _: Arc<[u8]>,
-        _: String,
+        archive: Arc<[u8]>,
+        digest: String,
    ) -> Result<Option<String>, AdminError> {
+        self.inspect(archive, Some(digest)).await?;
        Ok(self.data.lock().unwrap().compatibility_warning.clone())
    }
    async fn inspect(
@@ -130,6 +131,9 @@ struct FixtureData {
    saves: Vec<SavedInstance>,
    history: BTreeMap<String, PluginVersionConfiguration>,
    aborted: usize,
+    transition_active: bool,
+    fail_reload_after_migration: bool,
+    fail_next_load: bool,
    activated: usize,
    quiesced: usize,
    diagnostics: Option<BTreeMap<String, PluginInstanceRuntime>>,
@@ -183,6 +187,9 @@ impl LifecycleFixture {
                    },
                )]),
                aborted: 0,
+                transition_active: false,
+                fail_reload_after_migration: false,
+                fail_next_load: false,
                activated: 0,
                quiesced: 0,
                diagnostics: None,
@@ -235,6 +242,9 @@ impl LifecycleFixture {
            .instances
            .retain(|current| current.id != instance.id);
        data.snapshot.instances.push(instance.clone());
+        if transition_id.is_some() {
+            data.transition_active = false;
+        }
        data.saves.push(SavedInstance {
            artifact_sha256: instance.artifact_sha256.clone(),
            enabled: instance.enabled,
@@ -334,7 +344,11 @@ impl gateway_admin::ports::plugins::PluginStateLifecycle for LifecycleFixture {
        _: PluginStateTransition,
    ) -> Result<(), AdminError> {
        match self.behavior {
-            MigrationBehavior::Succeed => Ok(()),
+            MigrationBehavior::Succeed => {
+                let mut data = self.data.lock().unwrap();
+                data.fail_next_load = std::mem::take(&mut data.fail_reload_after_migration);
+                Ok(())
+            }
            MigrationBehavior::Fail => Err(AdminError::invalid("migration fixture failed")),
            MigrationBehavior::ConcurrentChangeThenFail => {
                let mut data = self.data.lock().unwrap();
@@ -398,9 +412,10 @@ impl PluginStateStore for LifecycleFixture {
        artifact_sha256: &str,
        _: PluginStateConfiguration,
    ) -> PluginStateStoreResult<PluginStateTransition> {
-        let data = self.data.lock().unwrap();
+        let mut data = self.data.lock().unwrap();
        let current = &data.snapshot.instances[0];
-        if current.enabled
+        if data.transition_active
+            || current.enabled
            || current.id != instance_id
            || current.revision != expected_instance_revision
            || artifact_sha256 != NEW_ARTIFACT
@@ -409,6 +424,7 @@ impl PluginStateStore for LifecycleFixture {
                PluginStateStoreErrorKind::Conflict,
            ));
        }
+        data.transition_active = true;
        Ok(PluginStateTransition {
            id: "00000000-0000-7000-8000-000000000002".into(),
            instance_id: instance_id.into(),
@@ -438,7 +454,9 @@ impl PluginStateStore for LifecycleFixture {
    }

    async fn abort_transition(&self, _: &str) -> PluginStateStoreResult<()> {
-        self.data.lock().unwrap().aborted += 1;
+        let mut data = self.data.lock().unwrap();
+        data.aborted += 1;
+        data.transition_active = false;
        Ok(())
    }
 }
@@ -463,7 +481,11 @@ impl PluginStore for LifecycleFixture {
            }))
    }
    async fn load_instances(&self) -> AdminStoreResult<PluginInstanceSnapshot> {
-        Ok(self.snapshot())
+        let mut data = self.data.lock().unwrap();
+        if std::mem::take(&mut data.fail_next_load) {
+            return Err(admin_error(AdminStoreErrorKind::Unavailable));
+        }
+        Ok(data.snapshot.clone())
    }

    async fn load_version_configuration(
@@ -1046,6 +1068,36 @@ async fn failed_state_migration_restores_the_previous_enabled_version_with_cas()
    assert_eq!(published.revisions.lock().unwrap().as_slice(), [11, 12]);
 }

+#[tokio::test]
+async fn reload_failure_after_migration_aborts_restores_and_allows_retry() {
+    let fixture = LifecycleFixture::new(MigrationBehavior::Succeed);
+    fixture.data.lock().unwrap().fail_reload_after_migration = true;
+    let published = Arc::new(Published::default());
+    let service = service(fixture.clone(), published.clone());
+    let id = "00000000-0000-7000-8000-000000000001";
+    let error = service
+        .configure_instance(Some(id), input(), &context())
+        .await
+        .err()
+        .unwrap();
+    assert_eq!(error.kind(), AdminErrorKind::Unavailable);
+    {
+        let data = fixture.data.lock().unwrap();
+        assert_eq!(data.aborted, 1);
+        assert!(!data.transition_active);
+        assert!(data.snapshot.instances[0].enabled);
+        assert_eq!(data.snapshot.instances[0].artifact_sha256, OLD_ARTIFACT);
+        assert_eq!(*published.revisions.lock().unwrap(), [11, 12]);
+    }
+    let result = service
+        .configure_instance(Some(id), input(), &context())
+        .await
+        .unwrap();
+    assert_eq!(result.instance.artifact_sha256, NEW_ARTIFACT);
+    assert!(result.instance.enabled);
+    assert!(!fixture.data.lock().unwrap().transition_active);
+}
+
 #[tokio::test]
 async fn failed_state_migration_never_overwrites_a_concurrent_configuration_change() {
    let fixture = LifecycleFixture::new(MigrationBehavior::ConcurrentChangeThenFail);
@@ -57,6 +57,7 @@ impl VisitMut for WireTypes {
            let last = path.path.segments.last().unwrap().clone();
            *ty = match last.ident.to_string().as_str() {
                "DateTime" | "Tz" | "TokenPrice" | "AdminApiKey" => parse_quote!(String),
+                "Value" => parse_quote!(serde_json::Value),
                "OpaqueProviderData" => parse_quote!(serde_json::Map<String, serde_json::Value>),
                _ => Type::Path(syn::TypePath {
                    attrs: std::mem::take(&mut path.attrs),
@@ -79,6 +80,10 @@ fn contract_type(mut item: Item, name: &str) -> Item {
                    | "ReplaceRuntimeSettings"
                    | "AdminApiKeyMutation"
                    | "RegeneratedAdminApiKey"
+                    | "CodexPrivacyPolicy"
+                    | "PrivacyRule"
+                    | "PrivacyPreviewRequest"
+                    | "PrivacyPreviewResult"
            );
            (
                &mut item.attrs,
@@ -107,6 +112,13 @@ fn contract_type(mut item: Item, name: &str) -> Item {
            field.vis = parse_quote!(pub);
        }
    }
+    if let Item::Enum(item) = &mut item {
+        for variant in &mut item.variants {
+            variant
+                .attrs
+                .retain(|attr| !attr.path().is_ident("default"));
+        }
+    }
    WireTypes.visit_item_mut(&mut item);
    item
 }
@@ -117,6 +129,19 @@ fn sdk_settings_contract_matches_host_declarations() {
    let mut types = Vec::new();
    let mut replacement_fields = Vec::new();
    for (path, names) in [
+        (
+            "../gateway-core/src/settings/privacy.rs",
+            &[
+                "CodexPrivacyPolicy",
+                "PrivacyFailureMode",
+                "PrivacyScope",
+                "PrivacyAction",
+                "PrivacyRule",
+                "PrivacyRuleOutcome",
+                "PrivacyPreviewRequest",
+                "PrivacyPreviewResult",
+            ][..],
+        ),
        (
            "src/model/settings.rs",
            &[
@@ -100,6 +100,51 @@ async fn client_profile_preview_rejects_unknown_provider_before_loading_settings
    assert_eq!(error.kind(), AdminErrorKind::Invalid);
 }

+#[tokio::test]
+async fn pricing_accepts_ultrafast_for_openai_but_rejects_it_for_xai() {
+    for provider in ["openai", "xai"] {
+        let store = Arc::new(PricingSettingsStore::default());
+        let services = super::AdminHarness::new()
+            .settings(store.clone())
+            .provider(super::test_provider(provider))
+            .build()
+            .await;
+        let context = MutationContext {
+            actor: gateway_admin::model::MutationActor::System,
+            request_id: "request-ultrafast-pricing".to_owned(),
+        };
+        for band in ["ultrafast", "long_ultrafast"] {
+            let pricing = serde_json::from_value(serde_json::json!({
+                "multiplierBps": 10000,
+                "bands": {
+                    "standard": {"input":"2", "output":"10", "cacheRead":"0.1", "cacheWrite":"2.5"},
+                    (band): {"input":"12", "output":"60", "cacheRead":"0.6", "cacheWrite":"15"}
+                }
+            }))
+            .expect("Ultrafast override");
+            let update = UpdatePricing {
+                provider: provider.to_owned(),
+                models: vec!["example-model".to_owned()],
+                change: PricingChange::Replace(pricing),
+            };
+            let result = services
+                .settings()
+                .update_pricing(&context, update.clone())
+                .await;
+            if provider == "openai" {
+                result.expect("OpenAI accepts Ultrafast overrides");
+                assert_eq!(store.updated.lock().unwrap().as_ref(), Some(&update));
+            } else {
+                assert_eq!(
+                    result.expect_err("xAI rejects Ultrafast").kind(),
+                    AdminErrorKind::Invalid
+                );
+                assert!(store.updated.lock().unwrap().is_none());
+            }
+        }
+    }
+}
+
 #[tokio::test]
 async fn pricing_accepts_native_provider_and_rejects_unknown_sync_provider() {
    let store = Arc::new(PricingSettingsStore::default());
@@ -280,12 +325,12 @@ async fn settings_should_reject_zero_refresh_margin_before_store_call() {
                model_mappings: Default::default(),
                rotation_strategy: RotationStrategy::Smart,
                values: gateway_admin::model::settings::RuntimeSettingsValues {
+                    codex_privacy_policy: Default::default(),
                    request_location_enabled: false,
                    request_location: Default::default(),
                    refresh_margin_seconds: 0,
                    refresh_concurrency: 1,
                    max_concurrent_per_account: 1,
-                    request_interval_ms: 0,
                    max_waiting_per_key: 0,
                    max_waiting_per_account: 0,
                    concurrency_wait_timeout_seconds: 30,
@@ -16,8 +16,9 @@ use gateway_admin::model::{
    PageSize,
    account_groups::{
        AccountGroupAccountSummary, AccountGroupCapacity, AccountGroupColor, AccountGroupListQuery,
-        AccountGroupMutation, AccountGroupPage, AccountGroupRecord, AccountGroupUsage,
-        CreateAccountGroup, DeleteAccountGroup, SetAccountGroupEnabled, UpdateAccountGroup,
+        AccountGroupMutation, AccountGroupOptionsPage, AccountGroupPage, AccountGroupRecord,
+        AccountGroupUsage, CreateAccountGroup, DeleteAccountGroup, SetAccountGroupEnabled,
+        UpdateAccountGroup,
    },
 };
 use gateway_core::{account::FastMode, routing::AccountGroupId};
@@ -212,6 +213,38 @@ struct AccountGroupPageData {
    config_revision: u64,
 }

+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "camelCase")]
+struct AccountGroupOptionsPageData {
+    items: Vec<AccountGroupRefView>,
+    page: PageMeta,
+    config_revision: u64,
+}
+
+impl From<AccountGroupOptionsPage> for AccountGroupOptionsPageData {
+    fn from(page: AccountGroupOptionsPage) -> Self {
+        let total_pages = if page.total == 0 {
+            0
+        } else {
+            page.total.div_ceil(u64::from(page.page_size))
+        };
+        Self {
+            items: page
+                .items
+                .into_iter()
+                .map(AccountGroupRefView::from)
+                .collect(),
+            page: PageMeta::new(
+                page.page,
+                u32::from(page.page_size),
+                page.total,
+                u32::try_from(total_pages).unwrap_or(u32::MAX),
+            ),
+            config_revision: page.config_revision.get(),
+        }
+    }
+}
+
 impl From<(AccountGroupPage, crate::time::TimePresenter)> for AccountGroupPageData {
    fn from((page, time): (AccountGroupPage, crate::time::TimePresenter)) -> Self {
        let total_pages = if page.total == 0 {
@@ -263,6 +296,7 @@ where
 {
    Router::new()
        .route("/api/admin/account-groups", get(list::<S>))
+        .route("/api/admin/account-groups/options", get(list_options::<S>))
        .route("/api/admin/account-groups/create", post(create::<S>))
        .route("/api/admin/account-groups/update", post(update::<S>))
        .route("/api/admin/account-groups/enable", post(enable::<S>))
@@ -270,6 +304,26 @@ where
        .route("/api/admin/account-groups/delete", post(delete::<S>))
 }

+async fn list_options<S>(
+    _auth: AdminAuth,
+    State(state): State<S>,
+    AdminQuery(query): AdminQuery<ListAccountGroupsQuery>,
+) -> Result<impl IntoResponse, AdminError>
+where
+    S: SessionState + Send + Sync,
+{
+    let result = state
+        .admin_services()
+        .account_groups()
+        .list_options(query.into_command().map_err(map_wire_error)?)
+        .await
+        .map_err(map_service_error)?;
+    Ok(AdminResponse::new(
+        StatusCode::OK,
+        AdminEnvelope::ok(AccountGroupOptionsPageData::from(result)),
+    ))
+}
+
 async fn list<S>(
    _auth: AdminAuth,
    State(state): State<S>,
@@ -308,8 +308,8 @@ pub(super) fn quota_local_usage(usage: &AccountUsage, time: crate::time::TimePre
        "inputTokensDisplay": display_optional_tokens(usage.input_tokens),
        "outputTokens": usage.output_tokens.unwrap_or_default(),
        "outputTokensDisplay": display_optional_tokens(usage.output_tokens),
-        "cachedTokens": usage.cached_tokens.unwrap_or_default(),
-        "cachedTokensDisplay": display_optional_tokens(usage.cached_tokens),
+        "cachedInputTokens": usage.cached_input_tokens.unwrap_or_default(),
+        "cachedInputTokensDisplay": display_optional_tokens(usage.cached_input_tokens),
        "imageInputTokens": usage.image_input_tokens.unwrap_or_default(),
        "imageInputTokensDisplay": display_optional_tokens(usage.image_input_tokens),
        "imageOutputTokens": usage.image_output_tokens.unwrap_or_default(),
@@ -355,10 +355,10 @@ pub(super) fn account_usage_view(
        input_tokens_display: display_optional_tokens(usage.input_tokens),
        output_tokens: usage.output_tokens,
        output_tokens_display: display_optional_tokens(usage.output_tokens),
-        cached_tokens: usage.cached_tokens,
-        cached_tokens_display: display_optional_tokens(usage.cached_tokens),
-        reasoning_tokens: usage.reasoning_tokens,
-        reasoning_tokens_display: display_optional_tokens(usage.reasoning_tokens),
+        cached_input_tokens: usage.cached_input_tokens,
+        cached_input_tokens_display: display_optional_tokens(usage.cached_input_tokens),
+        reasoning_output_tokens: usage.reasoning_output_tokens,
+        reasoning_output_tokens_display: display_optional_tokens(usage.reasoning_output_tokens),
        image_input_tokens: usage.image_input_tokens,
        image_input_tokens_display: display_optional_tokens(usage.image_input_tokens),
        image_output_tokens: usage.image_output_tokens,
@@ -369,10 +369,8 @@ pub(super) fn account_usage_view(
        image_request_failed_count_display: format_number(usage.image_request_failed_count),
        total_tokens: usage.total_tokens,
        total_tokens_display: display_optional_tokens(usage.total_tokens),
-        created_tokens: usage.cache_write_tokens,
-        created_tokens_display: display_optional_tokens(usage.cache_write_tokens),
-        read_tokens: usage.cached_tokens,
-        read_tokens_display: display_optional_tokens(usage.cached_tokens),
+        cache_write_input_tokens: usage.cache_write_input_tokens,
+        cache_write_input_tokens_display: display_optional_tokens(usage.cache_write_input_tokens),
        last_used_at: usage.last_used_at.map(|value| time.rfc3339(&value)),
        last_used_at_full_display: usage.last_used_at.map(|value| time.datetime(&value)),
        last_used_at_display: usage
@@ -429,8 +427,8 @@ pub(super) fn account_model_usage_view(
        input_tokens_display: display_optional_tokens(usage.input_tokens),
        output_tokens: usage.output_tokens,
        output_tokens_display: display_optional_tokens(usage.output_tokens),
-        cached_tokens: usage.cached_tokens,
-        cached_tokens_display: display_optional_tokens(usage.cached_tokens),
+        cached_input_tokens: usage.cached_input_tokens,
+        cached_input_tokens_display: display_optional_tokens(usage.cached_input_tokens),
        image_input_tokens: usage.image_input_tokens,
        image_input_tokens_display: display_optional_tokens(usage.image_input_tokens),
        image_output_tokens: usage.image_output_tokens,
@@ -478,10 +476,10 @@ pub(super) fn empty_account_usage() -> AccountUsageView {
        input_tokens_display: "—".to_owned(),
        output_tokens: None,
        output_tokens_display: "—".to_owned(),
-        cached_tokens: None,
-        cached_tokens_display: "—".to_owned(),
-        reasoning_tokens: None,
-        reasoning_tokens_display: "—".to_owned(),
+        cached_input_tokens: None,
+        cached_input_tokens_display: "—".to_owned(),
+        reasoning_output_tokens: None,
+        reasoning_output_tokens_display: "—".to_owned(),
        image_input_tokens: None,
        image_input_tokens_display: "—".to_owned(),
        image_output_tokens: None,
@@ -492,10 +490,8 @@ pub(super) fn empty_account_usage() -> AccountUsageView {
        image_request_failed_count_display: "—".to_owned(),
        total_tokens: None,
        total_tokens_display: "—".to_owned(),
-        created_tokens: None,
-        created_tokens_display: "—".to_owned(),
-        read_tokens: None,
-        read_tokens_display: "—".to_owned(),
+        cache_write_input_tokens: None,
+        cache_write_input_tokens_display: "—".to_owned(),
        last_used_at: None,
        last_used_at_full_display: None,
        last_used_at_display: "—".to_owned(),
@@ -435,10 +435,10 @@ pub struct AccountUsageView {
    pub input_tokens_display: String,
    pub output_tokens: Option<u64>,
    pub output_tokens_display: String,
-    pub cached_tokens: Option<u64>,
-    pub cached_tokens_display: String,
-    pub reasoning_tokens: Option<u64>,
-    pub reasoning_tokens_display: String,
+    pub cached_input_tokens: Option<u64>,
+    pub cached_input_tokens_display: String,
+    pub reasoning_output_tokens: Option<u64>,
+    pub reasoning_output_tokens_display: String,
    pub image_input_tokens: Option<u64>,
    pub image_input_tokens_display: String,
    pub image_output_tokens: Option<u64>,
@@ -449,10 +449,8 @@ pub struct AccountUsageView {
    pub image_request_failed_count_display: String,
    pub total_tokens: Option<u64>,
    pub total_tokens_display: String,
-    pub created_tokens: Option<u64>,
-    pub created_tokens_display: String,
-    pub read_tokens: Option<u64>,
-    pub read_tokens_display: String,
+    pub cache_write_input_tokens: Option<u64>,
+    pub cache_write_input_tokens_display: String,
    pub last_used_at: Option<String>,
    pub last_used_at_display: String,
    pub last_used_at_full_display: Option<String>,
@@ -477,8 +475,8 @@ pub struct ModelUsageView {
    pub input_tokens_display: String,
    pub output_tokens: Option<u64>,
    pub output_tokens_display: String,
-    pub cached_tokens: Option<u64>,
-    pub cached_tokens_display: String,
+    pub cached_input_tokens: Option<u64>,
+    pub cached_input_tokens_display: String,
    pub image_input_tokens: Option<u64>,
    pub image_input_tokens_display: String,
    pub image_output_tokens: Option<u64>,
@@ -58,9 +58,9 @@ pub(crate) fn request_metrics_view(metrics: &domain::RequestMetrics) -> RequestM
        caller_error_count: metrics.caller_error_count,
        input_tokens: metrics.input_tokens,
        output_tokens: metrics.output_tokens,
-        cached_tokens: metrics.cached_tokens,
-        cache_write_tokens: metrics.cache_write_tokens,
-        reasoning_tokens: metrics.reasoning_tokens,
+        cached_input_tokens: metrics.cached_input_tokens,
+        cache_write_input_tokens: metrics.cache_write_input_tokens,
+        reasoning_output_tokens: metrics.reasoning_output_tokens,
        total_tokens: metrics.total_tokens,
    }
 }
@@ -103,9 +103,9 @@ pub(crate) fn token_details(record: &domain::UsageRecord) -> TokenDetailsView {
    TokenDetailsView {
        input_tokens: record.input_tokens,
        output_tokens: record.output_tokens,
-        cached_tokens: record.cached_tokens,
-        cache_write_tokens: record.cache_write_tokens,
-        reasoning_tokens: record.reasoning_tokens,
+        cached_input_tokens: record.cached_input_tokens,
+        cache_write_input_tokens: record.cache_write_input_tokens,
+        reasoning_output_tokens: record.reasoning_output_tokens,
        image_input_tokens: record.image_input_tokens,
        image_output_tokens: record.image_output_tokens,
        total_tokens: record.total_tokens,
@@ -115,14 +115,14 @@ pub(crate) fn token_details(record: &domain::UsageRecord) -> TokenDetailsView {
        output_tokens_display: record
            .output_tokens
            .map_or_else(|| "-".to_owned(), format_number),
-        cached_tokens_display: record
-            .cached_tokens
+        cached_input_tokens_display: record
+            .cached_input_tokens
            .map_or_else(|| "-".to_owned(), format_compact_number),
-        cache_write_tokens_display: record
-            .cache_write_tokens
+        cache_write_input_tokens_display: record
+            .cache_write_input_tokens
            .map_or_else(|| "-".to_owned(), format_compact_number),
-        reasoning_tokens_display: record
-            .reasoning_tokens
+        reasoning_output_tokens_display: record
+            .reasoning_output_tokens
            .map_or_else(|| "-".to_owned(), format_number),
        image_input_tokens_display: record
            .image_input_tokens
@@ -140,9 +140,9 @@ pub(crate) fn usage_list_token_details(record: &domain::UsageListRecord) -> Toke
    TokenDetailsView {
        input_tokens: record.input_tokens,
        output_tokens: record.output_tokens,
-        cached_tokens: record.cached_tokens,
-        cache_write_tokens: record.cache_write_tokens,
-        reasoning_tokens: record.reasoning_tokens,
+        cached_input_tokens: record.cached_input_tokens,
+        cache_write_input_tokens: record.cache_write_input_tokens,
+        reasoning_output_tokens: record.reasoning_output_tokens,
        image_input_tokens: record.image_input_tokens,
        image_output_tokens: record.image_output_tokens,
        total_tokens: record.total_tokens,
@@ -152,14 +152,14 @@ pub(crate) fn usage_list_token_details(record: &domain::UsageListRecord) -> Toke
        output_tokens_display: record
            .output_tokens
            .map_or_else(|| "-".to_owned(), format_number),
-        cached_tokens_display: record
-            .cached_tokens
+        cached_input_tokens_display: record
+            .cached_input_tokens
            .map_or_else(|| "-".to_owned(), format_compact_number),
-        cache_write_tokens_display: record
-            .cache_write_tokens
+        cache_write_input_tokens_display: record
+            .cache_write_input_tokens
            .map_or_else(|| "-".to_owned(), format_compact_number),
-        reasoning_tokens_display: record
-            .reasoning_tokens
+        reasoning_output_tokens_display: record
+            .reasoning_output_tokens
            .map_or_else(|| "-".to_owned(), format_number),
        image_input_tokens_display: record
            .image_input_tokens
@@ -307,8 +307,14 @@ pub(crate) fn usage_list_record_view(
            first_event_ms: record.first_event_ms,
            first_reasoning_ms: record.first_reasoning_ms,
            first_text_ms: record.first_text_ms,
-            first_token_ms: record.first_token_ms,
            openai_processing_ms: record.provider_processing_ms,
+            upstream_response_ms: record.upstream_response_ms,
+            upstream_api_overhead_ms: record.upstream_api_overhead_ms,
+            upstream_engine_ms: record.upstream_engine_ms,
+            upstream_engine_iapi_ttft_ms: record.upstream_engine_iapi_ttft_ms,
+            upstream_engine_service_ttft_ms: record.upstream_engine_service_ttft_ms,
+            upstream_engine_iapi_tbt_ms: record.upstream_engine_iapi_tbt_ms,
+            upstream_engine_service_tbt_ms: record.upstream_engine_service_tbt_ms,
        },
        first_token_latency_ms: record.first_token_ms,
        latency_ms: record.latency_ms,
@@ -345,7 +351,6 @@ pub(crate) fn usage_record_view(
        .error_message
        .clone()
        .unwrap_or_else(|| outcome.clone());
-    let first_token_display = display_duration(record.first_token_ms);
    let latency_display = display_duration(record.latency_ms);
    let cost_coverage = match record.cost_source.as_str() {
        "provider_reported" | "calculated" => CostCoverageView {
@@ -409,20 +414,25 @@ pub(crate) fn usage_record_view(
            first_event_ms: record.first_event_ms,
            first_reasoning_ms: record.first_reasoning_ms,
            first_text_ms: record.first_text_ms,
-            first_token_ms: record.first_token_ms,
            openai_processing_ms: record.provider_processing_ms,
+            upstream_response_ms: record.upstream_response_ms,
+            upstream_api_overhead_ms: record.upstream_api_overhead_ms,
+            upstream_engine_ms: record.upstream_engine_ms,
+            upstream_engine_iapi_ttft_ms: record.upstream_engine_iapi_ttft_ms,
+            upstream_engine_service_ttft_ms: record.upstream_engine_service_ttft_ms,
+            upstream_engine_iapi_tbt_ms: record.upstream_engine_iapi_tbt_ms,
+            upstream_engine_service_tbt_ms: record.upstream_engine_service_tbt_ms,
        },
        attempt_index: None,
        attempt_count: u64::from(record.attempt_count),
        response_id: record.client_response_id,
        upstream_request_id: record.upstream_request_id,
        latency_ms: record.latency_ms,
-        first_token_ms: record.first_token_ms,
        input_tokens: record.input_tokens,
        output_tokens: record.output_tokens,
-        cached_tokens: record.cached_tokens,
-        cache_write_tokens: record.cache_write_tokens,
-        reasoning_tokens: record.reasoning_tokens,
+        cached_input_tokens: record.cached_input_tokens,
+        cache_write_input_tokens: record.cache_write_input_tokens,
+        reasoning_output_tokens: record.reasoning_output_tokens,
        image_input_tokens: record.image_input_tokens,
        image_output_tokens: record.image_output_tokens,
        message,
@@ -441,7 +451,6 @@ pub(crate) fn usage_record_view(
        costs,
        cost_coverage,
        first_token_latency_ms: record.first_token_ms,
-        first_token_latency_ms_display: first_token_display,
        latency_ms_display: latency_display,
        logical_outcome: outcome,
    }
@@ -517,7 +526,7 @@ pub(crate) fn usage_attempt_view(attempt: domain::UsageAttempt) -> UsageAttemptV
        estimated_cost_currency: attempt.cost_currency,
        input_tokens: attempt.input_tokens,
        output_tokens: attempt.output_tokens,
-        cached_tokens: attempt.cached_tokens,
+        cached_input_tokens: attempt.cached_input_tokens,
        total_tokens: attempt.total_tokens,
        first_token_ms: None,
        latency_ms: attempt.latency_ms,
@@ -674,8 +683,8 @@ pub(crate) fn trend_point_view(
        input_tokens_value: point.metrics.input_tokens,
        output_tokens: format_compact_number(point.metrics.output_tokens),
        output_tokens_value: point.metrics.output_tokens,
-        cached_tokens: format_compact_number(point.metrics.cached_tokens),
-        cached_tokens_value: point.metrics.cached_tokens,
+        cached_input_tokens: format_compact_number(point.metrics.cached_input_tokens),
+        cached_input_tokens_value: point.metrics.cached_input_tokens,
        cache_hit_rate_value: point.cached_token_rate,
        tokens_value: point.metrics.total_tokens,
        errors: format_compact_number(point.service_failure_count),
@@ -740,7 +749,7 @@ pub(crate) fn trend_summary_view(
            },
            TrendSummaryView {
                label: "缓存".to_owned(),
-                value: format_compact_number(summary.cached_tokens),
+                value: format_compact_number(summary.cached_input_tokens),
                ratio: None,
            },
        ],
@@ -756,7 +765,7 @@ pub(crate) fn trend_summary_view(
                ratio: None,
            },
            TrendSummaryView {
-                label: "吞吐 P50".to_owned(),
+                label: "速率 P50".to_owned(),
                value: summary
                    .minimum_output_throughput_p50
                    .map_or_else(|| "—".to_owned(), |value| format!("{value} tok/s")),
@@ -791,6 +800,7 @@ pub(crate) fn trend_view(
    time: crate::time::TimePresenter,
 ) -> TrendData {
    TrendData {
+        analytics: analytics_view(trend.analytics, time),
        kind,
        summary: trend_summary_view(kind, &trend.summary),
        points: trend
@@ -904,6 +914,7 @@ pub(crate) fn dashboard_view(
        rotation_strategy,
    } = result;
    let domain::DashboardObservation {
+        analytics,
        runtime_slots: _,
        range,
        totals,
@@ -973,6 +984,7 @@ pub(crate) fn dashboard_view(
        .saturating_sub(provider_accounts.normal);

    DashboardDataView {
+        analytics: analytics_view(analytics, time),
        as_of: range.end,
        as_of_display: time.datetime(&range.end),
        cards: DashboardCardsView {
@@ -1004,7 +1016,7 @@ pub(crate) fn dashboard_view(
                today_hit_rate_value: today.observed_cached_token_rate,
                yesterday_hit_rate_value: yesterday.observed_cached_token_rate,
                total_hit_rate: display_rate(total_cached_token_rate),
-                total_cached_tokens: format_compact_number(totals.cached_tokens),
+                total_cached_input_tokens: format_compact_number(totals.cached_input_tokens),
                average_first_token_latency_ms: display_duration(average_first_token_latency_ms),
            },
        },
@@ -1037,14 +1049,18 @@ pub(crate) fn dashboard_view(
    }
 }

-pub(crate) fn usage_summary_view(summary: domain::UsageSummary) -> UsageSummaryView {
+pub(crate) fn usage_summary_view(
+    summary: domain::UsageSummary,
+    time: crate::time::TimePresenter,
+) -> UsageSummaryView {
    let overview = summary.overview;
    UsageSummaryView {
+        analytics: analytics_view(overview.analytics, time),
        total_requests: format_compact_number(overview.requests.request_count),
        input_tokens: format_compact_number(overview.requests.input_tokens),
        output_tokens: format_compact_number(overview.requests.output_tokens),
-        cached_tokens: format_compact_number(overview.requests.cached_tokens),
-        cache_write_tokens: format_compact_number(overview.requests.cache_write_tokens),
+        cached_input_tokens: format_compact_number(overview.requests.cached_input_tokens),
+        cache_write_input_tokens: format_compact_number(overview.requests.cache_write_input_tokens),
        total_tokens: format_compact_number(overview.requests.total_tokens),
        average_latency_ms: display_duration(summary.average_latency_ms),
        logical_requests: request_metrics_view(&overview.requests),
@@ -1130,7 +1146,7 @@ pub(crate) fn usage_insights_view(
            label: time.label(point.bucket_start, "%m-%d %H:%M"),
            input_tokens: point.input_tokens,
            output_tokens: point.output_tokens,
-            cached_tokens: point.cached_tokens,
+            cached_input_tokens: point.cached_input_tokens,
            total_tokens: point.total_tokens,
            estimated_cost: point.estimated_cost.as_ref().map(ToString::to_string),
            standard_cost: point.standard_cost.as_ref().map(ToString::to_string),
@@ -1141,6 +1157,7 @@ pub(crate) fn usage_insights_view(
        })
        .collect();
    UsageInsightsOverviewView {
+        analytics: analytics_view(insights.analytics, time),
        granularity: granularity_name(insights.granularity).to_owned(),
        health: OverviewHealthView {
            total_requests: insights.health.total_requests,
@@ -1261,7 +1278,7 @@ pub(crate) fn usage_insights_view(
            cache_hit_request_rate: insights.cost.cache_hit_request_rate,
            input_tokens: insights.cost.input_tokens,
            output_tokens: insights.cost.output_tokens,
-            cached_tokens: insights.cost.cached_tokens,
+            cached_input_tokens: insights.cost.cached_input_tokens,
            total_tokens: insights.cost.total_tokens,
            points: cost_points,
            costs: cost_views(&insights.cost.costs),
@@ -1293,8 +1310,10 @@ pub(crate) fn granularity_name(granularity: domain::Granularity) -> &'static str
 pub(crate) fn diagnostics_view(
    result: domain::DiagnosticsResult,
    dimension: DiagnosticDimension,
+    time: crate::time::TimePresenter,
 ) -> DiagnosticsView {
    DiagnosticsView {
+        analytics: analytics_view(result.analytics, time),
        dimension: dimension.display_name().to_owned(),
        items: result
            .items
@@ -1347,3 +1366,22 @@ pub(crate) fn map_wire_error(error: WireValidationError) -> AdminError {
 pub(crate) fn map_service_error(error: gateway_admin::model::AdminError) -> AdminError {
    map_admin_service_error(error)
 }
+
+pub(crate) fn analytics_view(
+    metadata: domain::AnalyticsMetadata,
+    time: crate::time::TimePresenter,
+) -> AnalyticsView {
+    AnalyticsView {
+        coverage_start: metadata.coverage_start,
+        coverage_start_display: metadata.coverage_start.map(|value| time.datetime(&value)),
+        coverage_end: metadata.coverage_end,
+        coverage_end_display: metadata.coverage_end.map(|value| time.datetime(&value)),
+        generated_at: metadata.generated_at,
+        generated_at_display: time.datetime(&metadata.generated_at),
+        lag_seconds: metadata.lag_seconds,
+        state: metadata.state.as_str().to_owned(),
+        percentiles_approximate: metadata.percentiles_approximate,
+        schema_version: metadata.schema_version,
+        histogram_version: metadata.histogram_version,
+    }
+}
@@ -84,7 +84,6 @@ pub struct DiagnosticsQuery {
    pub provider: Option<String>,
    pub model: Option<String>,
    pub status_code: Option<i64>,
-    pub search: Option<String>,
 }

 impl DiagnosticsQuery {
@@ -314,6 +313,15 @@ pub(crate) fn usage_filter(query: &UsageQuery) -> Result<domain::UsageFilter, Wi
    })
 }

+pub(crate) fn analytics_filter(
+    query: &UsageQuery,
+) -> Result<domain::UsageFilter, WireValidationError> {
+    if query.search.is_some() {
+        return Err(WireValidationError::new("search"));
+    }
+    usage_filter(query)
+}
+
 pub(crate) fn usage_command(
    query: &UsageQuery,
    timezone: gateway_core::time::DeploymentTimeZone,
@@ -151,7 +151,7 @@ where
        state.admin_services().timezone(),
    )
    .map_err(map_wire_error)?;
-    let filter = usage_filter(&query).map_err(map_wire_error)?;
+    let filter = analytics_filter(&query).map_err(map_wire_error)?;
    let result = state
        .admin_services()
        .observability()
@@ -160,7 +160,10 @@ where
        .map_err(map_service_error)?;
    Ok(AdminResponse::new(
        StatusCode::OK,
-        AdminEnvelope::ok(usage_summary_view(result)),
+        AdminEnvelope::ok(usage_summary_view(
+            result,
+            crate::time::TimePresenter::new(state.admin_services().timezone()),
+        )),
    ))
 }

@@ -181,7 +184,7 @@ where
        state.admin_services().timezone(),
    )
    .map_err(map_wire_error)?;
-    let filter = usage_filter(&query).map_err(map_wire_error)?;
+    let filter = analytics_filter(&query).map_err(map_wire_error)?;
    let result = state
        .admin_services()
        .observability()
@@ -215,7 +218,6 @@ where
        provider_kind: non_empty(query.provider),
        model: non_empty(query.model),
        status_code: parse_status(query.status_code).map_err(map_wire_error)?,
-        search: non_empty(query.search),
        ..domain::UsageFilter::default()
    };
    let result = state
@@ -226,7 +228,11 @@ where
        .map_err(map_service_error)?;
    Ok(AdminResponse::new(
        StatusCode::OK,
-        AdminEnvelope::ok(diagnostics_view(result, dimension)),
+        AdminEnvelope::ok(diagnostics_view(
+            result,
+            dimension,
+            crate::time::TimePresenter::new(state.admin_services().timezone()),
+        )),
    ))
 }

@@ -18,17 +18,17 @@ pub struct PageData<T> {
 pub struct TokenDetailsView {
    pub input_tokens: Option<u64>,
    pub output_tokens: Option<u64>,
-    pub cached_tokens: Option<u64>,
-    pub cache_write_tokens: Option<u64>,
-    pub reasoning_tokens: Option<u64>,
+    pub cached_input_tokens: Option<u64>,
+    pub cache_write_input_tokens: Option<u64>,
+    pub reasoning_output_tokens: Option<u64>,
    pub image_input_tokens: Option<u64>,
    pub image_output_tokens: Option<u64>,
    pub total_tokens: Option<u64>,
    pub input_tokens_display: String,
    pub output_tokens_display: String,
-    pub cached_tokens_display: String,
-    pub cache_write_tokens_display: String,
-    pub reasoning_tokens_display: String,
+    pub cached_input_tokens_display: String,
+    pub cache_write_input_tokens_display: String,
+    pub reasoning_output_tokens_display: String,
    pub image_input_tokens_display: String,
    pub image_output_tokens_display: String,
    pub total_tokens_display: String,
@@ -160,12 +160,11 @@ pub struct UsageRecordView {
    pub response_id: Option<String>,
    pub upstream_request_id: Option<String>,
    pub latency_ms: Option<u64>,
-    pub first_token_ms: Option<u64>,
    pub input_tokens: Option<u64>,
    pub output_tokens: Option<u64>,
-    pub cached_tokens: Option<u64>,
-    pub cache_write_tokens: Option<u64>,
-    pub reasoning_tokens: Option<u64>,
+    pub cached_input_tokens: Option<u64>,
+    pub cache_write_input_tokens: Option<u64>,
+    pub reasoning_output_tokens: Option<u64>,
    pub image_input_tokens: Option<u64>,
    pub image_output_tokens: Option<u64>,
    pub message: String,
@@ -185,7 +184,6 @@ pub struct UsageRecordView {
    pub costs: Vec<CostView>,
    pub cost_coverage: CostCoverageView,
    pub first_token_latency_ms: Option<u64>,
-    pub first_token_latency_ms_display: String,
    pub latency_ms_display: String,
    pub logical_outcome: String,
 }
@@ -222,9 +220,21 @@ pub struct UsageLatencyDetailsView {
    #[serde(skip_serializing_if = "Option::is_none")]
    pub first_text_ms: Option<u64>,
    #[serde(skip_serializing_if = "Option::is_none")]
-    pub first_token_ms: Option<u64>,
-    #[serde(skip_serializing_if = "Option::is_none")]
    pub openai_processing_ms: Option<u64>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub upstream_response_ms: Option<u64>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub upstream_api_overhead_ms: Option<f64>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub upstream_engine_ms: Option<f64>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub upstream_engine_iapi_ttft_ms: Option<f64>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub upstream_engine_service_ttft_ms: Option<f64>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub upstream_engine_iapi_tbt_ms: Option<f64>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub upstream_engine_service_tbt_ms: Option<f64>,
 }

 /// 单次上游尝试展示
@@ -248,7 +258,7 @@ pub struct UsageAttemptView {
    pub estimated_cost_currency: Option<String>,
    pub input_tokens: Option<u64>,
    pub output_tokens: Option<u64>,
-    pub cached_tokens: Option<u64>,
+    pub cached_input_tokens: Option<u64>,
    pub total_tokens: Option<u64>,
    pub first_token_ms: Option<u64>,
    pub latency_ms: Option<u64>,
@@ -278,6 +288,7 @@ pub struct UsageRecordDetailView {
 #[derive(Debug, Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct TrendData {
+    pub analytics: AnalyticsView,
    pub kind: TrendKind,
    pub points: Vec<TrendPointView>,
    pub summary: Vec<TrendSummaryView>,
@@ -296,8 +307,8 @@ pub struct TrendPointView {
    pub input_tokens_value: u64,
    pub output_tokens: String,
    pub output_tokens_value: u64,
-    pub cached_tokens: String,
-    pub cached_tokens_value: u64,
+    pub cached_input_tokens: String,
+    pub cached_input_tokens_value: u64,
    pub cache_hit_rate_value: f64,
    pub tokens_value: u64,
    pub errors: String,
@@ -378,7 +389,7 @@ pub struct DashboardCacheCardView {
    pub today_hit_rate_value: Option<f64>,
    pub yesterday_hit_rate_value: Option<f64>,
    pub total_hit_rate: String,
-    pub total_cached_tokens: String,
+    pub total_cached_input_tokens: String,
    pub average_first_token_latency_ms: String,
 }

@@ -436,9 +447,9 @@ pub struct RequestMetricsView {
    pub caller_error_count: u64,
    pub input_tokens: u64,
    pub output_tokens: u64,
-    pub cached_tokens: u64,
-    pub cache_write_tokens: u64,
-    pub reasoning_tokens: u64,
+    pub cached_input_tokens: u64,
+    pub cache_write_input_tokens: u64,
+    pub reasoning_output_tokens: u64,
    pub total_tokens: u64,
 }

@@ -565,6 +576,7 @@ impl From<domain::DesktopReleaseStatus> for DashboardDesktopReleaseStatusView {
 #[derive(Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct DashboardDataView {
+    pub analytics: AnalyticsView,
    pub as_of: DateTime<Utc>,
    pub as_of_display: String,
    pub cards: DashboardCardsView,
@@ -582,11 +594,12 @@ pub struct DashboardDataView {
 #[derive(Debug, Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct UsageSummaryView {
+    pub analytics: AnalyticsView,
    pub total_requests: String,
    pub input_tokens: String,
    pub output_tokens: String,
-    pub cached_tokens: String,
-    pub cache_write_tokens: String,
+    pub cached_input_tokens: String,
+    pub cache_write_input_tokens: String,
    pub total_tokens: String,
    pub average_latency_ms: String,
    pub logical_requests: RequestMetricsView,
@@ -683,7 +696,7 @@ pub struct OverviewCostPointView {
    pub label: String,
    pub input_tokens: u64,
    pub output_tokens: u64,
-    pub cached_tokens: u64,
+    pub cached_input_tokens: u64,
    pub total_tokens: u64,
    pub estimated_cost: Option<String>,
    pub standard_cost: Option<String>,
@@ -709,7 +722,7 @@ pub struct OverviewCostView {
    pub cache_hit_request_rate: Option<f64>,
    pub input_tokens: u64,
    pub output_tokens: u64,
-    pub cached_tokens: u64,
+    pub cached_input_tokens: u64,
    pub total_tokens: u64,
    pub points: Vec<OverviewCostPointView>,
    pub costs: Vec<CostView>,
@@ -731,6 +744,7 @@ pub struct ProviderOverviewView {
 #[derive(Debug, Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct UsageInsightsOverviewView {
+    pub analytics: AnalyticsView,
    pub granularity: String,
    pub health: OverviewHealthView,
    pub performance: OverviewPerformanceView,
@@ -768,6 +782,7 @@ pub struct DiagnosticItemView {
 #[derive(Debug, Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct DiagnosticsView {
+    pub analytics: AnalyticsView,
    pub dimension: String,
    pub items: Vec<DiagnosticItemView>,
 }
@@ -842,3 +857,20 @@ pub struct OpsErrorMetadataView {
    pub recovery_retry_delay_ms: Option<u64>,
    pub recovery_total_latency_ms: Option<u64>,
 }
+
+/// 统计覆盖、新鲜度与近似口径，时间文案使用部署时区
+#[derive(Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct AnalyticsView {
+    pub coverage_start: Option<DateTime<Utc>>,
+    pub coverage_start_display: Option<String>,
+    pub coverage_end: Option<DateTime<Utc>>,
+    pub coverage_end_display: Option<String>,
+    pub generated_at: DateTime<Utc>,
+    pub generated_at_display: String,
+    pub lag_seconds: u64,
+    pub state: String,
+    pub percentiles_approximate: bool,
+    pub schema_version: u32,
+    pub histogram_version: u32,
+}
@@ -36,12 +36,12 @@ pub type ProviderRequestProfileUpdates =
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct RuntimeSettingsFields {
+    pub codex_privacy_policy: gateway_core::settings::privacy::CodexPrivacyPolicy,
    pub request_location_enabled: bool,
    pub request_location: gateway_core::account::RequestLocation,
    pub refresh_margin_seconds: u64,
    pub refresh_concurrency: u64,
    pub max_concurrent_per_account: u64,
-    pub request_interval_ms: u64,
    pub max_waiting_per_key: u32,
    pub max_waiting_per_account: u32,
    pub concurrency_wait_timeout_seconds: u32,
@@ -283,6 +283,10 @@ where
            "/api/admin/settings/client-profiles/{provider}/preview",
            post(preview_client_profile::<S>),
        )
+        .route(
+            "/api/admin/settings/privacy/preview",
+            post(preview_privacy::<S>),
+        )
        .route("/api/admin/settings/update", post(update_settings::<S>))
        .route(
            "/api/admin/settings/client-downloads/codex-desktop/windows",
@@ -719,6 +723,7 @@ impl RuntimeSettingsFields {
        self,
    ) -> Result<gateway_admin::model::settings::RuntimeSettingsValues, WireValidationError> {
        let values = gateway_admin::model::settings::RuntimeSettingsValues {
+            codex_privacy_policy: self.codex_privacy_policy,
            request_location_enabled: self.request_location_enabled,
            request_location: self
                .request_location
@@ -729,7 +734,6 @@ impl RuntimeSettingsFields {
                .map_err(|_| WireValidationError::new("settingsRefreshConcurrencyOverflow"))?,
            max_concurrent_per_account: u32::try_from(self.max_concurrent_per_account)
                .map_err(|_| WireValidationError::new("settingsMaxConcurrencyOverflow"))?,
-            request_interval_ms: self.request_interval_ms,
            max_waiting_per_key: self.max_waiting_per_key,
            max_waiting_per_account: self.max_waiting_per_account,
            concurrency_wait_timeout_seconds: self.concurrency_wait_timeout_seconds,
@@ -767,12 +771,12 @@ impl RuntimeSettingsFields {
 impl From<gateway_admin::model::settings::RuntimeSettingsValues> for RuntimeSettingsFields {
    fn from(settings: gateway_admin::model::settings::RuntimeSettingsValues) -> Self {
        crate::admin::settings::RuntimeSettingsFields {
+            codex_privacy_policy: settings.codex_privacy_policy,
            request_location_enabled: settings.request_location_enabled,
            request_location: settings.request_location,
            refresh_margin_seconds: settings.refresh_margin_seconds,
            refresh_concurrency: u64::from(settings.refresh_concurrency),
            max_concurrent_per_account: u64::from(settings.max_concurrent_per_account),
-            request_interval_ms: settings.request_interval_ms,
            max_waiting_per_key: settings.max_waiting_per_key,
            max_waiting_per_account: settings.max_waiting_per_account,
            concurrency_wait_timeout_seconds: settings.concurrency_wait_timeout_seconds,
@@ -828,7 +832,6 @@ fn settings_validation_error(field: &'static str) -> WireValidationError {
        "ops_event_retention_days" => "opsEventRetentionDays",
        "refresh_concurrency" => "refreshConcurrency",
        "refresh_margin_seconds" => "refreshMarginSeconds",
-        "request_interval_ms" => "requestIntervalMs",
        "request_location" => "requestLocation",
        "request_location_enabled" => "requestLocationEnabled",
        "responses_max_decompressed_body_bytes" => "responsesMaxDecompressedBodyBytes",
@@ -837,3 +840,23 @@ fn settings_validation_error(field: &'static str) -> WireValidationError {
        _ => "settings",
    })
 }
+
+async fn preview_privacy<S>(
+    State(state): State<S>,
+    _auth: AdminAuth,
+    AdminJson(request): AdminJson<gateway_core::settings::privacy::PrivacyPreviewRequest>,
+) -> Result<impl IntoResponse, AdminError>
+where
+    S: SessionState + Send + Sync,
+{
+    let result = state
+        .admin_services()
+        .settings()
+        .preview_privacy_policy(request)
+        .await
+        .map_err(map_service_error)?;
+    Ok(AdminResponse::new(
+        StatusCode::OK,
+        AdminEnvelope::ok(result),
+    ))
+}
@@ -114,7 +114,6 @@ struct SystemUpdateDetailView {
    notes: Option<String>,
    cached: bool,
    update_supported: bool,
-    restart_confirmation_supported: bool,
    unsupported_reason: Option<String>,
    warning: Option<String>,
 }
@@ -134,7 +133,6 @@ impl From<SystemUpdateDetail> for SystemUpdateDetailView {
            notes: detail.notes,
            cached: detail.cached,
            update_supported: detail.update_supported,
-            restart_confirmation_supported: true,
            unsupported_reason: detail.unsupported_reason,
            warning: detail.warning,
        }
@@ -138,7 +138,9 @@ where
        .login(
            payload.into(),
            peer.ip(),
-            session_cookie::value(&headers).as_deref(),
+            session_cookie::refresh_value(&headers)
+                .or_else(|| session_cookie::value(&headers))
+                .as_deref(),
        )
        .await
        .map_err(map_login_error)?;
@@ -149,8 +151,7 @@ where
        )
        .into_response(),
        &headers,
-        &result.session_id,
-        &result.session,
+        &result,
    )
 }

@@ -177,16 +178,18 @@ async fn refresh_session<S>(
 where
    S: SessionState + Send + Sync,
 {
-    let session_id = session_cookie::value(&headers);
-    let session = state
+    let grant = state
        .admin_services()
        .auth()
-        .renew_session(session_id.as_deref())
+        .renew_session(
+            session_cookie::refresh_value(&headers).as_deref(),
+            session_cookie::value(&headers).as_deref(),
+        )
        .await
        .map_err(map_admin_service_error)?;
-    let response = session_response(session.as_ref());
-    if let (Some(session_id), Some(session)) = (session_id, session) {
-        return set_session_cookie(response, &headers, &session_id, &session);
+    let response = session_response(grant.as_ref().map(|grant| &grant.session));
+    if let Some(grant) = grant {
+        return set_session_cookie(response, &headers, &grant);
    }
    // 失效响应不清 Cookie，避免晚到的请求覆盖另一个标签页刚建立的会话
    Ok(response)
@@ -206,32 +209,72 @@ fn session_response(session: Option<&AuthSession>) -> Response {
 fn set_session_cookie(
    mut response: Response,
    headers: &HeaderMap,
-    session_id: &str,
-    session: &AuthSession,
+    grant: &gateway_admin::model::auth::SessionGrant,
 ) -> Result<Response, AdminError> {
-    let max_age = session
-        .expires_at
-        .signed_duration_since(chrono::Utc::now())
-        .num_seconds()
-        .max(1);
-    let expires = session.expires_at.format("%a, %d %b %Y %H:%M:%S GMT");
-    let cookie = format!(
-        "{}={session_id}; {}; Max-Age={max_age}; Expires={expires}",
+    append_cookie(
+        &mut response,
+        headers,
        session_cookie::NAME,
-        session_cookie::attributes(headers)
-    );
-    response.headers_mut().insert(
-        header::SET_COOKIE,
-        HeaderValue::from_str(&cookie).map_err(|_| AdminError::internal())?,
-    );
+        &grant.session_id,
+        Some(grant.session.expires_at),
+    )?;
+    append_cookie(
+        &mut response,
+        headers,
+        session_cookie::REFRESH_NAME,
+        grant.refresh_token.as_deref().unwrap_or_default(),
+        grant
+            .session
+            .renewal
+            .as_ref()
+            .map(|renewal| renewal.expires_at),
+    )?;
    Ok(response)
 }

+fn append_cookie(
+    response: &mut Response,
+    headers: &HeaderMap,
+    name: &str,
+    value: &str,
+    expires_at: Option<chrono::DateTime<chrono::Utc>>,
+) -> Result<(), AdminError> {
+    let attributes = session_cookie::attributes(headers);
+    let path = if name == session_cookie::REFRESH_NAME {
+        "/api/auth"
+    } else {
+        "/"
+    };
+    let lifetime = expires_at.map_or_else(
+        || "Max-Age=0".to_owned(),
+        |expiry| {
+            format!(
+                "Max-Age={}; Expires={}",
+                expiry
+                    .signed_duration_since(chrono::Utc::now())
+                    .num_seconds()
+                    .max(1),
+                expiry.format("%a, %d %b %Y %H:%M:%S GMT")
+            )
+        },
+    );
+    response.headers_mut().append(
+        header::SET_COOKIE,
+        HeaderValue::from_str(&format!(
+            "{name}={value}; Path={path}; {attributes}; {lifetime}"
+        ))
+        .map_err(|_| AdminError::internal())?,
+    );
+    Ok(())
+}
+
 async fn logout<S>(State(state): State<S>, headers: HeaderMap) -> Result<Response, AdminError>
 where
    S: SessionState + Send + Sync,
 {
-    if let Some(session_id) = session_cookie::value(&headers) {
+    if let Some(session_id) =
+        session_cookie::refresh_value(&headers).or_else(|| session_cookie::value(&headers))
+    {
        state
            .admin_services()
            .auth()
@@ -285,15 +328,9 @@ fn clear_session_cookie(
    mut response: Response,
    headers: &HeaderMap,
 ) -> Result<Response, AdminError> {
-    let cookie = format!(
-        "{}=; {}; Max-Age=0",
-        session_cookie::NAME,
-        session_cookie::attributes(headers)
-    );
-    response.headers_mut().insert(
-        header::SET_COOKIE,
-        HeaderValue::from_str(&cookie).map_err(|_| AdminError::internal())?,
-    );
+    for name in [session_cookie::NAME, session_cookie::REFRESH_NAME] {
+        append_cookie(&mut response, headers, name, "", None)?;
+    }
    Ok(response)
 }

@@ -1,10 +1,12 @@
 //! `/healthz` 对 Core、Store 与 Host 关键 worker 健康事实的聚合

-use std::sync::Arc;
+use std::sync::{Arc, Mutex};
 use std::time::Duration;

 use axum::{extract::State, http::StatusCode};
 use futures::future::join_all;
+use gateway_core::diagnostics::{OperationalDiagnostics, OperationalFailure};
+use gateway_core::error::{ErrorDetails, ErrorSource};
 use gateway_core::health::{
    HealthProbe, HealthState, WorkerHealthKey, WorkerHealthSnapshot, WorkerHealthSource,
    WorkerRuntimeState,
@@ -19,6 +21,16 @@ const HEALTH_CHECK_TIMEOUT: Duration = Duration::from_secs(2);
 pub(crate) struct HealthStatus {
    probes: Arc<[Arc<dyn HealthProbe>]>,
    workers: Arc<dyn WorkerHealthSource>,
+    diagnostics: Arc<dyn OperationalDiagnostics>,
+    failures: Arc<Mutex<Vec<HealthFailure>>>,
+}
+
+#[derive(Clone, PartialEq, Eq, Debug, thiserror::Error)]
+#[error("{component} is {state}: {reason}")]
+struct HealthFailure {
+    component: String,
+    state: &'static str,
+    reason: String,
 }

 impl HealthStatus {
@@ -26,31 +38,93 @@ impl HealthStatus {
    pub(crate) fn new(
        probes: Vec<Arc<dyn HealthProbe>>,
        workers: Arc<dyn WorkerHealthSource>,
+        diagnostics: Arc<dyn OperationalDiagnostics>,
    ) -> Self {
        Self {
            probes: probes.into(),
            workers,
+            diagnostics,
+            failures: Arc::default(),
        }
    }

    pub(crate) async fn healthy(&self) -> bool {
-        if !self
+        let mut failures: Vec<_> = self
            .workers
            .snapshot()
-            .iter()
-            .filter(|worker| worker_affects_healthz(worker))
-            .all(worker_is_healthy)
-        {
-            return false;
-        }
-        let checks = self.probes.iter().map(|probe| probe.check());
-        tokio::time::timeout(HEALTH_CHECK_TIMEOUT, join_all(checks))
-            .await
-            .is_ok_and(|states| {
-                states
-                    .into_iter()
-                    .all(|state| matches!(state, HealthState::Healthy))
+            .into_iter()
+            .filter(|worker| worker_affects_healthz(worker) && !worker_is_healthy(worker))
+            .map(|worker| HealthFailure {
+                component: match worker.key {
+                    WorkerHealthKey::Task(id) => format!("worker:{id}"),
+                    WorkerHealthKey::Disabled(kind) => format!("worker:{kind:?}"),
+                },
+                state: "unhealthy",
+                reason: format!(
+                    "state={:?}; last_error={}",
+                    worker.state,
+                    worker.last_error.as_deref().unwrap_or("none")
+                ),
            })
+            .collect();
+        // 逐个探针共享截止时间，保留已完成结果并指出具体超时组件
+        let deadline = tokio::time::Instant::now() + HEALTH_CHECK_TIMEOUT;
+        let checks = self.probes.iter().map(|probe| async move {
+            let (state, reason) = match tokio::time::timeout_at(deadline, probe.check()).await {
+                Ok(HealthState::Healthy) => return None,
+                Ok(HealthState::Degraded(reason)) => ("degraded", reason),
+                Ok(HealthState::Unhealthy(reason)) => ("unhealthy", reason),
+                Err(_) => ("timed_out", "health probe exceeded 2s deadline".to_owned()),
+            };
+            Some(HealthFailure {
+                component: format!("probe:{}", probe.name()),
+                state,
+                reason,
+            })
+        });
+        failures.extend(join_all(checks).await.into_iter().flatten());
+        let healthy = failures.is_empty();
+        let changed = {
+            let mut previous = self
+                .failures
+                .lock()
+                .unwrap_or_else(std::sync::PoisonError::into_inner);
+            let changed = failures
+                .iter()
+                .filter(|failure| !previous.contains(failure))
+                .cloned()
+                .collect::<Vec<_>>();
+            for recovered in previous
+                .iter()
+                .filter(|old| !failures.iter().any(|new| new.component == old.component))
+            {
+                tracing::info!(component = %recovered.component, "health component recovered");
+            }
+            *previous = failures;
+            changed
+        };
+        // 只记录故障变化；使用既有有界观测队列，文件日志失效时仍有独立的运维证据
+        for failure in changed {
+            tracing::warn!(component = %failure.component, state = failure.state, "health check failed");
+            let mut event = OperationalFailure::new(
+                "health",
+                "check",
+                "health_check_failed",
+                "Health check failed",
+            );
+            event.correlation_id = Some(failure.component.clone());
+            event.details =
+                ErrorDetails::capture(Some(&ErrorSource::new(failure.clone())), None, false);
+            if self.diagnostics.record_failure(event).await.is_err() {
+                tracing::warn!("health diagnostic could not be recorded");
+                // 入队失败不能抑制下次探测的记录机会，也不改变本次健康判定
+                self.failures
+                    .lock()
+                    .unwrap_or_else(std::sync::PoisonError::into_inner)
+                    .retain(|previous| previous != &failure);
+            }
+        }
+        healthy
    }
 }

@@ -49,6 +49,7 @@ pub(super) fn config(secret: ClientKeySecret) -> ConfigView {
 #[derive(Serialize)]
 #[serde(rename_all = "camelCase")]
 pub(super) struct OverviewView {
+    analytics: crate::admin::observability::AnalyticsView,
    as_of: DateTime<Utc>,
    as_of_display: String,
    start_time: DateTime<Utc>,
@@ -82,9 +83,9 @@ struct MetricsView {
    requests: u64,
    input_tokens: u64,
    output_tokens: u64,
-    cached_tokens: u64,
-    cache_write_tokens: u64,
-    reasoning_tokens: u64,
+    cached_input_tokens: u64,
+    cache_write_input_tokens: u64,
+    reasoning_output_tokens: u64,
    total_tokens: u64,
    cost_usd: Option<String>,
    cost_incomplete: bool,
@@ -95,9 +96,9 @@ fn metrics(value: &RequestMetrics, costs: &[CurrencyCost], coverage: &CostCovera
        requests: value.request_count,
        input_tokens: value.input_tokens,
        output_tokens: value.output_tokens,
-        cached_tokens: value.cached_tokens,
-        cache_write_tokens: value.cache_write_tokens,
-        reasoning_tokens: value.reasoning_tokens,
+        cached_input_tokens: value.cached_input_tokens,
+        cache_write_input_tokens: value.cache_write_input_tokens,
+        reasoning_output_tokens: value.reasoning_output_tokens,
        total_tokens: value.total_tokens,
        cost_usd: costs
            .iter()
@@ -121,6 +122,10 @@ struct TrendPointView {
 pub(super) fn overview(value: KeyUsageOverview, time: crate::time::TimePresenter) -> OverviewView {
    let key = value.key;
    OverviewView {
+        analytics: crate::admin::observability::analytics_view(
+            value.overview.analytics.clone(),
+            time,
+        ),
        as_of: value.overview.range.end,
        as_of_display: time.time(&value.overview.range.end),
        start_time: value.overview.range.start,
@@ -201,6 +206,20 @@ pub(super) struct RecordView {
 #[derive(Default, Serialize)]
 #[serde(rename_all = "camelCase")]
 struct OutputTimingView {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    upstream_response_ms: Option<u64>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    upstream_api_overhead_ms: Option<f64>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    upstream_engine_ms: Option<f64>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    upstream_engine_iapi_ttft_ms: Option<f64>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    upstream_engine_service_ttft_ms: Option<f64>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    upstream_engine_iapi_tbt_ms: Option<f64>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    upstream_engine_service_tbt_ms: Option<f64>,
    #[serde(skip_serializing_if = "Option::is_none")]
    first_event_ms: Option<u64>,
    #[serde(skip_serializing_if = "Option::is_none")]
@@ -226,6 +245,13 @@ fn success_record(value: UsageListRecord, time: crate::time::TimePresenter) -> R
        latency_ms: value.latency_ms,
        first_token_latency_ms: value.first_token_ms,
        latency_details: OutputTimingView {
+            upstream_response_ms: value.upstream_response_ms,
+            upstream_api_overhead_ms: value.upstream_api_overhead_ms,
+            upstream_engine_ms: value.upstream_engine_ms,
+            upstream_engine_iapi_ttft_ms: value.upstream_engine_iapi_ttft_ms,
+            upstream_engine_service_ttft_ms: value.upstream_engine_service_ttft_ms,
+            upstream_engine_iapi_tbt_ms: value.upstream_engine_iapi_tbt_ms,
+            upstream_engine_service_tbt_ms: value.upstream_engine_service_tbt_ms,
            first_event_ms: value.first_event_ms,
            first_reasoning_ms: value.first_reasoning_ms,
            first_text_ms: value.first_text_ms,
@@ -190,7 +190,7 @@ pub fn initialize(
    let state = ApiState {
        admin,
        openai: OpenAiService::new(execution, lifecycle),
-        health: HealthStatus::new(probes, worker_health),
+        health: HealthStatus::new(probes, worker_health, diagnostics.clone()),
    };
    let index = config.asset_directory.join("index.html");
    let mut router = Router::new()
@@ -228,6 +228,8 @@ async fn handle(
            Ok(response.map(|body| body.map_err(|error| Box::new(error) as _).boxed_unsync()))
        })
    });
+    let request_id = context.request_id.clone();
+    let call_id = context.call_id.clone();
    let result = match plan {
        Some(plan) => plan.handle_http(context, request, next).await,
        None => next.run(request).await,
@@ -251,7 +253,18 @@ async fn handle(
                    tokio::select! {
                        biased;
                        () = cancellation.cancelled() => {},
-                        _ = task => {},
+                        result = task => {
+                            if let Err(contract::upgrade::SessionError::Failed { kind, plugin_instance_id }) = result {
+                                tracing::warn!(
+                                    event = "middleware.session.failed",
+                                    request_id,
+                                    call_id,
+                                    plugin_instance_id,
+                                    kind,
+                                    "升级后的中间件会话失败"
+                                );
+                            }
+                        },
                    }
                });
            }
@@ -62,7 +62,7 @@ where
                let started = match service
                    .start_prepared_provider_endpoint(
                        prepared, operation,
-                        // 图像/搜索等原生端点没有对应的上游模型权限。
+                        // 原生端点的模型语义由 Provider 从正文提取并检查账号政策
                        None, client_ip, user_agent, endpoint,
                    )
                    .await
@@ -19,6 +19,9 @@ use gateway_core::{
    error::GatewayError,
 };

+pub(crate) const SSE_KEEPALIVE_INTERVAL: std::time::Duration = std::time::Duration::from_secs(15);
+pub(crate) const SSE_KEEPALIVE_FRAME: Bytes = Bytes::from_static(b": keep-alive\n\n");
+
 /// 只读目录/用量与协议错误共用的单帧响应；没有 Provider attempt 或计量副作用
 pub(crate) async fn buffered_response(
    protocol: &str,
@@ -161,8 +164,8 @@ pub(crate) async fn into_http_response(
        let chunk = tokio::select! {
            biased;
            chunk = stream.next() => chunk?,
-            () = tokio::time::sleep(std::time::Duration::from_secs(15)), if keep_alive => {
-                Ok(Bytes::from_static(b": keep-alive\n\n"))
+            () = tokio::time::sleep(SSE_KEEPALIVE_INTERVAL), if keep_alive => {
+                Ok(SSE_KEEPALIVE_FRAME)
            }
        };
        Some((chunk, stream))
@@ -4,6 +4,9 @@ mod http;
 mod request;
 mod session;

-pub(crate) use http::{ExpectedBody, buffered_response, error_response, into_http_response};
+pub(crate) use http::{
+    ExpectedBody, SSE_KEEPALIVE_FRAME, SSE_KEEPALIVE_INTERVAL, buffered_response, error_response,
+    into_http_response,
+};
 pub(crate) use request::{RequestInput, invoke_request, query_response, request_parts};
 pub(crate) use session::{PendingExecution, finalize_session, pending_execution_response};
@@ -86,7 +86,9 @@ async fn models_response(
            .iter()
            .enumerate()
            .map(|(index, entry)| match entry {
-                PublicModelDescriptor::Adapted(profile) => Ok(codex_model_json(profile, index)),
+                PublicModelDescriptor::Adapted(profile) => {
+                    Ok(adapted_codex_model_json(profile, index))
+                }
                PublicModelDescriptor::Native { model, payload } => {
                    if payload.protocol() != "codex" {
                        return Err(());
@@ -192,7 +194,7 @@ fn openai_model_json(id: &str) -> Value {
    })
 }

-fn codex_model_json(profile: &PublicModelProfile, index: usize) -> Value {
+fn adapted_codex_model_json(profile: &PublicModelProfile, index: usize) -> Value {
    let id = profile.model().as_str();
    let presentation = profile.presentation();
    let reasoning_levels = presentation
@@ -265,6 +267,8 @@ fn codex_model_json(profile: &PublicModelProfile, index: usize) -> Value {
        "experimental_supported_tools": [],
        "input_modalities": input_modalities,
        "supports_search_tool": presentation.search_tool(),
+        // 通用画像没有 Responses Lite 支持依据，避免客户端启用未经声明的协议行为
+        // 原生目录由 Native 分支保留上游字段，不经过此处
        "use_responses_lite": false,
    })
 }
@@ -141,6 +141,7 @@ pub(crate) async fn execute_prepared_responses(
    let cancellation = prepared.cancellation();
    let started_request_id = Arc::new(OnceLock::new());
    let terminal_request_id = Arc::clone(&started_request_id);
+    let (admitted, keepalive) = tokio::sync::oneshot::channel();
    let mut middleware_headers = headers.clone();
    // 中间件正文已经由入口按上限解压；传输编码和旧长度不能与改写后的正文混用
    middleware_headers.remove(CONTENT_ENCODING);
@@ -213,37 +214,45 @@ pub(crate) async fn execute_prepared_responses(
                    .session
                    .trace()
                    .capture("client.request.body", &request_body);
+                let _ = admitted.send(started.session.response_commit());
                execution_middleware_response(started, connection_guard, terminal_validation).await
            })
        }),
    );
-    let middleware = if let Some(authorization) = authorization.as_ref() {
-        match await_with_authorization(middleware, authorization, &cancellation).await {
-            Ok(result) => result,
-            Err(error) => Err(MiddlewareError::Gateway(error)),
+    let response = async move {
+        let middleware = if let Some(authorization) = authorization.as_ref() {
+            match await_with_authorization(middleware, authorization, &cancellation).await {
+                Ok(result) => result,
+                Err(error) => Err(MiddlewareError::Gateway(error)),
+            }
+        } else {
+            middleware.await
+        };
+        let expected = if stream {
+            ExpectedBody::Sse
+        } else {
+            ExpectedBody::SingleJson
+        };
+        match middleware {
+            Ok(response) => {
+                let response = if let Some(authorization) = authorization {
+                    authorized_middleware_response(response, authorization, cancellation)
+                } else {
+                    response
+                };
+                into_http_response(
+                    validated_middleware_response(response, validation, stream),
+                    expected,
+                )
+                .await
+            }
+            Err(error) => error_response(error),
        }
-    } else {
-        middleware.await
    };
-    let expected = if stream {
-        ExpectedBody::Sse
+    let response = if stream {
+        super::keepalive::response(response, keepalive).await
    } else {
-        ExpectedBody::SingleJson
-    };
-    let response = match middleware {
-        Ok(response) => {
-            let response = if let Some(authorization) = authorization {
-                authorized_middleware_response(response, authorization, cancellation)
-            } else {
-                response
-            };
-            into_http_response(
-                validated_middleware_response(response, validation, stream),
-                expected,
-            )
-            .await
-        }
-        Err(error) => error_response(error),
+        response.await
    };
    super::super::with_model_request_id(response, started_request_id.get().unwrap_or(&request_id))
 }
@@ -519,16 +528,24 @@ pub async fn stream_execution_response(
    session: Box<dyn ExecutionSession>,
    connection_guard: Option<Box<dyn ConnectionGuard>>,
 ) -> Response {
-    match streaming_execution_middleware_response(
-        session,
-        connection_guard,
-        ResponseValidationFacts::default(),
+    let (admitted, keepalive) = tokio::sync::oneshot::channel();
+    let _ = admitted.send(session.response_commit());
+    super::keepalive::response(
+        async move {
+            match streaming_execution_middleware_response(
+                session,
+                connection_guard,
+                ResponseValidationFacts::default(),
+            )
+            .await
+            {
+                Ok(response) => into_http_response(response, ExpectedBody::Sse).await,
+                Err(error) => error_response(error),
+            }
+        },
+        keepalive,
    )
    .await
-    {
-        Ok(response) => into_http_response(response, ExpectedBody::Sse).await,
-        Err(error) => error_response(error),
-    }
 }

 fn validated_middleware_response(
@@ -0,0 +1,151 @@
+//! 准入成功后覆盖 Responses 首帧等待；已发心跳的 HTTP 错误转为流内失败
+
+use std::future::Future;
+
+use axum::{
+    body::{Body, BodyDataStream, Bytes, to_bytes},
+    http::{HeaderValue, StatusCode, header},
+    response::Response,
+};
+use futures::{StreamExt as _, future::BoxFuture, stream};
+use gateway_core::engine::execution::ResponseCommit;
+use gateway_protocol::openai::sse::{
+    DONE_SSE_FRAME, encode_sse_event, response_failed_sse_data_from_error_event,
+    response_failed_sse_data_with_id,
+};
+use serde_json::Value;
+use tokio::sync::oneshot;
+
+use crate::openai::middleware::{SSE_KEEPALIVE_FRAME, SSE_KEEPALIVE_INTERVAL};
+
+pub(super) async fn response(
+    response: impl Future<Output = Response> + Send + 'static,
+    admitted: oneshot::Receiver<ResponseCommit>,
+) -> Response {
+    let mut response = Box::pin(response);
+    // 鉴权、模型门禁和准入失败仍保留原 HTTP 状态，不提前建立 SSE
+    let commit = tokio::select! {
+        biased;
+        response = &mut response => return response,
+        admitted = admitted => match admitted {
+            Ok(commit) => commit,
+            Err(_) => return response.await,
+        },
+    };
+    tokio::select! {
+        biased;
+        response = &mut response => return response,
+        () = tokio::time::sleep(SSE_KEEPALIVE_INTERVAL) => {}
+    }
+    if !commit.record(Some(StatusCode::OK.as_u16())) {
+        return response.await;
+    }
+    let pending = PendingResponse::Waiting(response);
+    let stream = stream::once(async { Ok::<_, axum::Error>(SSE_KEEPALIVE_FRAME) })
+        .chain(stream::try_unfold(pending, PendingResponse::next));
+    let mut response = Response::new(Body::from_stream(stream));
+    let headers = response.headers_mut();
+    headers.insert(
+        header::CONTENT_TYPE,
+        HeaderValue::from_static("text/event-stream"),
+    );
+    headers.insert(
+        header::CACHE_CONTROL,
+        HeaderValue::from_static("no-cache, no-transform"),
+    );
+    headers.insert("x-accel-buffering", HeaderValue::from_static("no"));
+    response
+}
+
+enum PendingResponse {
+    Waiting(BoxFuture<'static, Response>),
+    Streaming(BodyDataStream),
+}
+
+impl PendingResponse {
+    async fn next(mut self) -> Result<Option<(Bytes, Self)>, axum::Error> {
+        loop {
+            match &mut self {
+                Self::Waiting(response) => {
+                    // 心跳只轮询同一个 future，不取消重建首帧等待或插件调用
+                    let response = tokio::select! {
+                        biased;
+                        response = response => response,
+                        () = tokio::time::sleep(SSE_KEEPALIVE_INTERVAL) => return Ok(Some((SSE_KEEPALIVE_FRAME, self))),
+                    };
+                    let sse = response.status().is_success()
+                        && response
+                            .headers()
+                            .get(header::CONTENT_TYPE)
+                            .and_then(|value| value.to_str().ok())
+                            .and_then(|value| value.split(';').next())
+                            .is_some_and(|value| {
+                                value.trim().eq_ignore_ascii_case("text/event-stream")
+                            });
+                    let body = if sse {
+                        response.into_body()
+                    } else {
+                        stream_failure(response).await
+                    };
+                    // 正式响应的正文已经带有交付期心跳，后续只转交，不叠加定时器
+                    self = Self::Streaming(body.into_data_stream());
+                }
+                Self::Streaming(body) => {
+                    return body
+                        .next()
+                        .await
+                        .transpose()
+                        .map(|chunk| chunk.map(|chunk| (chunk, self)));
+                }
+            }
+        }
+    }
+}
+
+async fn stream_failure(response: Response) -> Body {
+    let status = response.status();
+    let retry_after = response
+        .headers()
+        .get(header::RETRY_AFTER)
+        .and_then(|value| value.to_str().ok())
+        .map(ToOwned::to_owned);
+    let bytes = to_bytes(response.into_body(), usize::MAX)
+        .await
+        .unwrap_or_default();
+    let json = serde_json::from_slice::<Value>(&bytes).ok();
+    let raw_message = std::str::from_utf8(&bytes)
+        .ok()
+        .map(str::trim)
+        .filter(|text| !text.is_empty());
+    // 已完成客户端错误投影的对象原样保留，包括重试建议和策略错误的扩展字段
+    let mut data = json
+        .as_ref()
+        .and_then(|json| response_failed_sse_data_from_error_event(None, None, json))
+        .unwrap_or_else(|| {
+            response_failed_sse_data_with_id(
+                None,
+                "server_error",
+                "upstream_error",
+                raw_message.unwrap_or_else(|| {
+                    status
+                        .canonical_reason()
+                        .unwrap_or("Response stream failed")
+                }),
+            )
+        });
+    // HTTP 头已提交，按官方 SSE 错误合同保留允许下发的重试建议
+    if let Some(retry_after) = retry_after
+        && let Some(error) = data["response"]["error"].as_object_mut()
+        && let Some(headers) = error
+            .entry("headers")
+            .or_insert_with(|| serde_json::json!({}))
+            .as_object_mut()
+    {
+        headers
+            .entry("retry-after")
+            .or_insert(Value::String(retry_after));
+    }
+    let mut event = encode_sse_event("response.failed", &data.to_string());
+    event.push_str(DONE_SSE_FRAME);
+    Body::from(event)
+}
@@ -2,6 +2,7 @@

 mod error;
 mod http;
+mod keepalive;
 mod request;
 mod response;
 mod validation;
@@ -95,15 +95,25 @@ impl OpenAiRequestHeaders {
        }
    }

-    /// 独立端点只消费会话身份与 turn metadata，不携带 Responses 的连接状态
+    /// 独立端点保留业务扩展头与会话身份，不携带 Responses 的连接状态
    pub(crate) fn session_context(&self) -> Map<String, Value> {
        let mut context = Map::new();
        insert_protocol_context(&mut context, "session_id", self.session_id.as_ref());
        insert_protocol_context(&mut context, "thread_id", self.thread_id.as_ref());
        insert_protocol_context(&mut context, "turn_metadata", self.turn_metadata.as_ref());
+        self.insert_passthrough_headers(&mut context);
        context
    }

+    fn insert_passthrough_headers(&self, context: &mut Map<String, Value>) {
+        if !self.passthrough_headers.is_empty() {
+            context.insert(
+                PASSTHROUGH_HEADERS_CONTEXT_KEY.to_owned(),
+                Value::Array(self.passthrough_headers.clone()),
+            );
+        }
+    }
+
    fn protocol_context(
        &self,
        use_websocket: Option<bool>,
@@ -153,12 +163,7 @@ impl OpenAiRequestHeaders {
        insert_protocol_context(&mut context, "turn_id", self.turn_id.as_ref());
        insert_protocol_context(&mut context, "responses_lite", self.responses_lite.as_ref());
        insert_protocol_context(&mut context, "memgen_request", self.memgen_request.as_ref());
-        if !self.passthrough_headers.is_empty() {
-            context.insert(
-                PASSTHROUGH_HEADERS_CONTEXT_KEY.to_owned(),
-                Value::Array(self.passthrough_headers.clone()),
-            );
-        }
+        self.insert_passthrough_headers(&mut context);
        if let Some(use_websocket) = use_websocket {
            context.insert("use_websocket".to_owned(), Value::Bool(use_websocket));
        }
@@ -47,7 +47,7 @@ impl OpenAiResponsesEncoder {
            return Vec::new();
        };
        self.observe_wire(wire);
-        let projected = client_failure_payload(wire);
+        let projected = client_payload(wire);
        let data = projected.as_ref().unwrap_or_else(|| wire.data());
        // 当前 Codex 不消费 Responses `error` event，会在 EOF 时丢失失败原因
        // 在客户端 SSE 边界统一投影成它能识别的 `response.failed`
@@ -70,22 +70,29 @@ impl OpenAiResponsesEncoder {
        {
            return vec![raw_sse_frame.clone()];
        }
+        let data = if projected.is_none() {
+            wire.raw_websocket_message()
+                .map(str::to_owned)
+                .unwrap_or_else(|| data.to_string())
+        } else {
+            data.to_string()
+        };
        vec![Bytes::from(encode_sse_event_with_metadata(
            effective_event_type(wire).unwrap_or_default(),
-            &data.to_string(),
+            &data,
            wire.sse_id(),
            wire.sse_retry(),
        ))]
    }

-    /// 消费一个 Provider event，并返回 WebSocket JSON messages
+    /// 消费一个 Provider event，并返回完整 WebSocket 文本消息
    pub fn push_websocket(&mut self, event: &ProviderEvent) -> Vec<String> {
        self.observe_canonical_identity(event);
-        let Some(wire) = openai_wire(event).filter(|wire| wire.has_json_data()) else {
+        let Some(wire) = openai_wire(event) else {
            return Vec::new();
        };
        self.observe_wire(wire);
-        let projected = client_failure_payload(wire);
+        let projected = client_payload(wire);
        let data = projected.as_ref().unwrap_or_else(|| wire.data());
        // WS 客户端只对它无法消费的裸 `error` 帧做投影：codex 的 WS 端点
        // 会静默忽略缺少 status 且不含内置可重试错误码的 `error` 帧，客户
@@ -104,6 +111,14 @@ impl OpenAiResponsesEncoder {
        {
            return vec![data.to_string()];
        }
+        if projected.is_none()
+            && let Some(raw) = wire.raw_websocket_message()
+        {
+            return vec![raw.to_owned()];
+        }
+        if !wire.has_json_data() {
+            return Vec::new();
+        }
        vec![data.to_string()]
    }

@@ -248,15 +263,43 @@ fn effective_event_type(wire: &ProtocolWireEvent) -> Option<&str> {
        .or_else(|| wire.data().get("type").and_then(Value::as_str))
 }

-fn client_failure_payload(wire: &ProtocolWireEvent) -> Option<Value> {
+fn client_payload(wire: &ProtocolWireEvent) -> Option<Value> {
    if matches!(
        effective_event_type(wire),
        Some("error" | "response.failed")
    ) {
-        capacity_error_for_client(wire.data())
-    } else {
-        None
+        return capacity_error_for_client(wire.data());
    }
+    if !matches!(
+        effective_event_type(wire),
+        Some("response.metadata" | "codex.response.metadata")
+    ) {
+        return None;
+    }
+    let headers = wire.data().get("headers")?.as_object()?;
+    let connection_options: Vec<String> = headers
+        .iter()
+        .filter(|(name, _)| name.eq_ignore_ascii_case("connection"))
+        .flat_map(|(_, value)| match value {
+            Value::Array(values) => values.iter().filter_map(Value::as_str).collect::<Vec<_>>(),
+            _ => value.as_str().into_iter().collect(),
+        })
+        .flat_map(|value| value.split(','))
+        .map(|name| name.trim().to_ascii_lowercase())
+        .collect();
+    if headers
+        .keys()
+        .all(|name| super::response_header_is_forwardable(name, &connection_options))
+    {
+        return None;
+    }
+    // 只剥离既有响应头隔离策略禁止的字段，metadata 业务扩展保持不透明
+    let mut projected = wire.data().clone();
+    projected
+        .get_mut("headers")?
+        .as_object_mut()?
+        .retain(|name, _| super::response_header_is_forwardable(name, &connection_options));
+    Some(projected)
 }

 /// 判断 WS 上游的 `error` 帧是否已经是客户端可直接消费的形状
@@ -209,6 +209,11 @@ impl ResponsesDeliveryValidator {
        transformed: bool,
        facts: &ResponseValidationFacts,
    ) -> Result<(), ResponseValidationError> {
+        // 未改写的未知载荷不参与本地关联判断，不能因旁路解析失败截断原流
+        // 插件实际改写的载荷仍须满足交付合同
+        if parsed.is_err() && !transformed {
+            return Ok(());
+        }
        if !self.active && !transformed {
            if parsed.and_then(|frame| self.state.apply(frame)).is_err() {
                self.invalid_prefix = true;
@@ -253,7 +258,7 @@ impl ResponsesDeliveryValidator {
                    return Err(ResponseValidationError);
                }
            }
-            ParsedFrame::Event { .. } | ParsedFrame::Done => {}
+            ParsedFrame::Event { .. } | ParsedFrame::Done | ParsedFrame::NonEvent => {}
        }
        self.state.apply(parsed)
    }
@@ -292,6 +297,7 @@ impl ResponsesDeliveryValidator {
 enum ParsedFrame {
    Event { event_type: String, value: Value },
    Done,
+    NonEvent,
 }

 impl ParsedFrame {
@@ -301,6 +307,10 @@ impl ParsedFrame {
            return Ok(Self::Done);
        }
        let mut events = parse_sse_events(frame).map_err(|_| ResponseValidationError)?;
+        // 注释和仅含 SSE 元数据的帧不承载响应业务事实
+        if events.is_empty() {
+            return Ok(Self::NonEvent);
+        }
        if events.len() != 1 {
            return Err(ResponseValidationError);
        }
@@ -363,6 +373,9 @@ struct DeliveryState {

 impl DeliveryState {
    fn apply(&mut self, frame: ParsedFrame) -> Result<(), ResponseValidationError> {
+        if matches!(frame, ParsedFrame::NonEvent) {
+            return Ok(());
+        }
        if self.done {
            return Err(ResponseValidationError);
        }
@@ -12,7 +12,7 @@ use gateway_core::engine::middleware::{
    MiddlewareBody, MiddlewareError, MiddlewareFrame, MiddlewareFraming, MiddlewareHeader,
    MiddlewareResponse,
 };
-use gateway_core::engine::response_control::ResponseControl;
+use gateway_core::engine::response_control::{ResponseControl, ResponseControlUnavailable};
 use gateway_core::error::{GatewayError, GatewayErrorKind};
 use gateway_core::event::ProviderResponseHeader;
 use gateway_core::operation::ProviderSessionState;
@@ -25,7 +25,7 @@ use super::{
    super::{DecodedResponsesRequest, OpenAiResponsesEncoder, ProtocolErrorBody},
    connection::{ConnectionEvent, FramePhase, ResponsesWebSocketConnection, WriteContext},
    protocol::{
-        decode_response_interrupt, error_event, initial_engine_error_event, response_metadata_event,
+        error_event, initial_engine_error_event, is_response_create, response_metadata_event,
    },
 };

@@ -137,7 +137,7 @@ pub(super) async fn forward_response(
    replay: &mut ConnectionReplaySnapshot,
    capture: ReplayCaptureHandle,
    validation: ResponseValidationFacts,
-    response_control: ResponseControl,
+    response_control: &ResponseControl,
 ) -> ForwardOutcome {
    let (protocol, status, headers, mut body, _) = response.into_parts();
    if protocol != "openai" || StatusCode::from_u16(status).is_err() {
@@ -150,8 +150,16 @@ pub(super) async fn forward_response(
            ProviderResponseHeader::new(name, value)
        })
        .collect::<Vec<_>>();
-    let first = match next_body_input(connection, body.as_mut(), &response_control, &request_id)
-        .await
+    let mut interrupt = super::interrupt::ResponseInterrupt::default();
+    let first = match next_body_input(
+        connection,
+        body.as_mut(),
+        response_control,
+        &mut interrupt,
+        &request_id,
+        false,
+    )
+    .await
    {
        BodyInput::Frame(Ok(Some(frame))) => frame,
        BodyInput::Frame(Ok(None)) => {
@@ -197,8 +205,15 @@ pub(super) async fn forward_response(
        let frame = match current.take() {
            Some(frame) => frame,
            None => {
-                match next_body_input(connection, body.as_mut(), &response_control, &request_id)
-                    .await
+                match next_body_input(
+                    connection,
+                    body.as_mut(),
+                    response_control,
+                    &mut interrupt,
+                    &request_id,
+                    terminal_seen,
+                )
+                .await
                {
                    BodyInput::Frame(Ok(Some(frame))) => frame,
                    BodyInput::Frame(Ok(None)) if terminal_seen && body.is_finalized() => {
@@ -262,11 +277,24 @@ pub(super) async fn forward_response(
            (true, true) => FramePhase::Terminal,
            (true, false) => FramePhase::Data,
        };
+        let created_id = super::interrupt::ResponseInterrupt::created_id(&message);
        match connection
            .send_text(message, WriteContext::request(&request_id, phase))
            .await
        {
-            Ok(super::connection::WriteOutcome::Written) => first_frame_written = true,
+            Ok(super::connection::WriteOutcome::Written) => {
+                first_frame_written = true;
+                if let Some(id) = created_id {
+                    interrupt.observe_created(id, response_control);
+                    tokio::select! {
+                        _ = connection.wait_for_exit() => {
+                            detach_body(body);
+                            return ForwardOutcome::Disconnect;
+                        }
+                        () = interrupt.forward_pending(response_control) => {}
+                    }
+                }
+            }
            Ok(super::connection::WriteOutcome::Suppressed) => {}
            Err(_) => {
                detach_body(body);
@@ -284,8 +312,10 @@ fn detach_body(body: Box<dyn MiddlewareBody>) {
 }

 fn validate_frame(frame: &MiddlewareFrame) -> Result<(), MiddlewareError> {
-    if frame.framing() != MiddlewareFraming::JsonDocument
-        || serde_json::from_slice::<serde::de::IgnoredAny>(frame.bytes()).is_err()
+    if !matches!(
+        frame.framing(),
+        MiddlewareFraming::JsonDocument | MiddlewareFraming::RawBytes
+    ) || std::str::from_utf8(frame.bytes()).is_err()
    {
        return Err(MiddlewareError::InvalidState);
    }
@@ -301,7 +331,9 @@ async fn next_body_input(
    connection: &mut ResponsesWebSocketConnection,
    body: &mut dyn MiddlewareBody,
    response_control: &ResponseControl,
+    interrupt: &mut super::interrupt::ResponseInterrupt,
    request_id: &Arc<str>,
+    terminal_seen: bool,
 ) -> BodyInput {
    // 处理控制帧时继续持有同一个读取 future，不能取消正在加工正文的中间件
    let frame = body.next_frame();
@@ -312,19 +344,18 @@ async fn next_body_input(
                let Some(event) = event else { return BodyInput::Disconnect; };
                match &event.event {
                    ConnectionEvent::Text(payload) => {
-                        let error = match decode_response_interrupt(payload) {
-                            Ok(Some(response_id)) => response_control.interrupt(&response_id).err().map(|_| {
-                                super::super::RequestDecodeError::InvalidValue { field: "response_id".to_owned() }.protocol_body()
-                            }),
-                            Ok(None) => {
-                                connection.defer(event);
-                                continue;
+                        if is_response_create(payload) {
+                            connection.defer(event);
+                            continue;
+                        }
+                        if !terminal_seen && interrupt.retain(payload) {
+                            tokio::select! {
+                                _ = connection.wait_for_exit() => return BodyInput::Disconnect,
+                                () = interrupt.forward_pending(response_control) => {}
                            }
-                            Err(error) => Some(error.protocol_body()),
-                        };
-                        if let Some(error) = error
-                            && send_protocol_error(connection, StatusCode::BAD_REQUEST, error, request_id).await == ForwardOutcome::Disconnect
-                        {
+                            continue;
+                        }
+                        if send_control(connection, response_control, payload, request_id).await == ForwardOutcome::Disconnect {
                            return BodyInput::Disconnect;
                        }
                    }
@@ -337,6 +368,11 @@ async fn next_body_input(
                    ConnectionEvent::Exited(_) => return BodyInput::Disconnect,
                }
            }
+            event = response_control.receive(), if terminal_seen => {
+                if forward_control_event(connection, response_control, event).await == ForwardOutcome::Disconnect {
+                    return BodyInput::Disconnect;
+                }
+            }
            frame = &mut frame => return BodyInput::Frame(frame),
        }
    }
@@ -537,19 +573,26 @@ impl WebSocketExecutionBody {
                    self.transformed_pending = transformed;
                    continue;
                }
-                messages.extend(encoded.into_iter().map(|message| (message, transformed)));
+                let framing = if event.wire_event().is_some_and(|wire| {
+                    wire.raw_websocket_message().is_some() && !wire.has_json_data()
+                }) {
+                    MiddlewareFraming::RawBytes
+                } else {
+                    MiddlewareFraming::JsonDocument
+                };
+                messages.extend(
+                    encoded
+                        .into_iter()
+                        .map(|message| (message, transformed, framing)),
+                );
                self.transformed_pending = false;
            }
            let terminal = self.encoder.is_completed() || self.encoder.has_wire_failure();
            let last = messages.len().saturating_sub(1);
            self.pending.extend(messages.into_iter().enumerate().map(
-                |(index, (message, transformed))| {
-                    MiddlewareFrame::new(
-                        Bytes::from(message),
-                        MiddlewareFraming::JsonDocument,
-                        terminal && index == last,
-                    )
-                    .with_transformed(transformed)
+                |(index, (message, transformed, framing))| {
+                    MiddlewareFrame::new(Bytes::from(message), framing, terminal && index == last)
+                        .with_transformed(transformed)
                },
            ));
            self.awaiting_terminal_eof = terminal;
@@ -720,3 +763,46 @@ async fn send_metadata(
        .await
        .is_ok()
 }
+
+pub(super) async fn send_control(
+    connection: &mut ResponsesWebSocketConnection,
+    control: &ResponseControl,
+    payload: &str,
+    request_id: &Arc<str>,
+) -> ForwardOutcome {
+    let result = tokio::select! {
+        _ = connection.wait_for_exit() => return ForwardOutcome::Disconnect,
+        result = control.send(payload) => result,
+    };
+    if result.is_err() {
+        return send_gateway_error(
+            connection,
+            &GatewayError::new(
+                GatewayErrorKind::InvalidRequest,
+                "No upstream WebSocket connection is available for control messages",
+            ),
+            request_id,
+        )
+        .await;
+    }
+    ForwardOutcome::Continue
+}
+
+pub(super) async fn forward_control_event(
+    connection: &mut ResponsesWebSocketConnection,
+    control: &ResponseControl,
+    event: Result<String, ResponseControlUnavailable>,
+) -> ForwardOutcome {
+    let Ok(payload) = event else {
+        control.clear();
+        return ForwardOutcome::Continue;
+    };
+    if connection
+        .send_text(payload, WriteContext::connection(FramePhase::Data))
+        .await
+        .is_err()
+    {
+        return ForwardOutcome::Disconnect;
+    }
+    ForwardOutcome::Continue
+}
@@ -0,0 +1,91 @@
+//! 当前逻辑响应的中断意图，跨重试连接保留并随新响应 ID 转发
+
+use std::{borrow::Cow, collections::BTreeSet};
+
+use gateway_core::engine::response_control::{ResponseControl, ResponseControlBinding};
+use serde::Deserialize;
+use serde_json::Value;
+
+#[derive(Deserialize)]
+struct EventIdentity<'a> {
+    #[serde(rename = "type", borrow)]
+    event_type: Cow<'a, str>,
+    #[serde(borrow)]
+    response: Option<ResponseIdentity<'a>>,
+}
+
+#[derive(Deserialize)]
+struct ResponseIdentity<'a> {
+    #[serde(borrow)]
+    id: Cow<'a, str>,
+}
+
+#[derive(Default)]
+pub(super) struct ResponseInterrupt {
+    delivered_ids: BTreeSet<String>,
+    current: Option<(String, ResponseControlBinding)>,
+    pending: Option<Value>,
+    sent: bool,
+}
+
+impl ResponseInterrupt {
+    pub(super) fn created_id(payload: &str) -> Option<String> {
+        let event: EventIdentity<'_> = serde_json::from_str(payload).ok()?;
+        (event.event_type == "response.created").then_some(())?;
+        Some(event.response?.id.into_owned())
+    }
+
+    /// 只在 created 实际写入下游后更新，不能把未交付的 ID 当成客户端目标
+    pub(super) fn observe_created(&mut self, id: String, control: &ResponseControl) {
+        let Some(binding) = control.binding() else {
+            return;
+        };
+        if self
+            .current
+            .as_ref()
+            .is_none_or(|(previous, old)| previous != &id || !old.same_binding(&binding))
+        {
+            self.sent = false;
+        }
+        self.delivered_ids.insert(id.clone());
+        self.current = Some((id, binding));
+    }
+
+    /// 未知控制消息、模式和其他逻辑响应的 ID 仍走原始透明通道
+    pub(super) fn retain(&mut self, payload: &str) -> bool {
+        let Ok(event) = serde_json::from_str::<Value>(payload) else {
+            return false;
+        };
+        if event["type"] != "response.interrupt"
+            || event["mode"] != "discard_partial_items"
+            || !event["response_id"]
+                .as_str()
+                .is_some_and(|id| self.delivered_ids.contains(id))
+        {
+            return false;
+        }
+        self.pending = Some(event);
+        self.sent = false;
+        true
+    }
+
+    pub(super) async fn forward_pending(&mut self, control: &ResponseControl) {
+        if self.sent {
+            return;
+        }
+        let (Some(payload), Some((id, binding))) = (&mut self.pending, &self.current) else {
+            return;
+        };
+        // 换号已绑定、created 尚未交付时等待新 ID；连接快照保证 await 期间也不会串号
+        if !control
+            .binding()
+            .is_some_and(|current| binding.same_binding(&current))
+        {
+            return;
+        }
+        payload["response_id"] = Value::String(id.clone());
+        if binding.send(&payload.to_string()).await.is_ok() {
+            self.sent = true;
+        }
+    }
+}
@@ -2,6 +2,7 @@

 pub mod connection;
 mod forward;
+mod interrupt;
 mod protocol;

 use std::{
@@ -24,6 +25,7 @@ use gateway_core::{
    engine::{
        execution::{AuthenticatedClient, ClientTransport},
        middleware::{FrozenMiddlewarePlan, MiddlewareError},
+        response_control::ResponseControl,
    },
    lifecycle::{ConnectionGuard, ConnectionLifecycle},
    operation::OperationKind,
@@ -46,11 +48,12 @@ use super::{
 };
 use connection::{ConnectionEvent, FramePhase, ResponsesWebSocketConnection, WriteContext};
 use forward::{
-    ConnectionReplaySnapshot, ForwardOutcome, execution_response, forward_response,
-    new_replay_capture, send_gateway_error, send_middleware_error, send_protocol_error,
+    ConnectionReplaySnapshot, ForwardOutcome, execution_response, forward_control_event,
+    forward_response, new_replay_capture, send_control, send_gateway_error, send_middleware_error,
+    send_protocol_error,
 };
-use protocol::connection_limit_event;
 pub use protocol::{ResponseCreateFrameError, decode_response_create_with_context};
+use protocol::{connection_limit_event, is_response_create};

 const TEXT_FRAMES_ONLY: &str = "Responses WebSocket accepts text frames only";
 const CONNECTION_LIMIT_CLOSE_REASON: &str = "Responses websocket connection limit reached";
@@ -191,10 +194,20 @@ async fn serve_responses_websocket(socket: WebSocket, session: ResponsesWebSocke
    );
    let mut request_count = 0_u64;
    let mut replay = ConnectionReplaySnapshot::default();
+    let mut response_control = ResponseControl::default();

    loop {
-        let Some(event) = connection.next_event().await else {
-            break;
+        let event = tokio::select! {
+            event = connection.next_event() => {
+                let Some(event) = event else { break };
+                event
+            }
+            event = response_control.receive() => {
+                if forward_control_event(&mut connection, &response_control, event).await == ForwardOutcome::Disconnect {
+                    break;
+                }
+                continue;
+            }
        };
        let payload = match event {
            ConnectionEvent::Text(payload) => payload,
@@ -212,8 +225,22 @@ async fn serve_responses_websocket(socket: WebSocket, session: ResponsesWebSocke
            expire_connection(&mut connection).await;
            break;
        }
-        request_count = request_count.saturating_add(1);
        let correlation_id = Arc::<str>::from(service.next_request_id());
+        if !is_response_create(&payload) {
+            if send_control(
+                &mut connection,
+                &response_control,
+                &payload,
+                &correlation_id,
+            )
+            .await
+                == ForwardOutcome::Disconnect
+            {
+                break;
+            }
+            continue;
+        }
+        request_count = request_count.saturating_add(1);
        // 初步解码只保留路由事实，避免整份正文跨越准入等待和响应交付
        let model_hint = match decode_response_create_with_context(&payload, &request_headers) {
            Ok(decoded) => Some(decoded.metadata().requested_model().to_owned()),
@@ -251,6 +278,7 @@ async fn serve_responses_websocket(socket: WebSocket, session: ResponsesWebSocke
            expire_connection(&mut connection).await;
            break;
        }
+        response_control.clear();
        let execution = service.execution();
        let preparation = async {
            // 握手的显式改写可继承，Key 策略与宿主设置仍在每轮执行前刷新
@@ -291,7 +319,7 @@ async fn serve_responses_websocket(socket: WebSocket, session: ResponsesWebSocke
            }
        };
        let request_id = Arc::<str>::from(prepared.request_id().to_string());
-        let response_control = prepared.response_control();
+        response_control = prepared.response_control();
        let capture = new_replay_capture();
        let validation = ResponseValidationFacts::default();
        let input = RequestInput {
@@ -381,7 +409,7 @@ async fn serve_responses_websocket(socket: WebSocket, session: ResponsesWebSocke
            &mut replay,
            capture,
            validation,
-            response_control,
+            &response_control,
        )
        .await
            == ForwardOutcome::Disconnect
@@ -31,42 +31,22 @@ pub fn decode_response_create_with_context(
    decode_response_create_inner(payload, request_headers)
 }

-/// 中断只引用活动响应；普通创建帧仍交给原有解码与串行准入路径
-pub(super) fn decode_response_interrupt(
-    payload: &str,
-) -> Result<Option<String>, ResponseCreateFrameError> {
+/// 只识别需要本地准入的创建帧，其余文本不在网关解释
+pub(super) fn is_response_create(payload: &str) -> bool {
    #[derive(serde::Deserialize)]
    struct FrameType {
        #[serde(rename = "type")]
-        message_type: Option<String>,
+        message_type: String,
    }
-    // 非控制帧仍在原来的串行请求边界校验，不能抢先拒绝排队的普通请求
    // 只投影类型，避免为排队的大型 response.create 再构造完整 JSON 树
-    let Ok(frame) = serde_json::from_str::<FrameType>(payload) else {
-        return Ok(None);
-    };
-    if frame.message_type.as_deref() != Some("response.interrupt") {
-        return Ok(None);
+    match serde_json::from_str::<FrameType>(payload) {
+        Ok(frame) => frame.message_type == "response.create",
+        // struct 投影拒绝重复 type；沿用创建解码器的 JSON object 语义，
+        // 避免这类创建请求绕过准入进入透传路径
+        Err(_) => serde_json::from_str::<Value>(payload).is_ok_and(|frame| {
+            frame.get("type").and_then(Value::as_str) == Some("response.create")
+        }),
    }
-    let value: Value =
-        serde_json::from_str(payload).map_err(|_| ResponseCreateFrameError::InvalidJson)?;
-    if value.get("mode").and_then(Value::as_str) != Some("discard_partial_items") {
-        return Err(ResponseCreateFrameError::Request(
-            RequestDecodeError::InvalidValue {
-                field: "mode".to_owned(),
-            },
-        ));
-    }
-    let id = value
-        .get("response_id")
-        .and_then(Value::as_str)
-        .filter(|id| !id.is_empty())
-        .ok_or_else(|| {
-            ResponseCreateFrameError::Request(RequestDecodeError::InvalidValue {
-                field: "response_id".to_owned(),
-            })
-        })?;
-    Ok(Some(id.to_owned()))
 }

 fn decode_response_create_inner(
@@ -4,6 +4,7 @@ use axum::http::{HeaderMap, header::ORIGIN};
 use url::Url;

 pub(crate) const NAME: &str = "cpr_session";
+pub(crate) const REFRESH_NAME: &str = "cpr_refresh";

 pub(crate) fn attributes(headers: &HeaderMap) -> &'static str {
    // HTTPS 反代回源 HTTP 不改变浏览器 Origin
@@ -19,16 +20,24 @@ pub(crate) fn attributes(headers: &HeaderMap) -> &'static str {
                })
            });
    if http_origin {
-        "Path=/; HttpOnly; SameSite=Lax"
+        "HttpOnly; SameSite=Lax"
    } else {
-        "Path=/; Secure; HttpOnly; SameSite=Lax"
+        "Secure; HttpOnly; SameSite=Lax"
    }
 }

 pub(crate) fn value(headers: &HeaderMap) -> Option<String> {
+    named_value(headers, NAME)
+}
+
+pub(crate) fn refresh_value(headers: &HeaderMap) -> Option<String> {
+    named_value(headers, REFRESH_NAME)
+}
+
+fn named_value(headers: &HeaderMap, name: &str) -> Option<String> {
    let cookie = headers.get("cookie")?.to_str().ok()?;
    cookie.split(';').find_map(|part| {
        let (candidate, value) = part.trim().split_once('=')?;
-        (candidate == NAME).then(|| value.to_owned())
+        (candidate == name && !value.is_empty()).then(|| value.to_owned())
    })
 }
@@ -49,6 +49,36 @@ async fn list_route_should_keep_camel_case_group_and_page_wire() {
    assert!(value["data"]["items"][0].get("member_count").is_none());
 }

+#[tokio::test]
+async fn options_route_should_return_only_lightweight_group_fields() {
+    let fixture = authenticated_fixture().await;
+    let response = request(
+        router(&fixture),
+        Method::GET,
+        "/api/admin/account-groups/options?page=1&pageSize=1&search=alpha&enabled=true",
+        None,
+        true,
+    )
+    .await;
+
+    assert_eq!(response.status(), StatusCode::OK);
+    let value = response_json(response).await;
+    assert_eq!(
+        value["data"]["items"][0],
+        json!({
+            "id": PRIMARY_GROUP_ID,
+            "name": "Alpha routing",
+            "color": "#2563EBFF",
+            "enabled": true
+        })
+    );
+    assert_eq!(value["data"]["page"]["page"], 1);
+    assert_eq!(value["data"]["page"]["pageSize"], 1);
+    assert_eq!(value["data"]["page"]["total"], 1);
+    assert_eq!(value["data"]["page"]["totalPages"], 1);
+    assert_eq!(value["data"]["configRevision"], 7);
+}
+
 #[tokio::test]
 async fn create_route_should_create_an_empty_group() {
    let fixture = authenticated_fixture().await;
@@ -163,6 +193,11 @@ async fn list_route_should_reject_unknown_and_invalid_pagination_fields() {
        "/api/admin/account-groups?page=0",
        "/api/admin/account-groups?pageSize=0",
        "/api/admin/account-groups?pageSize=201",
+        "/api/admin/account-groups/options?other=true",
+        "/api/admin/account-groups/options?page=0",
+        "/api/admin/account-groups/options?pageSize=0",
+        "/api/admin/account-groups/options?pageSize=201",
+        "/api/admin/account-groups/options?search=%00",
    ] {
        let response = request(router(&fixture), Method::GET, uri, None, true).await;
        assert_eq!(response.status(), StatusCode::BAD_REQUEST, "{uri}");
@@ -219,6 +254,14 @@ async fn account_group_routes_should_require_admin_authentication() {
        false,
    )
    .await;
+    let options_response = request(
+        router(&fixture),
+        Method::GET,
+        "/api/admin/account-groups/options",
+        None,
+        false,
+    )
+    .await;
    let post_response = request(
        router(&fixture),
        Method::POST,
@@ -229,9 +272,29 @@ async fn account_group_routes_should_require_admin_authentication() {
    .await;

    assert_eq!(get_response.status(), StatusCode::UNAUTHORIZED);
+    assert_eq!(options_response.status(), StatusCode::UNAUTHORIZED);
    assert_eq!(post_response.status(), StatusCode::UNAUTHORIZED);
 }

+#[tokio::test]
+async fn options_route_should_reject_client_key_identity() {
+    let fixture = crate::support::key_fixture().await;
+    let response = router(&fixture)
+        .oneshot(
+            Request::builder()
+                .method(Method::GET)
+                .uri("/api/admin/account-groups/options")
+                .header("x-api-key", crate::support::RAW_KEY)
+                .header("x-request-id", "req_account_group_options_client_key")
+                .body(Body::empty())
+                .expect("client key options request"),
+        )
+        .await
+        .expect("client key options response");
+
+    assert_eq!(response.status(), StatusCode::UNAUTHORIZED);
+}
+
 async fn authenticated_fixture() -> AdminTestFixture {
    let fixture = AdminTestFixture::new().await;
    fixture.auth.insert_session("valid-session");
@@ -12,13 +12,8 @@ use super::super::{AdminTestFixture, AdminTestState};
 #[tokio::test]
 async fn account_cooldown_returns_an_instant_and_server_formatted_recovery() {
    use chrono::{DateTime, Duration, Utc};
-    use gateway_admin::model::{
-        Revision,
-        accounts::{AccountCapacity, AccountPageItem, AccountRecord},
-    };
    use gateway_core::account::{
        AccountCooldown, AccountCooldownKind, AccountStatusFacts, CredentialState, QuotaState,
-        resolve_account_status,
    };

    for zone in ["Asia/Shanghai", "UTC", "Asia/Kathmandu", "America/New_York"] {
@@ -65,41 +60,7 @@ async fn account_cooldown_returns_an_instant_and_server_formatted_recovery() {
                last_error_reason: None,
                last_error_message: None,
            };
-            *fixture.account.lock().unwrap() = Some(AccountPageItem {
-                account: AccountRecord {
-                    id: "acct_cooldown".to_owned(),
-                    provider_kind: gateway_core::routing::ProviderKind::new("openai").unwrap(),
-                    groups: Vec::new(),
-                    name: "synthetic cooldown account".to_owned(),
-                    notes: None,
-                    email: None,
-                    upstream_user_id: None,
-                    upstream_account_id: None,
-                    plan_type: None,
-                    authentication_kind: "oauth".to_owned(),
-                    credential_revision: Revision::new(1).unwrap(),
-                    has_refresh_token: true,
-                    access_token_expires_at: None,
-                    next_refresh_at: None,
-                    enabled: true,
-                    concurrency_limit: None,
-                    weight: Default::default(),
-                    model_access: Default::default(),
-                    outbound_proxy: None,
-                    credential_state: facts.credential_state,
-                    credential_observed_at: now,
-                    quota: facts.quota,
-                    last_error_reason: None,
-                    last_error_message: None,
-                    created_at: now,
-                    updated_at: now,
-                },
-                capacity: AccountCapacity {
-                    used_slots: None,
-                    total_slots: None,
-                },
-                projection: resolve_account_status(&facts, now.into()),
-            });
+            *fixture.account.lock().unwrap() = Some(account_page_item(facts, now, "oauth"));
            let response = admin::accounts::router::<AdminTestState>()
                .with_state(fixture.state())
                .oneshot(
@@ -138,6 +99,132 @@ async fn account_cooldown_returns_an_instant_and_server_formatted_recovery() {
    }
 }

+fn account_page_item(
+    facts: gateway_core::account::AccountStatusFacts,
+    now: chrono::DateTime<chrono::Utc>,
+    authentication_kind: &str,
+) -> gateway_admin::model::accounts::AccountPageItem {
+    use gateway_admin::model::{
+        Revision,
+        accounts::{AccountCapacity, AccountPageItem, AccountRecord},
+    };
+    use gateway_core::account::resolve_account_status;
+
+    AccountPageItem {
+        account: AccountRecord {
+            id: "acct_cooldown".to_owned(),
+            provider_kind: gateway_core::routing::ProviderKind::new("openai").unwrap(),
+            groups: Vec::new(),
+            name: "synthetic cooldown account".to_owned(),
+            notes: None,
+            email: None,
+            upstream_user_id: None,
+            upstream_account_id: None,
+            plan_type: None,
+            authentication_kind: authentication_kind.to_owned(),
+            credential_revision: Revision::new(1).unwrap(),
+            has_refresh_token: authentication_kind == "oauth",
+            access_token_expires_at: None,
+            next_refresh_at: None,
+            enabled: true,
+            concurrency_limit: None,
+            weight: Default::default(),
+            model_access: Default::default(),
+            outbound_proxy: None,
+            credential_state: facts.credential_state,
+            credential_observed_at: now,
+            quota: facts.quota,
+            last_error_reason: None,
+            last_error_message: None,
+            created_at: now,
+            updated_at: now,
+        },
+        capacity: AccountCapacity {
+            used_slots: None,
+            total_slots: None,
+        },
+        projection: resolve_account_status(&facts, now.into()),
+    }
+}
+
+#[tokio::test]
+async fn account_usage_returns_distinct_cache_read_and_write_tokens_without_aliases() {
+    use chrono::Utc;
+    use gateway_admin::model::accounts::AccountUsage;
+    use gateway_core::account::{AccountStatusFacts, CredentialState, QuotaState};
+
+    let fixture = AdminTestFixture::new().await;
+    fixture.auth.insert_session("valid-session");
+    let now = Utc::now();
+    let facts = AccountStatusFacts {
+        enabled: true,
+        credential_state: CredentialState::Ready,
+        access_token_expires_at: None,
+        quota: QuotaState::unknown(),
+        cooldown: None,
+        last_error_reason: None,
+        last_error_message: None,
+    };
+    *fixture.account.lock().unwrap() = Some(account_page_item(facts, now, "api_key"));
+    for (read, write) in [(Some(13), Some(7)), (None, None)] {
+        *fixture.account_usage.lock().unwrap() = vec![AccountUsage {
+            account_id: "acct_cooldown".to_owned(),
+            request_count: 1,
+            success_count: 1,
+            input_tokens: Some(100),
+            output_tokens: Some(20),
+            cached_input_tokens: read,
+            cache_write_input_tokens: write,
+            reasoning_output_tokens: Some(3),
+            image_input_tokens: None,
+            image_output_tokens: None,
+            image_request_count: 0,
+            image_request_failed_count: 0,
+            total_tokens: Some(120),
+            cost_coverage: Default::default(),
+            costs: Vec::new(),
+            last_used_at: Some(now),
+            request_buckets: Vec::new(),
+            models: Vec::new(),
+        }];
+        let response = admin::accounts::router::<AdminTestState>()
+            .with_state(fixture.state())
+            .oneshot(
+                Request::builder()
+                    .uri("/api/admin/accounts")
+                    .header("x-request-id", "req_account_usage_contract")
+                    .header(header::COOKIE, "cpr_session=valid-session")
+                    .body(Body::empty())
+                    .unwrap(),
+            )
+            .await
+            .unwrap();
+        let status = response.status();
+        let body = to_bytes(response.into_body(), 32768).await.unwrap();
+        let value: serde_json::Value = serde_json::from_slice(&body).unwrap();
+        assert_eq!(status, StatusCode::OK, "{value}");
+        let usage = &value["data"]["items"][0]["usage"];
+        assert_eq!(usage["cachedInputTokens"], serde_json::json!(read));
+        assert_eq!(usage["cacheWriteInputTokens"], serde_json::json!(write));
+        assert_eq!(
+            usage["cachedInputTokensDisplay"],
+            if read.is_some() { "13" } else { "—" }
+        );
+        assert_eq!(
+            usage["cacheWriteInputTokensDisplay"],
+            if write.is_some() { "7" } else { "—" }
+        );
+        for alias in [
+            "createdTokens",
+            "createdTokensDisplay",
+            "readTokens",
+            "readTokensDisplay",
+        ] {
+            assert!(usage.get(alias).is_none(), "obsolete token alias: {alias}");
+        }
+    }
+}
+
 #[tokio::test]
 async fn standalone_credential_rotation_route_is_not_exposed() {
    let fixture = AdminTestFixture::new().await;
@@ -484,10 +484,10 @@ mod response {
            input_tokens_display: "-".to_owned(),
            output_tokens: None,
            output_tokens_display: "-".to_owned(),
-            cached_tokens: None,
-            cached_tokens_display: "-".to_owned(),
-            reasoning_tokens: None,
-            reasoning_tokens_display: "-".to_owned(),
+            cached_input_tokens: None,
+            cached_input_tokens_display: "-".to_owned(),
+            reasoning_output_tokens: None,
+            reasoning_output_tokens_display: "-".to_owned(),
            image_input_tokens: None,
            image_input_tokens_display: "-".to_owned(),
            image_output_tokens: None,
@@ -498,10 +498,8 @@ mod response {
            image_request_failed_count_display: "-".to_owned(),
            total_tokens: None,
            total_tokens_display: "-".to_owned(),
-            created_tokens: None,
-            created_tokens_display: "-".to_owned(),
-            read_tokens: None,
-            read_tokens_display: "-".to_owned(),
+            cache_write_input_tokens: None,
+            cache_write_input_tokens_display: "-".to_owned(),
            last_used_at: None,
            last_used_at_full_display: None,
            last_used_at_display: "-".to_owned(),
@@ -516,9 +514,9 @@ mod response {
        assert_eq!(value["windowLabelDisplay"], "周/月额度窗口");
        assert!(value["inputTokens"].is_null());
        assert!(value["totalTokens"].is_null());
-        assert!(value["reasoningTokens"].is_null());
-        assert_eq!(value["reasoningTokensDisplay"], "-");
-        assert_eq!(value["createdTokensDisplay"], "-");
+        assert!(value["reasoningOutputTokens"].is_null());
+        assert_eq!(value["reasoningOutputTokensDisplay"], "-");
+        assert_eq!(value["cacheWriteInputTokensDisplay"], "-");
    }

    #[test]
@@ -18,9 +18,10 @@ use gateway_admin::{
        MutationContext, Revision,
        account_groups::{
            AccountGroupAccountSummary, AccountGroupCapacity, AccountGroupColor,
-            AccountGroupListQuery, AccountGroupMemberFact, AccountGroupMutation, AccountGroupPage,
-            AccountGroupRecord, AccountGroupUsage, DeleteAccountGroup, NewAccountGroup,
-            SetAccountGroupEnabled, UpdateAccountGroup,
+            AccountGroupListQuery, AccountGroupMemberFact, AccountGroupMutation,
+            AccountGroupOptionsPage, AccountGroupPage, AccountGroupRecord, AccountGroupRef,
+            AccountGroupUsage, DeleteAccountGroup, NewAccountGroup, SetAccountGroupEnabled,
+            UpdateAccountGroup,
        },
        accounts::{
            AccountListQuery, AccountPage, AccountPageItem, AccountRuntimeSnapshot,
@@ -111,6 +112,7 @@ pub(super) struct AdminTestFixture {
    pub dashboard_summary_range: Arc<Mutex<Option<TimeRange>>>,
    pub provider_error: Arc<Mutex<Option<ProviderAdminError>>>,
    pub account: Arc<Mutex<Option<AccountPageItem>>>,
+    pub account_usage: Arc<Mutex<Vec<AccountUsage>>>,
 }

 impl AdminTestFixture {
@@ -153,6 +155,7 @@ impl AdminTestFixture {
        let dashboard_summary_range = Arc::new(Mutex::new(None));
        let provider_error = Arc::new(Mutex::new(None));
        let account = Arc::new(Mutex::new(None));
+        let account_usage = Arc::new(Mutex::new(Vec::new()));
        let unused = Arc::new(UnusedStore {
            observations: observations.clone(),
            usage_records: Arc::clone(&usage_records),
@@ -162,6 +165,7 @@ impl AdminTestFixture {
            dashboard_observation: Arc::clone(&dashboard_observation),
            dashboard_summary_range: Arc::clone(&dashboard_summary_range),
            account: Arc::clone(&account),
+            account_usage: Arc::clone(&account_usage),
        });
        let plugin_ports = Arc::new(plugins::TestPluginPorts::default());
        let published_snapshot = gateway_core::runtime::RuntimeSnapshotHandle::default();
@@ -231,6 +235,7 @@ impl AdminTestFixture {
            dashboard_summary_range,
            provider_error,
            account,
+            account_usage,
        }
    }

@@ -316,6 +321,7 @@ impl MemoryAuthStore {
                    },
                    admin_user_id: "admin_1".to_owned(),
                },
+                renewal: None,
                absolute_expires_at: None,
                expires_at: Utc::now() + Duration::hours(1),
            },
@@ -334,7 +340,7 @@ impl MemoryAuthStore {
        self.sessions
            .lock()
            .unwrap()
-            .get_mut(session_id)
+            .get_mut(session_id.split('.').nth(1).unwrap_or(session_id))
            .unwrap()
            .expires_at = expires_at;
    }
@@ -410,19 +416,24 @@ impl AuthStore for MemoryAuthStore {
        Ok(())
    }

-    async fn renew_session(
+    async fn compare_exchange_session(
        &self,
        session_id: &str,
        expected: &AuthSession,
-        expires_at: chrono::DateTime<chrono::Utc>,
+        replacement: Option<&AuthSession>,
    ) -> AdminStoreResult<Option<AuthSession>> {
        let mut sessions = self.sessions.lock().unwrap();
        if let Some(session) = sessions.get_mut(session_id) {
-            if session.expires_at <= chrono::Utc::now() {
+            if session.retained_until() <= chrono::Utc::now() {
                return Ok(None);
            }
            if session == expected {
-                session.expires_at = expires_at;
+                if let Some(replacement) = replacement {
+                    *session = replacement.clone();
+                } else {
+                    sessions.remove(session_id);
+                    return Ok(None);
+                }
            }
            return Ok(Some(session.clone()));
        }
@@ -599,12 +610,12 @@ impl SettingsStore for MemorySettingsStore {
            rotation_strategy: command.rotation_strategy,
            updated_at: Utc::now(),
            values: gateway_admin::model::settings::RuntimeSettingsValues {
+                codex_privacy_policy: command.values.codex_privacy_policy,
                request_location_enabled: command.values.request_location_enabled,
                request_location: command.values.request_location,
                refresh_margin_seconds: command.values.refresh_margin_seconds,
                refresh_concurrency: command.values.refresh_concurrency,
                max_concurrent_per_account: command.values.max_concurrent_per_account,
-                request_interval_ms: command.values.request_interval_ms,
                max_waiting_per_key: command.values.max_waiting_per_key,
                max_waiting_per_account: command.values.max_waiting_per_account,
                concurrency_wait_timeout_seconds: command.values.concurrency_wait_timeout_seconds,
@@ -789,6 +800,48 @@ impl AccountGroupStore for MemoryAccountGroupStore {
        })
    }

+    async fn list_account_group_options(
+        &self,
+        query: AccountGroupListQuery,
+    ) -> AdminStoreResult<AccountGroupOptionsPage> {
+        let state = self.state.lock().expect("account groups");
+        let search = query.search.as_ref().map(|value| value.to_lowercase());
+        let mut matching = state
+            .groups
+            .values()
+            .filter(|record| {
+                query
+                    .enabled
+                    .is_none_or(|enabled| record.enabled == enabled)
+            })
+            .filter(|record| {
+                search
+                    .as_ref()
+                    .is_none_or(|search| record.name.to_lowercase().contains(search))
+            })
+            .map(|record| AccountGroupRef {
+                id: record.id.clone(),
+                name: record.name.clone(),
+                color: record.color.clone(),
+                enabled: record.enabled,
+            })
+            .collect::<Vec<_>>();
+        matching.sort_by(|left, right| left.name.cmp(&right.name));
+        let total = matching.len() as u64;
+        let page_size = usize::from(query.page_size.get());
+        let offset = usize::try_from(query.page.saturating_sub(1))
+            .unwrap_or(usize::MAX)
+            .saturating_mul(page_size);
+        let items = matching.into_iter().skip(offset).take(page_size).collect();
+        Ok(AccountGroupOptionsPage {
+            config_revision: state.revision,
+            items,
+            total,
+            page: query.page,
+            page_size: query.page_size.get(),
+        })
+    }
+
    async fn load_account_group_members(
        &self,
        group_ids: &[gateway_core::routing::AccountGroupId],
@@ -1056,6 +1109,7 @@ struct UnusedStore {
    dashboard_observation: Arc<Mutex<Option<DashboardObservation>>>,
    dashboard_summary_range: Arc<Mutex<Option<TimeRange>>>,
    account: Arc<Mutex<Option<AccountPageItem>>>,
+    account_usage: Arc<Mutex<Vec<AccountUsage>>>,
 }

 struct UnusedClientKeyVerifier;
@@ -1117,18 +1171,41 @@ impl AccountStore for UnusedStore {
    async fn load_account_usage(
        &self,
        _: TimeRange,
-        _: &[String],
+        account_ids: &[String],
    ) -> AdminStoreResult<Vec<AccountUsage>> {
        if self.account.lock().expect("account").is_some() {
-            return Ok(Vec::new());
+            return Ok(self
+                .account_usage
+                .lock()
+                .expect("account usage")
+                .iter()
+                .filter(|usage| account_ids.contains(&usage.account_id))
+                .cloned()
+                .collect());
        }
        Err(unavailable("account usage"))
    }

    async fn load_account_usage_by_windows(
        &self,
-        _: &[AccountUsageWindowQuery],
+        windows: &[AccountUsageWindowQuery],
    ) -> AdminStoreResult<Vec<AccountUsageWindowResult>> {
+        if self.account.lock().expect("account").is_some() {
+            let usage = self.account_usage.lock().expect("account usage");
+            return Ok(windows
+                .iter()
+                .filter_map(|window| {
+                    usage
+                        .iter()
+                        .find(|usage| usage.account_id == window.account_id)
+                        .map(|usage| AccountUsageWindowResult {
+                            account_id: window.account_id.clone(),
+                            key: window.key.clone(),
+                            usage: usage.clone(),
+                        })
+                })
+                .collect());
+        }
        Err(unavailable("account quota window usage"))
    }

@@ -1302,6 +1379,10 @@ impl AccountRuntimeStore for UnusedStore {

 #[async_trait]
 impl ObservabilityStore for UnusedStore {
+    fn query_timeout(&self) -> std::time::Duration {
+        std::time::Duration::from_secs(10)
+    }
+
    async fn dashboard_summary(
        &self,
        query: DashboardQuery,
@@ -1337,15 +1418,39 @@ impl ObservabilityStore for UnusedStore {
        data.trend.clone().ok_or_else(|| unavailable("usage trend"))
    }

-    fn usage_calculated_billing_facts(
+    async fn analytics_cache_generation(&self) -> AdminStoreResult<u64> {
+        Ok(self
+            .observations
+            .lock()
+            .expect("observations")
+            .summary
+            .as_ref()
+            .map_or(0, |summary| summary.analytics.generation))
+    }
+
+    async fn usage_insights_observation(
        &self,
-        _: TimeRange,
-        _: UsageFilter,
+        range: TimeRange,
+        filter: UsageFilter,
        _: Granularity,
-    ) -> gateway_admin::ports::store::UsageCalculatedBillingStream<'_> {
-        Box::pin(futures::stream::once(async {
-            Err(unavailable("usage billing facts"))
-        }))
+    ) -> AdminStoreResult<gateway_admin::model::observability::UsageInsightsObservation> {
+        let mut data = self.observations.lock().expect("observations");
+        data.summaries.push((range, filter.clone()));
+        data.trends.push((range, filter));
+        Ok(
+            gateway_admin::model::observability::UsageInsightsObservation {
+                overview: data
+                    .summary
+                    .clone()
+                    .map(|summary| UsageOverview { range, ..summary })
+                    .ok_or_else(|| unavailable("usage summary"))?,
+                trend: data
+                    .trend
+                    .clone()
+                    .ok_or_else(|| unavailable("usage trend"))?,
+                costs: Vec::new(),
+            },
+        )
    }

    async fn list_usage_records(&self, query: UsageQuery) -> AdminStoreResult<UsagePage> {
@@ -1624,12 +1729,12 @@ fn test_runtime_settings() -> RuntimeSettings {
        rotation_strategy: RotationStrategy::Smart,
        updated_at: Utc::now(),
        values: gateway_admin::model::settings::RuntimeSettingsValues {
+            codex_privacy_policy: Default::default(),
            request_location_enabled: false,
            request_location: Default::default(),
            refresh_margin_seconds: 3_600,
            refresh_concurrency: 2,
            max_concurrent_per_account: 3,
-            request_interval_ms: 50,
            max_waiting_per_key: 0,
            max_waiting_per_account: 0,
            concurrency_wait_timeout_seconds: 30,
@@ -25,6 +25,17 @@ async fn dashboard_summary_should_include_quota_exhaustion_in_unavailable_headli
        .dashboard_observation
        .lock()
        .expect("dashboard observation") = Some(DashboardObservation {
+        analytics: gateway_admin::model::observability::AnalyticsMetadata {
+            coverage_start: Some(now - Duration::hours(1)),
+            coverage_end: Some(now),
+            generated_at: now,
+            lag_seconds: 12,
+            state: gateway_admin::model::observability::AnalyticsState::Lagging,
+            percentiles_approximate: true,
+            schema_version: 1,
+            histogram_version: 1,
+            generation: 42,
+        },
        runtime_slots: None,
        range: TimeRange::new(now - Duration::hours(1), now).expect("dashboard range"),
        totals: Default::default(),
@@ -59,6 +70,14 @@ async fn dashboard_summary_should_include_quota_exhaustion_in_unavailable_headli
        .expect("dashboard response body");
    let value: serde_json::Value = serde_json::from_slice(&body).expect("dashboard response JSON");
    assert_eq!(status, StatusCode::OK, "{value}");
+    assert_eq!(value["data"]["analytics"]["state"], "lagging");
+    assert_eq!(value["data"]["analytics"]["lagSeconds"], 12);
+    assert_eq!(value["data"]["analytics"]["percentilesApproximate"], true);
+    assert_eq!(value["data"]["analytics"]["schemaVersion"], 1);
+    assert_eq!(value["data"]["analytics"]["histogramVersion"], 1);
+    assert!(value["data"]["analytics"]["coverageStart"].is_string());
+    assert!(value["data"]["analytics"]["generatedAtDisplay"].is_string());
+    assert!(value["data"]["analytics"].get("generation").is_none());

    assert_eq!(
        (
@@ -108,12 +127,13 @@ async fn dashboard_summary_should_use_lifetime_totals_for_card_footers() {
        .dashboard_observation
        .lock()
        .expect("dashboard observation") = Some(DashboardObservation {
+        analytics: Default::default(),
        runtime_slots: None,
        range: TimeRange::new(now - Duration::hours(1), now).expect("dashboard range"),
        totals: DashboardTotals {
            request_count: 42,
            input_tokens: 800,
-            cached_tokens: 200,
+            cached_input_tokens: 200,
            total_tokens: 840,
            billing_usd: None,
        },
@@ -141,13 +161,21 @@ async fn dashboard_summary_should_use_lifetime_totals_for_card_footers() {
        .expect("dashboard response body");
    let value: serde_json::Value = serde_json::from_slice(&body).expect("dashboard response JSON");
    assert_eq!(status, StatusCode::OK, "{value}");
+    assert_eq!(
+        value["data"]["analytics"]["coverageStartDisplay"],
+        serde_json::Value::Null
+    );
+    assert_eq!(
+        value["data"]["analytics"]["coverageEndDisplay"],
+        serde_json::Value::Null
+    );

    assert_eq!(
        (
            &value["data"]["cards"]["traffic"]["totalRequests"],
            &value["data"]["cards"]["tokens"]["totalTokens"],
            &value["data"]["cards"]["cache"]["totalHitRate"],
-            &value["data"]["cards"]["cache"]["totalCachedTokens"],
+            &value["data"]["cards"]["cache"]["totalCachedInputTokens"],
        ),
        (
            &serde_json::json!("42"),
@@ -180,6 +208,7 @@ async fn dashboard_summary_should_default_to_current_deployment_day() {
        .dashboard_observation
        .lock()
        .expect("dashboard observation") = Some(DashboardObservation {
+        analytics: Default::default(),
        runtime_slots: None,
        range: TimeRange::new(now - Duration::hours(1), now).expect("dashboard range"),
        totals: Default::default(),
@@ -233,6 +262,22 @@ async fn usage_detail_should_keep_attempt_snapshot_contract() {
    let fixture = AdminTestFixture::new().await;
    fixture.auth.insert_session("valid-session");
    let now = Utc::now();
+    let mut record = usage_record_with_account(
+        "req_detail",
+        "acct_snap_a",
+        "Snapshot Alpha",
+        "alpha@example.invalid",
+        "oauth",
+        now,
+    );
+    record.first_token_ms = Some(20);
+    record.upstream_response_ms = Some(1_000);
+    record.upstream_api_overhead_ms = Some(120.25);
+    record.upstream_engine_ms = Some(6400.0);
+    record.upstream_engine_iapi_ttft_ms = Some(650.5);
+    record.upstream_engine_service_ttft_ms = Some(720.25);
+    record.upstream_engine_iapi_tbt_ms = Some(18.45);
+    record.upstream_engine_service_tbt_ms = Some(20.12);
    fixture
        .usage_detail
        .lock()
@@ -240,14 +285,7 @@ async fn usage_detail_should_keep_attempt_snapshot_contract() {
        .replace(UsageDetail {
            trace: None,
            related_requests: Vec::new(),
-            request: usage_record_with_account(
-                "req_detail",
-                "acct_snap_a",
-                "Snapshot Alpha",
-                "alpha@example.invalid",
-                "oauth",
-                now,
-            ),
+            request: record,
            attempts: vec![UsageAttempt {
                source: "ops_event".to_owned(),
                id: "ops_detail".to_owned(),
@@ -273,9 +311,9 @@ async fn usage_detail_should_keep_attempt_snapshot_contract() {
                message: Some("limited".to_owned()),
                input_tokens: None,
                output_tokens: None,
-                cached_tokens: None,
-                cache_write_tokens: None,
-                reasoning_tokens: None,
+                cached_input_tokens: None,
+                cache_write_input_tokens: None,
+                reasoning_output_tokens: None,
                total_tokens: None,
                cost_source: Some("unavailable".to_owned()),
                cost_amount: None,
@@ -300,6 +338,39 @@ async fn usage_detail_should_keep_attempt_snapshot_contract() {
        .await
        .expect("usage detail body");
    let value: serde_json::Value = serde_json::from_slice(&body).expect("usage detail JSON");
+    assert_eq!(value["data"]["firstTokenLatencyMs"], 20);
+    assert_eq!(value["data"]["latencyDetails"]["upstreamResponseMs"], 1_000);
+    assert_eq!(
+        value["data"]["latencyDetails"]["upstreamApiOverheadMs"],
+        json!(120.25)
+    );
+    assert_eq!(
+        value["data"]["latencyDetails"]["upstreamEngineMs"],
+        json!(6400.0)
+    );
+    assert_eq!(
+        value["data"]["latencyDetails"]["upstreamEngineIapiTtftMs"],
+        json!(650.5)
+    );
+    assert_eq!(
+        value["data"]["latencyDetails"]["upstreamEngineServiceTtftMs"],
+        json!(720.25)
+    );
+    assert_eq!(
+        value["data"]["latencyDetails"]["upstreamEngineIapiTbtMs"],
+        json!(18.45)
+    );
+    assert_eq!(
+        value["data"]["latencyDetails"]["upstreamEngineServiceTbtMs"],
+        json!(20.12)
+    );
+    assert!(value["data"].get("firstTokenMs").is_none());
+    assert!(value["data"].get("firstTokenLatencyMsDisplay").is_none());
+    assert!(
+        value["data"]["latencyDetails"]
+            .get("firstTokenMs")
+            .is_none()
+    );
    assert_eq!(
        serde_json::json!({
            "accountId": value["data"]["accountId"],
@@ -359,9 +430,9 @@ async fn zero_attempt_failure_detail_keeps_missing_upstream_facts_and_preparatio
    record.error_message = Some("no upstream account is available".to_owned());
    record.input_tokens = None;
    record.output_tokens = None;
-    record.cached_tokens = None;
-    record.cache_write_tokens = None;
-    record.reasoning_tokens = None;
+    record.cached_input_tokens = None;
+    record.cache_write_input_tokens = None;
+    record.reasoning_output_tokens = None;
    record.image_input_tokens = None;
    record.image_output_tokens = None;
    record.total_tokens = None;
@@ -575,6 +646,7 @@ async fn diagnostics_should_keep_stable_key_and_display_name_contract() {
    let fixture = AdminTestFixture::new().await;
    fixture.auth.insert_session("valid-session");
    *fixture.diagnostics.lock().expect("diagnostics") = DiagnosticsObservation {
+        analytics: Default::default(),
        total_request_count: 4,
        items: vec![DiagnosticObservation {
            key: "acct_diag".to_owned(),
@@ -684,9 +756,9 @@ fn usage_record_with_account(
        retry_after_ms: None,
        input_tokens: Some(1),
        output_tokens: Some(1),
-        cached_tokens: Some(0),
-        cache_write_tokens: Some(0),
-        reasoning_tokens: Some(0),
+        cached_input_tokens: Some(0),
+        cache_write_input_tokens: Some(0),
+        reasoning_output_tokens: Some(0),
        image_input_tokens: Some(0),
        image_output_tokens: Some(0),
        total_tokens: Some(2),
@@ -702,6 +774,13 @@ fn usage_record_with_account(
        first_text_ms: None,
        first_token_ms: None,
        provider_processing_ms: None,
+        upstream_response_ms: None,
+        upstream_api_overhead_ms: None,
+        upstream_engine_ms: None,
+        upstream_engine_iapi_ttft_ms: None,
+        upstream_engine_service_ttft_ms: None,
+        upstream_engine_iapi_tbt_ms: None,
+        upstream_engine_service_tbt_ms: None,
        latency_ms: None,
        admission_decision_ms: None,
        account_selection_wait_ms: None,
@@ -798,9 +877,9 @@ async fn usage_route_should_expose_table_facts_without_detail_payload() {
            service_tier: Some("default".to_owned()),
            input_tokens: Some(1),
            output_tokens: Some(1),
-            cached_tokens: Some(0),
-            cache_write_tokens: Some(0),
-            reasoning_tokens: Some(0),
+            cached_input_tokens: Some(0),
+            cache_write_input_tokens: Some(0),
+            reasoning_output_tokens: Some(0),
            image_input_tokens: Some(31),
            image_output_tokens: Some(9),
            total_tokens: Some(2),
@@ -834,6 +913,13 @@ async fn usage_route_should_expose_table_facts_without_detail_payload() {
            first_text_ms: Some(19),
            first_token_ms: Some(20),
            provider_processing_ms: Some(21),
+            upstream_response_ms: Some(2_000),
+            upstream_api_overhead_ms: None,
+            upstream_engine_ms: None,
+            upstream_engine_iapi_ttft_ms: None,
+            upstream_engine_service_ttft_ms: None,
+            upstream_engine_iapi_tbt_ms: None,
+            upstream_engine_service_tbt_ms: None,
            latency_ms: Some(31),
            admission_decision_ms: Some(1),
            account_selection_wait_ms: Some(2),
@@ -970,8 +1056,8 @@ async fn usage_route_should_expose_table_facts_without_detail_payload() {
                "firstEventMs": 17,
                "firstReasoningMs": 18,
                "firstTextMs": 19,
-                "firstTokenMs": 20,
                "openaiProcessingMs": 21,
+                "upstreamResponseMs": 2000,
            },
            "firstTokenLatencyMs": 20,
            "latencyMs": 31,
@@ -1045,6 +1131,12 @@ async fn calendar_queries_and_display_follow_deployment_timezone_with_one_anchor
        let fixture = AdminTestFixture::with_timezone(timezone).await;
        fixture.auth.insert_session("valid-session");
        *fixture.dashboard_observation.lock().unwrap() = Some(DashboardObservation {
+            analytics: gateway_admin::model::observability::AnalyticsMetadata {
+                coverage_start: Some(range.start),
+                coverage_end: Some(end),
+                generated_at: end,
+                ..Default::default()
+            },
            runtime_slots: None,
            range,
            totals: Default::default(),
@@ -1086,6 +1178,15 @@ async fn calendar_queries_and_display_follow_deployment_timezone_with_one_anchor
        assert_eq!(queried.end, end);
        assert_eq!(value["data"]["asOf"], anchor);
        assert_eq!(value["data"]["asOfDisplay"], display);
+        let analytics = &value["data"]["analytics"];
+        assert_eq!(analytics["coverageStart"], start);
+        assert_eq!(analytics["coverageEnd"], anchor);
+        assert_eq!(
+            analytics["coverageStartDisplay"],
+            format!("{} 00:00:00", &display[..10])
+        );
+        assert_eq!(analytics["coverageEndDisplay"], display);
+        assert_eq!(analytics["generatedAtDisplay"], display);
        let points = value["data"]["healthTimeline"]["points"]
            .as_array()
            .unwrap();
@@ -1142,3 +1243,63 @@ async fn calendar_query_rejects_an_anchor_outside_the_local_calendar() {
    assert_eq!(response.status(), StatusCode::BAD_REQUEST);
    assert!(fixture.dashboard_summary_range.lock().unwrap().is_none());
 }
+
+#[tokio::test]
+async fn observability_queries_reject_group_filters_and_analytics_search() {
+    use crate::admin::{AdminTestFixture, AdminTestState};
+    use axum::{
+        body::Body,
+        http::{Request, StatusCode, header},
+    };
+    use gateway_api::admin::observability;
+    use tower::ServiceExt as _;
+    let fixture = AdminTestFixture::new().await;
+    fixture.auth.insert_session("valid-session");
+    let router = observability::router::<AdminTestState>().with_state(fixture.state());
+    for (path, parameter) in [
+        ("/api/admin/usage/records", "routingGroupRefs=group-a"),
+        ("/api/admin/operations/errors", "routingGroupRefs=group-a"),
+        (
+            "/api/admin/usage/records/summary",
+            "routingGroupRefs=group-a",
+        ),
+        (
+            "/api/admin/usage/insights/overview",
+            "routingGroupRefs=group-a",
+        ),
+        (
+            "/api/admin/usage/insights/diagnostics",
+            "routingGroupRefs=group-a",
+        ),
+        ("/api/admin/usage/records/summary", "search=request-prefix"),
+        (
+            "/api/admin/usage/insights/overview",
+            "search=request-prefix",
+        ),
+        (
+            "/api/admin/usage/insights/diagnostics",
+            "search=request-prefix",
+        ),
+    ] {
+        let response = router
+            .clone()
+            .oneshot(
+                Request::builder()
+                    .uri(format!("{path}?{parameter}"))
+                    .header(header::COOKIE, "cpr_session=valid-session")
+                    .header("x-request-id", "req_rejected_observability_filter")
+                    .body(Body::empty())
+                    .unwrap(),
+            )
+            .await
+            .unwrap();
+        assert_eq!(
+            response.status(),
+            StatusCode::BAD_REQUEST,
+            "{path}?{parameter}"
+        );
+    }
+    let observations = fixture.observations.lock().unwrap();
+    assert!(observations.records.is_empty());
+    assert!(observations.errors.is_empty());
+}
@@ -395,14 +395,7 @@ async fn published_fixture() -> AdminTestFixture {
    fixture.published_snapshot.publish(
        RuntimeSnapshot::new(
            ConfigRevision::new(7).unwrap(),
-            gateway_core::settings::SettingsValues::new(
-                1,
-                0,
-                "smart",
-                Default::default(),
-                None,
-                None,
-            ),
+            gateway_core::settings::SettingsValues::new(1, "smart", Default::default(), None, None),
            vec![],
            vec![],
            vec![],
@@ -40,6 +40,7 @@ async fn response_json(response: axum::response::Response) -> Value {
 fn update_body() -> Value {
    json!({
        "configRevision": 7,
+        "codexPrivacyPolicy": {"enabled":false,"onError":"skip_rule","rules":[]},
        "requestLocationEnabled": false,
        "requestLocation": {"country":"US", "region":"Ohio", "city":"Piketon", "timezone":"America/New_York"},
        "modelMappings": {
@@ -49,7 +50,6 @@ fn update_body() -> Value {
        "refreshMarginSeconds": 1800,
        "refreshConcurrency": 4,
        "maxConcurrentPerAccount": 5,
-        "requestIntervalMs": 25,
        "maxWaitingPerKey": 0,
        "maxWaitingPerAccount": 0,
        "openaiGuardianReservedConcurrency": 0,
@@ -78,6 +78,63 @@ fn update_body() -> Value {
    })
 }

+#[tokio::test]
+async fn privacy_save_requires_provider_validation_and_preview_requires_admin_auth() {
+    let fixture = AdminTestFixture::new().await;
+    fixture.auth.insert_session("valid-session");
+    let mut body = update_body();
+    let policy = json!({"enabled":true,"onError":"reject_request","rules":[{
+        "id":"auth","name":"自定义认证头","enabled":true,"scope":"request_header",
+        "selector":"authorization","action":"remove_field","pattern":null,
+        "replacement":"","value":null,"replaceAll":true,"caseInsensitive":false,"multiLine":false
+    }]});
+    body["codexPrivacyPolicy"] = policy.clone();
+    let response = app(fixture.state())
+        .oneshot(request(
+            Method::POST,
+            "/api/admin/settings/update",
+            Some(body),
+        ))
+        .await
+        .unwrap();
+    assert_eq!(response.status(), StatusCode::BAD_REQUEST);
+    let response = app(fixture.state())
+        .oneshot(request(Method::GET, "/api/admin/settings", None))
+        .await
+        .unwrap();
+    assert_eq!(
+        response_json(response).await["data"]["codexPrivacyPolicy"],
+        json!({"enabled":false,"onError":"skip_rule","rules":[]})
+    );
+    let response = app(fixture.state())
+        .oneshot(
+            Request::builder()
+                .method(Method::POST)
+                .uri("/api/admin/settings/privacy/preview")
+                .header(header::CONTENT_TYPE, "application/json")
+                .body(Body::from(
+                    json!({"policy":policy,"body":{},"headers":{},"turnMetadata":null}).to_string(),
+                ))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(response.status(), StatusCode::UNAUTHORIZED);
+}
+
+#[test]
+fn privacy_policy_is_required_and_rejects_unknown_contract_fields() {
+    let mut missing = update_body();
+    missing
+        .as_object_mut()
+        .unwrap()
+        .remove("codexPrivacyPolicy");
+    assert!(serde_json::from_value::<UpdateRuntimeSettingsRequest>(missing).is_err());
+    let mut unknown = update_body();
+    unknown["codexPrivacyPolicy"]["protectedFields"] = json!([]);
+    assert!(serde_json::from_value::<UpdateRuntimeSettingsRequest>(unknown).is_err());
+}
+
 #[tokio::test]
 async fn smart_settings_round_trip_and_invalid_updates_leave_the_saved_value_intact() {
    let fixture = AdminTestFixture::new().await;
@@ -223,12 +280,12 @@ fn settings_response_should_cover_the_full_runtime_settings_contract() {
            .single()
            .expect("timestamp"),
        values: gateway_admin::model::settings::RuntimeSettingsValues {
+            codex_privacy_policy: Default::default(),
            request_location_enabled: false,
            request_location: Default::default(),
            refresh_margin_seconds: 1800,
            refresh_concurrency: 4,
            max_concurrent_per_account: 5,
-            request_interval_ms: 25,
            max_waiting_per_key: 0,
            max_waiting_per_account: 0,
            concurrency_wait_timeout_seconds: 30,
@@ -268,6 +325,7 @@ fn settings_response_should_cover_the_full_runtime_settings_contract() {
            "providerRequestProfiles": {},
            "openaiClientProfile": null,
            "xaiClientProfile": null,
+        "codexPrivacyPolicy": {"enabled":false,"onError":"skip_rule","rules":[]},
        "requestLocationEnabled": false,
        "requestLocation": {"country":"US", "region":"Ohio", "city":"Piketon", "timezone":"America/New_York"},
            "modelMappings": {
@@ -277,7 +335,6 @@ fn settings_response_should_cover_the_full_runtime_settings_contract() {
            "refreshMarginSeconds": 1800,
            "refreshConcurrency": 4,
            "maxConcurrentPerAccount": 5,
-            "requestIntervalMs": 25,
            "maxWaitingPerKey": 0,
            "maxWaitingPerAccount": 0,
            "openaiGuardianReservedConcurrency": 0,
@@ -348,13 +405,13 @@ fn settings_request_and_response_fields_should_stay_in_lockstep() {
            .expect("fixture rotation strategy"),
        updated_at: chrono::Utc::now(),
        values: gateway_admin::model::settings::RuntimeSettingsValues {
+            codex_privacy_policy: Default::default(),
            request_location_enabled: false,
            request_location: Default::default(),
            refresh_margin_seconds: request.values.refresh_margin_seconds,
            refresh_concurrency: u32::try_from(request.values.refresh_concurrency).expect("u32"),
            max_concurrent_per_account: u32::try_from(request.values.max_concurrent_per_account)
                .expect("u32"),
-            request_interval_ms: request.values.request_interval_ms,
            max_waiting_per_key: 0,
            max_waiting_per_account: 0,
            concurrency_wait_timeout_seconds: 30,
@@ -23,6 +23,27 @@ fn session_cookie(response: &axum::response::Response) -> String {
        .to_owned()
 }

+fn refresh_cookie(response: &axum::response::Response) -> String {
+    response
+        .headers()
+        .get_all(header::SET_COOKIE)
+        .iter()
+        .filter_map(|value| value.to_str().ok())
+        .find(|value| value.starts_with("cpr_refresh="))
+        .expect("refresh cookie")
+        .split(';')
+        .next()
+        .unwrap()
+        .to_owned()
+}
+
+async fn refresh(app: &axum::Router, cookie: &str) -> axum::response::Response {
+    app.clone()
+        .oneshot(cookie_request(Method::POST, "/api/auth/refresh", cookie))
+        .await
+        .unwrap()
+}
+
 async fn login(
    app: &axum::Router,
    body: Value,
@@ -537,64 +558,129 @@ async fn key_auth_should_issue_restore_and_clear_a_unified_cookie() {
 }

 #[tokio::test]
-async fn refresh_renews_admin_cookie_and_preserves_fixed_key_expiry() {
+async fn refresh_restores_expired_access_with_only_the_refresh_cookie() {
    let (app, fixture) = auth_app().await;
-    for body in [
+    let response = login(
+        &app,
        json!({"mode": "admin", "password": "strong-admin-password"}),
-        json!({"mode": "key", "apiKey": RAW_KEY}),
-    ] {
-        let response = login(&app, body.clone(), None).await;
-        let cookie = session_cookie(&response);
-        let original = response_json(response).await["data"]["expiresAt"]
-            .as_str()
-            .unwrap()
-            .to_owned();
-        if body["mode"] == "admin" {
-            fixture.set_session_expiry(
-                cookie.split_once('=').unwrap().1,
-                chrono::Utc::now() + chrono::Duration::minutes(1),
-            );
-        }
-        let response = app
-            .clone()
-            .oneshot(cookie_request(Method::POST, "/api/auth/refresh", &cookie))
+        None,
+    )
+    .await;
+    let access = session_cookie(&response);
+    let renewal = refresh_cookie(&response);
+    let cookies: Vec<_> = response
+        .headers()
+        .get_all(header::SET_COOKIE)
+        .iter()
+        .map(|value| value.to_str().unwrap())
+        .collect();
+    assert_eq!(cookies.len(), 2);
+    assert!(cookies[0].contains("Path=/;"));
+    assert!(cookies[1].contains("Path=/api/auth;"));
+    assert!(
+        cookies
+            .iter()
+            .all(|value| value.contains("HttpOnly") && value.contains("SameSite=Lax"))
+    );
+    assert_eq!(
+        response_json(refresh(&app, &access).await).await["data"]["authenticated"],
+        false
+    );
+    fixture.set_session_expiry(
+        access.split_once('=').unwrap().1,
+        chrono::Utc::now() - chrono::Duration::seconds(1),
+    );
+    assert_eq!(
+        get(&app, "/api/admin/system/version", &access)
            .await
-            .unwrap();
-        assert_eq!(response.status(), StatusCode::OK);
-        assert_eq!(response.headers()[header::CACHE_CONTROL], "no-store");
-        assert_eq!(session_cookie(&response), cookie);
-        assert!(
-            response.headers()[header::SET_COOKIE]
-                .to_str()
-                .unwrap()
-                .contains("HttpOnly")
-        );
-        let data = response_json(response).await;
-        assert_eq!(data["data"]["authenticated"], true);
-        let expiry = data["data"]["session"]["expiresAt"].as_str().unwrap();
-        if body["mode"] == "key" {
-            assert_eq!(expiry, original);
-        } else {
-            assert!(
-                chrono::DateTime::parse_from_rfc3339(expiry).unwrap()
-                    > chrono::Utc::now() + chrono::Duration::minutes(1)
-            );
-        }
-    }
+            .status(),
+        StatusCode::UNAUTHORIZED
+    );
+    assert_eq!(
+        response_json(get(&app, "/api/auth/status", &renewal).await).await["data"]["authenticated"],
+        false
+    );
+
+    let response = refresh(&app, &renewal).await;
+    assert_eq!(response.status(), StatusCode::OK);
+    assert_eq!(response.headers()[header::CACHE_CONTROL], "no-store");
+    let next_access = session_cookie(&response);
+    let next_renewal = refresh_cookie(&response);
+    assert_ne!(next_access, access);
+    assert_ne!(next_renewal, renewal);
+    assert_eq!(response_json(response).await["data"]["authenticated"], true);
+    assert_eq!(
+        get(&app, "/api/admin/system/version", &next_access)
+            .await
+            .status(),
+        StatusCode::OK
+    );
+    assert_eq!(
+        get(&app, "/api/admin/system/version", &access)
+            .await
+            .status(),
+        StatusCode::UNAUTHORIZED
+    );
+    // 模拟响应丢失后的重试，返回同一代 Cookie
+    let retry = refresh(&app, &renewal).await;
+    assert_eq!(session_cookie(&retry), next_access);
+    assert_eq!(refresh_cookie(&retry), next_renewal);
+}
+
+#[tokio::test]
+async fn key_refresh_preserves_fixed_expiry_and_clears_admin_refresh_cookie() {
+    let (app, _) = auth_app().await;
+    let admin = login(
+        &app,
+        json!({"mode": "admin", "password": "strong-admin-password"}),
+        None,
+    )
+    .await;
+    let renewal = refresh_cookie(&admin);
+    let response = login(
+        &app,
+        json!({"mode": "key", "apiKey": RAW_KEY}),
+        Some(&renewal),
+    )
+    .await;
+    assert_eq!(refresh_cookie(&response), "cpr_refresh=");
+    assert!(
+        response
+            .headers()
+            .get_all(header::SET_COOKIE)
+            .iter()
+            .any(|value| {
+                let value = value.to_str().unwrap();
+                value.starts_with("cpr_refresh=")
+                    && value.contains("Max-Age=0")
+                    && value.contains("Path=/api/auth;")
+            })
+    );
+    let cookie = session_cookie(&response);
+    let original = response_json(response).await["data"]["expiresAt"].clone();
+    let response = refresh(&app, &cookie).await;
+    assert_eq!(session_cookie(&response), cookie);
+    let data = response_json(response).await;
+    assert_eq!(data["data"]["authenticated"], true);
+    assert_eq!(data["data"]["session"]["expiresAt"], original);
+    assert_eq!(
+        response_json(refresh(&app, &renewal).await).await["data"]["authenticated"],
+        false
+    );
 }

 #[tokio::test]
 async fn refresh_after_logout_or_password_change_cannot_recreate_a_session() {
-    let (app, _) = auth_app().await;
+    let (app, fixture) = auth_app().await;
    for password_change in [false, true] {
-        let cookie = session_cookie(
-            &login(
-                &app,
-                json!({"mode": "admin", "password": "strong-admin-password"}),
-                None,
-            )
-            .await,
-        );
+        let login_response = login(
+            &app,
+            json!({"mode": "admin", "password": "strong-admin-password"}),
+            None,
+        )
+        .await;
+        let cookie = session_cookie(&login_response);
+        let renewal = refresh_cookie(&login_response);
        let response = if password_change {
            change_password(
                &app,
@@ -604,15 +690,34 @@ async fn refresh_after_logout_or_password_change_cannot_recreate_a_session() {
            )
            .await
        } else {
+            fixture.set_session_expiry(
+                cookie.split_once('=').unwrap().1,
+                chrono::Utc::now() - chrono::Duration::seconds(1),
+            );
            app.clone()
-                .oneshot(cookie_request(Method::POST, "/api/auth/logout", &cookie))
+                .oneshot(cookie_request(Method::POST, "/api/auth/logout", &renewal))
                .await
                .unwrap()
        };
        assert_eq!(response.status(), StatusCode::OK);
+        assert_eq!(
+            response
+                .headers()
+                .get_all(header::SET_COOKIE)
+                .iter()
+                .count(),
+            2
+        );
+        assert!(
+            response
+                .headers()
+                .get_all(header::SET_COOKIE)
+                .iter()
+                .all(|value| value.to_str().unwrap().contains("Max-Age=0"))
+        );
        let response = app
            .clone()
-            .oneshot(cookie_request(Method::POST, "/api/auth/refresh", &cookie))
+            .oneshot(cookie_request(Method::POST, "/api/auth/refresh", &renewal))
            .await
            .unwrap();
        assert_eq!(response.status(), StatusCode::OK);
@@ -1,6 +1,6 @@
 //! 验证健康接口按基础设施与关键 Worker 状态判定可用性

-use std::sync::Arc;
+use std::sync::{Arc, Mutex};

 use axum::{
    body::Body,
@@ -13,12 +13,17 @@ use gateway_core::{
        StartProviderExecution, StartedExecution,
    },
    error::GatewayError,
-    health::{WorkerHealthKey, WorkerHealthSnapshot, WorkerHealthSource, WorkerRuntimeState},
+    health::{
+        HealthProbe, HealthState, WorkerHealthKey, WorkerHealthSnapshot, WorkerHealthSource,
+        WorkerRuntimeState,
+    },
    routing::PublicModelId,
    task::{WorkerId, WorkerKind},
 };
 use tower::ServiceExt;

+use crate::support::RecordingDiagnostics;
+
 #[tokio::test]
 async fn healthz_should_return_no_content_when_all_inputs_are_healthy() {
    let response = crate::openai::api_router(Arc::new(UnusedExecution))
@@ -81,6 +86,214 @@ async fn healthz_should_reject_critical_worker_failure() {
    assert_eq!(response.status(), StatusCode::SERVICE_UNAVAILABLE);
 }

+#[tokio::test]
+async fn healthz_records_probe_changes_once_and_records_recurrence_after_recovery() {
+    let probe = Arc::new(MutableProbe(Mutex::new(HealthState::Unhealthy(
+        "file logging rejected records".to_owned(),
+    ))));
+    let diagnostics = Arc::new(RecordingDiagnostics::default());
+    let router = health_router(vec![probe.clone()], Vec::new(), diagnostics.clone()).await;
+
+    let responses =
+        futures::future::join_all((0..8).map(|_| health_response(router.clone()))).await;
+    for response in responses {
+        assert_eq!(response.status(), StatusCode::SERVICE_UNAVAILABLE);
+        assert!(
+            axum::body::to_bytes(response.into_body(), 1024)
+                .await
+                .unwrap()
+                .is_empty()
+        );
+    }
+    {
+        let events = diagnostics.0.lock().unwrap();
+        assert_eq!(events.len(), 1);
+        assert_eq!(events[0].component, "health");
+        assert_eq!(
+            events[0].correlation_id.as_deref(),
+            Some("probe:file_logging")
+        );
+        assert_eq!(events[0].message, "Health check failed");
+        assert!(
+            events[0]
+                .details
+                .as_ref()
+                .unwrap()
+                .as_str()
+                .contains("file logging rejected records")
+        );
+    }
+
+    *probe.0.lock().unwrap() = HealthState::Degraded("file logging maintenance failed".to_owned());
+    assert_eq!(
+        health_response(router.clone()).await.status(),
+        StatusCode::SERVICE_UNAVAILABLE
+    );
+    assert_eq!(diagnostics.0.lock().unwrap().len(), 2);
+    *probe.0.lock().unwrap() = HealthState::Healthy;
+    assert_eq!(
+        health_response(router.clone()).await.status(),
+        StatusCode::NO_CONTENT
+    );
+    *probe.0.lock().unwrap() = HealthState::Degraded("file logging maintenance failed".to_owned());
+    assert_eq!(
+        health_response(router).await.status(),
+        StatusCode::SERVICE_UNAVAILABLE
+    );
+    assert_eq!(diagnostics.0.lock().unwrap().len(), 3);
+}
+
+#[tokio::test(start_paused = true)]
+async fn healthz_retains_worker_and_completed_probe_failures_when_another_probe_times_out() {
+    let diagnostics = Arc::new(RecordingDiagnostics::default());
+    let router = health_router(
+        vec![
+            Arc::new(MutableProbe(Mutex::new(HealthState::Unhealthy(
+                "file output failed".to_owned(),
+            )))),
+            Arc::new(PendingProbe),
+        ],
+        vec![
+            worker_snapshot(
+                WorkerKind::RuntimeSnapshotReconciliation,
+                WorkerRuntimeState::BackingOff,
+            ),
+            worker_snapshot(
+                WorkerKind::QuotaCatalogHealth,
+                WorkerRuntimeState::BackingOff,
+            ),
+        ],
+        diagnostics.clone(),
+    )
+    .await;
+
+    assert_eq!(
+        health_response(router).await.status(),
+        StatusCode::SERVICE_UNAVAILABLE
+    );
+    let events = diagnostics.0.lock().unwrap();
+    assert_eq!(events.len(), 3);
+    for (component, reason) in [
+        (
+            "worker:runtime_snapshot_reconciliation:health-test",
+            "test worker failure",
+        ),
+        ("probe:file_logging", "file output failed"),
+        ("probe:pending", "timed_out"),
+    ] {
+        let event = events
+            .iter()
+            .find(|event| event.correlation_id.as_deref() == Some(component))
+            .expect(component);
+        assert!(event.details.as_ref().unwrap().as_str().contains(reason));
+    }
+}
+
+#[tokio::test]
+async fn healthz_retries_failed_diagnostic_admission_without_changing_health_result() {
+    let diagnostics = Arc::new(FailingOnceDiagnostics::default());
+    let router = health_router(
+        vec![Arc::new(MutableProbe(Mutex::new(HealthState::Unhealthy(
+            "file output failed".to_owned(),
+        ))))],
+        Vec::new(),
+        diagnostics.clone(),
+    )
+    .await;
+
+    assert_eq!(
+        health_response(router.clone()).await.status(),
+        StatusCode::SERVICE_UNAVAILABLE
+    );
+    assert!(diagnostics.recorded.0.lock().unwrap().is_empty());
+    assert_eq!(
+        health_response(router).await.status(),
+        StatusCode::SERVICE_UNAVAILABLE
+    );
+    assert_eq!(diagnostics.recorded.0.lock().unwrap().len(), 1);
+}
+
+#[derive(Default)]
+struct FailingOnceDiagnostics {
+    failed: std::sync::atomic::AtomicBool,
+    recorded: RecordingDiagnostics,
+}
+
+#[async_trait::async_trait]
+impl gateway_core::diagnostics::OperationalDiagnostics for FailingOnceDiagnostics {
+    async fn record_failure(
+        &self,
+        failure: gateway_core::diagnostics::OperationalFailure,
+    ) -> Result<(), gateway_core::error::StoreError> {
+        if !self.failed.swap(true, std::sync::atomic::Ordering::SeqCst) {
+            return Err(gateway_core::error::StoreError::new(
+                gateway_core::error::StoreErrorKind::Unavailable,
+            ));
+        }
+        self.recorded.record_failure(failure).await
+    }
+}
+
+async fn health_router(
+    probes: Vec<Arc<dyn HealthProbe>>,
+    workers: Vec<WorkerHealthSnapshot>,
+    diagnostics: Arc<dyn gateway_core::diagnostics::OperationalDiagnostics>,
+) -> axum::Router {
+    let admin = crate::admin::AdminTestFixture::new().await;
+    gateway_api::initialize(
+        gateway_api::ApiConfig {
+            asset_directory: std::env::temp_dir(),
+            cors_allowed_origins: Vec::new(),
+            request_timeout_seconds: None,
+            request_id_header: "x-request-id".to_owned(),
+        },
+        Arc::new(UnusedExecution),
+        admin.services,
+        probes,
+        Arc::new(StaticWorkerHealth(workers)),
+        Arc::new(crate::openai::TestLifecycle::default()),
+        diagnostics,
+    )
+    .unwrap()
+    .router()
+}
+
+async fn health_response(router: axum::Router) -> axum::response::Response {
+    router
+        .oneshot(
+            Request::builder()
+                .uri("/healthz")
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap()
+}
+
+struct MutableProbe(Mutex<HealthState>);
+
+impl HealthProbe for MutableProbe {
+    fn name(&self) -> &'static str {
+        "file_logging"
+    }
+
+    fn check(&self) -> BoxFuture<'_, HealthState> {
+        Box::pin(std::future::ready(self.0.lock().unwrap().clone()))
+    }
+}
+
+struct PendingProbe;
+
+impl HealthProbe for PendingProbe {
+    fn name(&self) -> &'static str {
+        "pending"
+    }
+
+    fn check(&self) -> BoxFuture<'_, HealthState> {
+        Box::pin(std::future::pending())
+    }
+}
+
 #[derive(Clone)]
 struct StaticWorkerHealth(Vec<WorkerHealthSnapshot>);

@@ -48,8 +48,8 @@ pub(super) async fn fixture() -> AdminTestFixture {
        failure_count: 1,
        input_tokens: 1000,
        output_tokens: 100,
-        cached_tokens: 900,
-        reasoning_tokens: 40,
+        cached_input_tokens: 900,
+        reasoning_output_tokens: 40,
        total_tokens: 1100,
        ..Default::default()
    };
@@ -65,6 +65,7 @@ pub(super) async fn fixture() -> AdminTestFixture {
    {
        let mut observations = fixture.observations.lock().unwrap();
        observations.summary = Some(UsageOverview {
+            analytics: Default::default(),
            range: TimeRange {
                start: now - Duration::hours(1),
                end: now,
@@ -111,9 +112,9 @@ fn usage_record() -> UsageListRecord {
        service_tier: Some("private-sentinel".to_owned()),
        input_tokens: Some(1000),
        output_tokens: Some(100),
-        cached_tokens: Some(900),
-        cache_write_tokens: Some(0),
-        reasoning_tokens: Some(40),
+        cached_input_tokens: Some(900),
+        cache_write_input_tokens: Some(0),
+        reasoning_output_tokens: Some(40),
        image_input_tokens: None,
        image_output_tokens: None,
        total_tokens: Some(1100),
@@ -135,6 +136,13 @@ fn usage_record() -> UsageListRecord {
        first_text_ms: Some(600),
        first_token_ms: Some(210),
        provider_processing_ms: None,
+        upstream_response_ms: Some(1_000),
+        upstream_api_overhead_ms: None,
+        upstream_engine_ms: None,
+        upstream_engine_iapi_ttft_ms: None,
+        upstream_engine_service_ttft_ms: None,
+        upstream_engine_iapi_tbt_ms: Some(2.450638),
+        upstream_engine_service_tbt_ms: None,
        latency_ms: Some(1250),
        admission_decision_ms: None,
        account_selection_wait_ms: None,
@@ -181,6 +181,7 @@ async fn overview_scopes_every_query_and_projects_only_key_visible_fields() {
            "summary",
            "trend",
            "healthTimeline",
+            "analytics",
        ],
    );
    assert_fields(
@@ -203,8 +204,8 @@ async fn overview_scopes_every_query_and_projects_only_key_visible_fields() {
    assert_eq!(data["key"]["dailyUsedUsd"], "0.640001");
    assert_eq!(data["key"]["maxConcurrency"], 0);
    assert_eq!(data["summary"]["totalTokens"], 1100);
-    assert_eq!(data["summary"]["reasoningTokens"], 40);
-    assert_eq!(data["trend"][0]["reasoningTokens"], 40);
+    assert_eq!(data["summary"]["reasoningOutputTokens"], 40);
+    assert_eq!(data["trend"][0]["reasoningOutputTokens"], 40);
    assert_eq!(data["summary"]["costUsd"], "0.123456");
    assert_eq!(data["summary"]["costIncomplete"], true);
    assert_eq!(data["trend"][0]["bucketSeconds"], 900);
@@ -300,14 +301,25 @@ async fn records_keep_pagination_and_hide_admin_and_upstream_data() {
        assert!(!data.to_string().contains("private-sentinel"));
        if kind == "success" {
            assert_eq!(record["billing"]["totalAmountDisplay"], "$0.1235");
-            assert_eq!(record["tokenDetails"]["reasoningTokens"], 40);
+            assert_eq!(record["tokenDetails"]["reasoningOutputTokens"], 40);
            assert_eq!(record["tokenDetails"]["totalTokens"], 1100);
            assert_eq!(record["firstTokenLatencyMs"], 210);
            assert_fields(
                &record["latencyDetails"],
-                &["firstEventMs", "firstReasoningMs", "firstTextMs"],
+                &[
+                    "upstreamResponseMs",
+                    "upstreamEngineIapiTbtMs",
+                    "firstEventMs",
+                    "firstReasoningMs",
+                    "firstTextMs",
+                ],
            );
            assert_eq!(record["latencyDetails"]["firstEventMs"], 100);
+            assert_eq!(record["latencyDetails"]["upstreamResponseMs"], 1000);
+            assert_eq!(
+                record["latencyDetails"]["upstreamEngineIapiTbtMs"],
+                2.450638
+            );
            assert!(record["statusCode"].is_null());
        } else {
            assert_eq!(record["statusCode"], 502);
@@ -419,6 +431,7 @@ async fn empty_usage_has_zero_cost_but_unknown_pricing_stays_unknown() {
        {
            let mut data = fixture.observations.lock().unwrap();
            let summary = data.summary.as_mut().unwrap();
+            summary.analytics.generation += 1;
            summary.requests = RequestMetrics {
                request_count: requests,
                ..Default::default()
@@ -1,5 +1,6 @@
 //! HTTP 与 WebSocket 中间件测试入口及请求生命周期替身

+mod session;
 mod websocket;

 use std::{
@@ -40,6 +41,9 @@ enum Mode {
        idle: bool,
        block_messages: bool,
    },
+    SessionEnd {
+        kind: Option<&'static str>,
+    },
    Service,
    Echo,
    Slow {
@@ -120,7 +124,7 @@ impl MiddlewarePlan for Plan {
        assert!(input.is_null());
        Box::pin(async move {
            let mut result = next.run(input).await?;
-            result["request_interval_ms"] = serde_json::json!(4321);
+            result["refresh_margin_seconds"] = serde_json::json!(4321);
            Ok(result)
        })
    }
@@ -161,13 +165,43 @@ impl MiddlewarePlan for Plan {
                        session.send(Message { kind: Kind::Text, payload: Bytes::from_static(b"ready") }).await?;
                        let message = receive.await?.unwrap();
                        session.send(message).await?;
-                        session.send(Message { kind: Kind::Close { code: Some(1000) }, payload: Bytes::from_static(b"done") }).await
+                        session.send(Message { kind: Kind::Close { code: Some(1000) }, payload: Bytes::from_static(b"done") }).await.map_err(Into::into)
                    })));
                    if reject {
                        *response.status_mut() = StatusCode::FORBIDDEN;
                    }
                    Ok(response)
                }
+                Mode::SessionEnd { kind } => {
+                    let upgrade = request
+                        .extensions_mut()
+                        .remove::<Arc<dyn contract::upgrade::WebSocketUpgrade>>()
+                        .unwrap();
+                    let (parts, _) = request.into_parts();
+                    let (mut response, session) = upgrade.accept(parts, Vec::new()).await?;
+                    response
+                        .extensions_mut()
+                        .insert(contract::upgrade::Upgraded::new(
+                            StatusCode::SWITCHING_PROTOCOLS,
+                            Box::pin(async move {
+                                let _session = session.await.map_err(|_| MiddlewareError::Fault)?;
+                                match kind {
+                                    None => Ok(()),
+                                    Some("cancelled") => {
+                                        Err(contract::upgrade::SessionError::Cancelled)
+                                    }
+                                    Some("reported") => {
+                                        Err(contract::upgrade::SessionError::Reported)
+                                    }
+                                    Some(kind) => Err(contract::upgrade::SessionError::Failed {
+                                        kind,
+                                        plugin_instance_id: Some("plugin-fixture".into()),
+                                    }),
+                                }
+                            }),
+                        ));
+                    Ok(response)
+                }
                Mode::Rewrite => {
                    assert_eq!(request.uri(), "/unrecognized/client/path?raw=%2f%FF");
                    assert_eq!(request.headers()["authorization"], "Bearer fixture-secret");
@@ -389,7 +423,7 @@ async fn admin_http_does_not_invoke_service_middleware_for_native_business_metho
        .await
        .unwrap();
    let result: serde_json::Value = serde_json::from_slice(&bytes).unwrap();
-    assert_ne!(result["data"]["requestIntervalMs"], 4321);
+    assert_ne!(result["data"]["refreshMarginSeconds"], 4321);
    assert_eq!(plan.calls.load(Ordering::SeqCst), 0);
 }

@@ -0,0 +1,79 @@
+//! 验证升级后终态只记录一次安全分类，正常结束及已报告失败不重复输出
+
+use super::*;
+use tracing::{
+    Event, Metadata, Subscriber,
+    span::{Attributes, Id, Record},
+};
+
+#[derive(Clone, Default)]
+struct Recorder(Arc<Mutex<Vec<String>>>);
+
+impl Subscriber for Recorder {
+    fn enabled(&self, _: &Metadata<'_>) -> bool {
+        true
+    }
+    fn new_span(&self, _: &Attributes<'_>) -> Id {
+        Id::from_u64(1)
+    }
+    fn record(&self, _: &Id, _: &Record<'_>) {}
+    fn record_follows_from(&self, _: &Id, _: &Id) {}
+    fn enter(&self, _: &Id) {}
+    fn exit(&self, _: &Id) {}
+    fn event(&self, event: &Event<'_>) {
+        struct Fields(String);
+        impl tracing::field::Visit for Fields {
+            fn record_debug(&mut self, field: &tracing::field::Field, value: &dyn std::fmt::Debug) {
+                use std::fmt::Write as _;
+                write!(&mut self.0, "{}={value:?} ", field.name()).unwrap();
+            }
+        }
+        let mut fields = Fields(String::new());
+        event.record(&mut fields);
+        if fields.0.contains("middleware.session.failed") {
+            self.0.lock().unwrap().push(fields.0);
+        }
+    }
+}
+
+#[tokio::test]
+async fn upgraded_session_records_one_correlated_failure_and_ignores_expected_endings() {
+    use tokio_tungstenite::{connect_async, tungstenite::client::IntoClientRequest as _};
+    for kind in [
+        None,
+        Some("cancelled"),
+        Some("reported"),
+        Some("permission_denied"),
+    ] {
+        let recorder = Recorder::default();
+        let _subscriber = tracing::subscriber::set_default(recorder.clone());
+        let (router, plan) = router(Mode::SessionEnd { kind }, None).await;
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let address = listener.local_addr().unwrap();
+        let server = tokio::spawn(async move {
+            axum::serve(listener, router).await.unwrap();
+        });
+        let mut request = format!("ws://{address}/plugin-owned/session")
+            .into_client_request()
+            .unwrap();
+        request
+            .headers_mut()
+            .insert("x-request-id", "session-regression".parse().unwrap());
+        let (_socket, response) = connect_async(request).await.unwrap();
+        assert_eq!(response.status(), StatusCode::SWITCHING_PROTOCOLS);
+        let cancellation = plan.cancellation.lock().unwrap().clone().unwrap();
+        tokio::time::timeout(Duration::from_secs(3), cancellation.cancelled())
+            .await
+            .unwrap();
+        let events = recorder.0.lock().unwrap();
+        if kind == Some("permission_denied") {
+            assert_eq!(events.len(), 1, "{events:?}");
+            assert!(events[0].contains("session-regression"));
+            assert!(events[0].contains("plugin-fixture"));
+            assert!(events[0].contains("permission_denied"));
+        } else {
+            assert!(events.is_empty(), "{events:?}");
+        }
+        server.abort();
+    }
+}
@@ -13,6 +13,40 @@ use gateway_api::openai::error::{
    gateway_error_response, openai_error_response,
 };

+#[tokio::test]
+async fn ordinary_upstream_rejections_preserve_status_body_and_client_retry_advice() {
+    use bytes::Bytes;
+    use gateway_core::error::ClientVisibleUpstreamResponse;
+    use gateway_core::event::ProviderResponseHeader;
+
+    let body = Bytes::from_static(br#"{ "error":{"code":"Vendor.Future.v2","type":"server_error","message":"original failure","future":9007199254740993} }"#);
+    for status in [400, 409, 500, 503, 504] {
+        let error = EngineError::Provider(
+            ProviderError::new(ProviderErrorKind::Unavailable, UpstreamSendState::NotSent)
+                .with_retry_prohibited()
+                .with_client_visible_upstream_response(
+                    ClientVisibleUpstreamResponse::new(
+                        status,
+                        Some(b"application/problem+json".to_vec()),
+                        body.clone(),
+                    )
+                    .with_headers(vec![ProviderResponseHeader::new(
+                        "retry-after",
+                        Bytes::from_static(b"17"),
+                    )]),
+                ),
+        );
+        let response = engine_error_response(&error);
+        assert_eq!(response.status().as_u16(), status);
+        assert_eq!(
+            response.headers()["content-type"],
+            "application/problem+json"
+        );
+        assert_eq!(response.headers()["retry-after"], "17");
+        assert_eq!(to_bytes(response.into_body(), 4096).await.unwrap(), body);
+    }
+}
+
 #[tokio::test]
 async fn capacity_errors_offer_client_retry_without_changing_upstream_facts() {
    use bytes::Bytes;
@@ -10,6 +10,7 @@ use axum::{
    body::{Body, to_bytes},
    http::{Request, StatusCode, header::AUTHORIZATION},
 };
+use base64::{Engine as _, engine::general_purpose::STANDARD};
 use bytes::Bytes;
 use futures::future::BoxFuture;
 use gateway_core::engine::execution::{
@@ -300,6 +301,11 @@ async fn image_routes_should_not_decode_bodies_and_should_preserve_both_directio
                    .header("x-codex-image-turn-id", "turn_image_route")
                    .header("session-id", "root-image-session")
                    .header("thread-id", "child-image-thread")
+                    .header("x-future-business", "first")
+                    .header("x-future-business", "second")
+                    .header("cookie", "client-secret")
+                    .header("connection", "x-private-hop")
+                    .header("x-private-hop", "client-hop")
                    .body(Body::from(body.to_vec()))
                    .expect("image request"),
            )
@@ -338,8 +344,37 @@ async fn image_routes_should_not_decode_bodies_and_should_preserve_both_directio
        assert_eq!(captured.transport, ClientTransport::HttpJson);
        assert_eq!(captured.kind, *kind);
        assert_eq!(captured.body.as_ref(), *body);
+        let mut context = captured.context.clone();
+        let headers = context
+            .as_object_mut()
+            .unwrap()
+            .remove("opaque_request_headers")
+            .unwrap();
+        let headers: Vec<_> = headers
+            .as_array()
+            .unwrap()
+            .iter()
+            .map(|entry| {
+                (
+                    entry[0].as_str().unwrap(),
+                    STANDARD.decode(entry[1].as_str().unwrap()).unwrap(),
+                )
+            })
+            .collect();
        assert_eq!(
-            captured.context,
+            headers
+                .iter()
+                .filter(|(name, _)| *name == "x-future-business")
+                .map(|(_, value)| value.as_slice())
+                .collect::<Vec<_>>(),
+            [b"first".as_slice(), b"second".as_slice()]
+        );
+        assert!(!headers.iter().any(|(name, _)| matches!(
+            *name,
+            "authorization" | "cookie" | "connection" | "x-private-hop"
+        )));
+        assert_eq!(
+            context,
            json!({"image_turn_id": "turn_image_route", "session_id": "root-image-session", "thread_id": "child-image-thread"})
        );
    }
@@ -283,19 +283,32 @@ fn snapshot_with_client_key(
    plaintext: &str,
    provider_name: &str,
    client_key_id: &str,
+) -> RuntimeSnapshot {
+    snapshot_with_accounts(plaintext, provider_name, client_key_id, &["acct_api_test"])
+}
+
+fn snapshot_with_accounts(
+    plaintext: &str,
+    provider_name: &str,
+    client_key_id: &str,
+    accounts: &[&str],
 ) -> RuntimeSnapshot {
    let provider = ProviderKind::new(provider_name).expect("provider");
-    let account_directory = Arc::new(RuntimeAccountDirectory::new(BTreeMap::from([(
-        ProviderAccountId::new("acct_api_test").expect("account ID"),
-        RuntimeAccount::new(provider.clone(), BTreeSet::new()),
-    )])));
+    let account_directory = Arc::new(RuntimeAccountDirectory::new(BTreeMap::from_iter(
+        accounts.iter().map(|id| {
+            (
+                ProviderAccountId::new(*id).expect("account ID"),
+                RuntimeAccount::new(provider.clone(), BTreeSet::new()),
+            )
+        }),
+    )));
    let capabilities = ModelCapabilities::new(
        BTreeSet::from([gateway_core::operation::OperationKind::Generate]),
        Some(16_000),
    );
    RuntimeSnapshot::new(
        ConfigRevision::new(1).expect("revision"),
-        gateway_core::settings::SettingsValues::new(2, 1, "smart", Default::default(), None, None),
+        gateway_core::settings::SettingsValues::new(2, "smart", Default::default(), None, None),
        vec![provider.clone()],
        ["model-a", "model-b"]
            .into_iter()
@@ -323,7 +336,7 @@ fn snapshot_with_client_key(
 }

 #[derive(Default)]
-struct TestLifecycle {
+pub(crate) struct TestLifecycle {
    cancellation: gateway_core::lifecycle::CancellationToken,
 }

@@ -23,7 +23,7 @@ use futures::StreamExt;
 use futures::future::{BoxFuture, pending};
 use gateway_core::engine::execution::{
    AuthenticatedClient, ClientAuthenticationError, ExecutionService, ExecutionSession,
-    StartExecution, StartProviderExecution, StartedExecution,
+    ResponseCommit, StartExecution, StartProviderExecution, StartedExecution,
 };
 use gateway_core::engine::middleware::{FrozenMiddlewarePlan, MiddlewareHeader};
 use gateway_core::engine::{CommitRequirement, CoordinatedEvent, EngineError, ModelRequestId};
@@ -58,6 +58,7 @@ fn responses_middleware() -> RequestMiddleware {

 #[derive(Default)]
 struct Trace {
+    response_commit: ResponseCommit,
    events: Mutex<Vec<&'static str>>,
    client_statuses: Mutex<Vec<u16>>,
    cancelled: AtomicBool,
@@ -77,7 +78,7 @@ impl Trace {
        self.client_statuses
            .lock()
            .expect("client status lock")
-            .push(status);
+            .push(self.response_commit.status_code().unwrap_or(status));
    }

    fn client_statuses(&self) -> Vec<u16> {
@@ -104,6 +105,7 @@ enum NextStep {
    Event(CoordinatedEvent),
    DelayedEvent(Duration, CoordinatedEvent),
    Error(EngineError),
+    DelayedError(Duration, EngineError),
    FinalizeCancelled,
    FinalizeSuccess,
    End,
@@ -297,6 +299,10 @@ impl FakeSession {
 }

 impl ExecutionSession for FakeSession {
+    fn response_commit(&self) -> ResponseCommit {
+        self.trace.response_commit.clone()
+    }
+
    fn next_event(&mut self) -> BoxFuture<'_, Result<Option<CoordinatedEvent>, EngineError>> {
        Box::pin(async move {
            match self.next.pop_front().unwrap_or(NextStep::End) {
@@ -310,6 +316,13 @@ impl ExecutionSession for FakeSession {
                    self.trace.push("next_event");
                    Ok(Some(event))
                }
+                NextStep::DelayedError(delay, error) => {
+                    self.trace.push("wait_error");
+                    tokio::time::sleep(delay).await;
+                    self.trace.push("next_error");
+                    self.finalized = true;
+                    Err(error)
+                }
                NextStep::Error(error) => {
                    self.trace.push("next_error");
                    self.finalized = true;
@@ -1288,27 +1301,203 @@ async fn dropping_stream_during_keepalive_should_cancel_and_finalize_execution()
 }

 #[tokio::test(start_paused = true)]
-async fn streaming_keepalive_should_wait_for_first_event_before_committing_http_status() {
+async fn streaming_keepalive_should_cover_four_minutes_before_first_event() {
    let trace = Arc::new(Trace::default());
    let session = FakeSession::streaming(
        Arc::clone(&trace),
        vec![
            NextStep::DelayedEvent(
-                Duration::from_secs(45),
-                delivery(started(), CommitRequirement::CommitBeforeDelivery),
+                Duration::from_secs(240),
+                delivery(completed(), CommitRequirement::CommitBeforeDelivery),
+            ),
+            NextStep::FinalizeSuccess,
+        ],
+    );
+    let start = tokio::time::Instant::now();
+    let response = tokio::time::timeout(
+        Duration::from_secs(20),
+        stream_execution_response(Box::new(session), None),
+    )
+    .await
+    .expect("headers and heartbeat must precede the first upstream event");
+    assert_eq!(response.status(), StatusCode::OK);
+    assert_eq!(response.headers()[CONTENT_TYPE], "text/event-stream");
+    assert_eq!(trace.response_commit.status_code(), Some(200));
+    let mut body = response.into_body().into_data_stream();
+    for heartbeat in 1..16 {
+        let chunk = tokio::time::timeout(Duration::from_secs(20), body.next())
+            .await
+            .expect("first-event wait must stay alive")
+            .expect("heartbeat")
+            .expect("bytes");
+        assert_eq!(chunk, Bytes::from_static(b": keep-alive\n\n"));
+        assert_eq!(start.elapsed(), Duration::from_secs(15 * heartbeat));
+        assert_eq!(trace.snapshot(), vec!["wait_event"]);
+    }
+    let terminal = body.next().await.expect("terminal").expect("bytes");
+    assert!(String::from_utf8_lossy(&terminal).contains("response.completed"));
+    assert_eq!(start.elapsed(), Duration::from_secs(240));
+    assert_eq!(
+        body.next().await.unwrap().unwrap(),
+        Bytes::from_static(b"data: [DONE]\n\n")
+    );
+    assert!(body.next().await.is_none());
+    assert_eq!(
+        trace.snapshot(),
+        vec!["wait_event", "next_event", "commit", "next_end"]
+    );
+    assert!(!trace.is_cancelled());
+}
+
+#[tokio::test(start_paused = true)]
+async fn streaming_error_after_initial_keepalive_should_be_a_terminal_sse_failure() {
+    let trace = Arc::new(Trace::default());
+    let session = FakeSession::streaming(
+        Arc::clone(&trace),
+        vec![NextStep::DelayedError(
+            Duration::from_secs(45),
+            EngineError::Deadline,
+        )],
+    )
+    .with_response_headers(headers(&[("x-codex-turn-state", "private-attempt-state")]));
+    let response = stream_execution_response(Box::new(session), None).await;
+    assert_eq!(response.status(), StatusCode::OK);
+    assert!(!response.headers().contains_key("x-codex-turn-state"));
+    let bytes = to_bytes(response.into_body(), usize::MAX).await.unwrap();
+    let events = parse_sse_events(std::str::from_utf8(&bytes).unwrap()).unwrap();
+    assert!(String::from_utf8_lossy(&bytes).starts_with(": keep-alive\n\n"));
+    let failed = events
+        .iter()
+        .find(|event| event.event.as_deref() == Some("response.failed"))
+        .expect("failure event");
+    let payload: Value = serde_json::from_str(&failed.data).unwrap();
+    assert_eq!(payload["response"]["error"]["code"], "request_timeout");
+    assert!(bytes.ends_with(b"data: [DONE]\n\n"));
+    assert_eq!(trace.client_statuses(), vec![200]);
+    assert_eq!(trace.snapshot(), vec!["wait_error", "next_error"]);
+}
+
+#[tokio::test(start_paused = true)]
+async fn streaming_late_upstream_error_should_preserve_extended_error_fields() {
+    let mut error = json!({
+        "type": "invalid_request_error", "code": "misalignment_policy_violation",
+        "message": "synthetic policy error", "misalignment": {"category": "synthetic"},
+        "extension": {"opaque": true}
+    });
+    let failure = ProviderError::new(ProviderErrorKind::InvalidRequest, UpstreamSendState::Sent)
+        .with_client_visible_upstream_response(
+            ClientVisibleUpstreamResponse::new(
+                400,
+                Some(b"application/json".to_vec()),
+                Bytes::from(json!({"error": error}).to_string()),
+            )
+            .with_headers(headers(&[("retry-after", "7")])),
+        );
+    error["headers"] = json!({"retry-after": "7"});
+    let session = FakeSession::streaming(
+        Arc::new(Trace::default()),
+        vec![NextStep::DelayedError(
+            Duration::from_secs(30),
+            EngineError::Provider(failure),
+        )],
+    );
+    let response = stream_execution_response(Box::new(session), None).await;
+    assert_eq!(response.status(), StatusCode::OK);
+    let bytes = to_bytes(response.into_body(), usize::MAX).await.unwrap();
+    let events = parse_sse_events(std::str::from_utf8(&bytes).unwrap()).unwrap();
+    let failed = events
+        .iter()
+        .find(|event| event.event.as_deref() == Some("response.failed"))
+        .unwrap();
+    let payload: Value = serde_json::from_str(&failed.data).unwrap();
+    assert_eq!(payload["response"]["error"], error);
+    assert!(bytes.ends_with(b"data: [DONE]\n\n"));
+}
+
+#[tokio::test]
+async fn responses_http_connection_should_survive_a_shorter_read_idle_timeout() {
+    use tokio::io::{AsyncReadExt as _, AsyncWriteExt as _};
+
+    let trace = Arc::new(Trace::default());
+    let session = FakeSession::streaming(
+        Arc::clone(&trace),
+        vec![
+            NextStep::DelayedEvent(
+                Duration::from_secs(35),
+                delivery(completed(), CommitRequirement::CommitBeforeDelivery),
+            ),
+            NextStep::FinalizeSuccess,
+        ],
+    );
+    let execution = Arc::new(SessionExecution {
+        client: authenticated_client_for_provider("sk_correlation_test", "openai"),
+        session: Mutex::new(Some(Box::new(session))),
+        middleware: Some(Arc::new(responses_middleware()).frozen()),
+    });
+    let app = api_router(execution).await;
+    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+    let address = listener.local_addr().unwrap();
+    let server = tokio::spawn(async move { axum::serve(listener, app).await.unwrap() });
+    let mut client = tokio::net::TcpStream::connect(address).await.unwrap();
+    let body = json!({"model": "model-a", "input": "synthetic", "stream": true}).to_string();
+    client.write_all(format!(
+        "POST /v1/responses HTTP/1.1\r\nHost: {address}\r\nAuthorization: Bearer sk_correlation_test\r\nUser-Agent: AnotherTerminal/1.0\r\nContent-Type: application/json\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{body}", body.len()
+    ).as_bytes()).await.unwrap();
+    let mut received = Vec::new();
+    let result = async {
+        loop {
+            let mut buffer = [0; 4096];
+            // 真实 TCP 每次读取都受空闲期限约束，首个业务事件晚于该期限
+            let read =
+                tokio::time::timeout(Duration::from_secs(20), client.read(&mut buffer)).await?;
+            let count = read.unwrap();
+            if count == 0 {
+                break;
+            }
+            received.extend_from_slice(&buffer[..count]);
+        }
+        Ok::<(), tokio::time::error::Elapsed>(())
+    }
+    .await;
+    server.abort();
+    result.expect("HTTP connection must receive keepalive before its read idle deadline");
+    let wire = String::from_utf8(received).unwrap();
+    assert!(wire.starts_with("HTTP/1.1 200 OK\r\n"));
+    assert!(wire.contains("x-accel-buffering: no\r\n"));
+    assert_eq!(wire.matches(": keep-alive\n\n").count(), 2);
+    assert!(wire.contains("response.completed"));
+    assert!(wire.contains("data: [DONE]\n\n"));
+    assert!(!trace.is_cancelled());
+    assert_eq!(
+        trace.snapshot(),
+        vec!["wait_event", "next_event", "commit", "next_end"]
+    );
+}
+
+#[tokio::test(start_paused = true)]
+async fn dropping_stream_before_first_event_should_cancel_the_original_wait() {
+    let trace = Arc::new(Trace::default());
+    let session = FakeSession::streaming(
+        Arc::clone(&trace),
+        vec![
+            NextStep::DelayedEvent(
+                Duration::from_secs(240),
+                delivery(completed(), CommitRequirement::CommitBeforeDelivery),
            ),
            NextStep::FinalizeCancelled,
        ],
    );
-    let response = tokio::spawn(stream_execution_response(Box::new(session), None));
+    let response = stream_execution_response(Box::new(session), None).await;
+    let mut body = response.into_body().into_data_stream();
+    assert_eq!(
+        body.next().await.unwrap().unwrap(),
+        Bytes::from_static(b": keep-alive\n\n")
+    );
+    drop(body);
    tokio::task::yield_now().await;
-    tokio::time::advance(Duration::from_secs(30)).await;
-
-    assert!(!response.is_finished());
-    assert!(trace.client_statuses().is_empty());
-    let response = response.await.expect("response task");
-    assert_eq!(response.status(), StatusCode::OK);
-    assert_eq!(trace.snapshot(), vec!["wait_event", "next_event", "commit"]);
+    assert!(trace.is_cancelled());
+    assert_eq!(trace.detached_finalizations(), 1);
+    assert_eq!(trace.snapshot(), vec!["wait_event", "cancel_finalize"]);
 }

 #[tokio::test]
@@ -2279,6 +2468,7 @@ async fn buffered_response_commits_only_after_complete_json_is_encoded() {
 async fn buffered_response_collects_completed_output_items_without_rewriting_streams() {
    let message = json!({
        "id": "msg_test", "type": "message", "role": "assistant", "status": "completed",
+        "phase": "partial_answer",
        "content": [{"type": "output_text", "text": "完整文本", "annotations": []}],
        "future_item_field": {"keep": true}
    });
@@ -2288,6 +2478,7 @@ async fn buffered_response_collects_completed_output_items_without_rewriting_str
    });
    let terminal = json!({
        "id": "resp_test", "status": "completed", "output": [],
+        "end_turn": false,
        "usage": {"input_tokens": 20, "output_tokens": 8, "total_tokens": 28},
        "future_terminal_field": {"keep": true}
    });
@@ -3020,3 +3211,117 @@ async fn compressed_http_request_above_default_limit_should_reach_execution_afte
        }
    }
 }
+
+#[tokio::test]
+async fn streaming_middleware_preserves_heartbeats_before_and_after_rewriting() {
+    for opaque in [
+        b": ping\n\n".as_slice(),
+        b"id: next\nretry: 1000\n\n".as_slice(),
+        b"event: vendor.future\ndata: future non-JSON payload\n\n".as_slice(),
+    ] {
+        let admin = crate::admin::AdminTestFixture::new().await.services;
+        let trace = Arc::new(Trace::default());
+        let heartbeat = Bytes::copy_from_slice(opaque);
+        let future = Bytes::from_static(
+            b"event: response.future\ndata: {\"type\":\"response.future\",\"extension\":true}\n\n",
+        );
+        let session = FakeSession::streaming(
+            Arc::clone(&trace),
+            vec![
+                NextStep::Event(delivery(started(), CommitRequirement::CommitBeforeDelivery)),
+                NextStep::Event(delivery_provider(
+                    ProviderEvent::wire(
+                        ProtocolWireEvent::raw_sse("openai", heartbeat.clone()).unwrap(),
+                    ),
+                    CommitRequirement::AlreadyCommitted,
+                )),
+                NextStep::Event(delivery_provider(
+                    ProviderEvent::wire(
+                        ProtocolWireEvent::raw_sse("openai", future.clone()).unwrap(),
+                    ),
+                    CommitRequirement::AlreadyCommitted,
+                )),
+                NextStep::Event(delivery_provider(
+                    ProviderEvent::wire(
+                        ProtocolWireEvent::raw_sse("openai", heartbeat.clone()).unwrap(),
+                    ),
+                    CommitRequirement::AlreadyCommitted,
+                )),
+                NextStep::Event(delivery(completed(), CommitRequirement::AlreadyCommitted)),
+                NextStep::FinalizeSuccess,
+            ],
+        );
+        let replacement = Bytes::from_static(b"event: response.future\ndata: {\"type\":\"response.future\",\"extension\":\"changed\"}\n\n");
+        let middleware = Arc::new(responses_middleware().with_response_actions(vec![
+            ResponseFrameAction::Continue,
+            ResponseFrameAction::Continue,
+            ResponseFrameAction::Replace(replacement.clone()),
+            ResponseFrameAction::Continue,
+            ResponseFrameAction::Continue,
+            ResponseFrameAction::Continue,
+        ]));
+        let response =
+            response_with_middleware(&admin, "openai", session, true, Some(middleware)).await;
+        let body = to_bytes(response.into_body(), usize::MAX).await.unwrap();
+        let text = std::str::from_utf8(&body).unwrap();
+        assert_eq!(
+            text.matches(std::str::from_utf8(opaque).unwrap()).count(),
+            2
+        );
+        assert!(text.contains(std::str::from_utf8(&replacement).unwrap()));
+        assert!(text.contains("response.completed"));
+        assert!(!text.contains("middleware_failed"));
+        assert!(text.ends_with("data: [DONE]\n\n"));
+        assert!(!trace.is_cancelled());
+    }
+}
+
+#[tokio::test(start_paused = true)]
+async fn responses_route_should_keep_alive_while_request_middleware_waits_for_first_event() {
+    let admin = crate::admin::AdminTestFixture::new().await.services;
+    for invalid_output in [false, true] {
+        let trace = Arc::new(Trace::default());
+        let session = FakeSession::streaming(
+            Arc::clone(&trace),
+            vec![
+                NextStep::DelayedEvent(
+                    Duration::from_secs(150),
+                    delivery(started(), CommitRequirement::CommitBeforeDelivery),
+                ),
+                NextStep::Event(delivery(completed(), CommitRequirement::AlreadyCommitted)),
+                NextStep::FinalizeSuccess,
+            ],
+        );
+        let actions = if invalid_output {
+            vec![ResponseFrameAction::Replace(Bytes::from_static(
+                b"data: {invalid-json}\n\n",
+            ))]
+        } else {
+            Vec::new()
+        };
+        let middleware = Arc::new(responses_middleware().with_response_actions(actions));
+        let response = tokio::time::timeout(
+            Duration::from_secs(20),
+            response_with_middleware(&admin, "openai", session, true, Some(middleware)),
+        )
+        .await
+        .expect("request middleware must not block transport keepalive");
+        assert_eq!(response.status(), StatusCode::OK);
+        assert!(response.headers().contains_key("x-gateway-request-id"));
+        let bytes = to_bytes(response.into_body(), usize::MAX).await.unwrap();
+        let text = std::str::from_utf8(&bytes).unwrap();
+        assert!(text.starts_with(": keep-alive\n\n"));
+        assert!(text.ends_with("data: [DONE]\n\n"));
+        if invalid_output {
+            assert!(text.contains("response.failed"));
+            assert!(text.contains("middleware_failed"));
+            assert!(!text.contains("{invalid-json}"));
+            assert!(trace.is_cancelled());
+        } else {
+            assert!(text.contains("response.completed"));
+            assert!(!text.contains("response.failed"));
+            assert!(!trace.is_cancelled());
+        }
+        assert_eq!(trace.client_statuses(), vec![200]);
+    }
+}
@@ -1071,3 +1071,35 @@ fn transparent_encoder_should_only_require_wire_terminal_for_buffered_conversion
        ResponseEncodeError::MissingWireTerminal
    );
 }
+
+#[test]
+fn metadata_keeps_business_extensions_and_filters_only_protected_headers() {
+    let data = json!({
+        "type":"response.metadata",
+        "headers":{"x-future-header":["first","second"],"authorization":"private","set-cookie":"private","chatgpt-account-id":"private","connection":"x-private-hop","x-private-hop":"private"},
+        "metadata":{"type":"safety_buffering","use_cases":["cyber"],"reasons":["user_risk"],"openai_verification_recommendation":{"future":true},"openai_chatgpt_moderation_metadata":{"future":true}},
+        "future_extension":{"keep":true}
+    });
+    let raw = data.to_string();
+    let event = ProviderEvent::wire(
+        ProtocolWireEvent::json("openai", Some("response.metadata".to_owned()), data.clone())
+            .unwrap()
+            .with_raw_websocket_message(raw.as_str()),
+    );
+    let mut encoder = OpenAiResponsesEncoder::new();
+    let ws = encoder.push_websocket(&event);
+    let delivered: Value = serde_json::from_str(&ws[0]).unwrap();
+    assert_eq!(delivered["metadata"], data["metadata"]);
+    assert_eq!(delivered["future_extension"], data["future_extension"]);
+    assert_eq!(
+        delivered["headers"],
+        json!({"x-future-header":["first","second"]})
+    );
+    let sse = encoder.push_sse(&event);
+    assert!(!std::str::from_utf8(&sse[0]).unwrap().contains("private"));
+    assert!(
+        std::str::from_utf8(&sse[0])
+            .unwrap()
+            .contains("safety_buffering")
+    );
+}
@@ -221,7 +221,7 @@ async fn turns_refresh_host_settings_and_key_identity_while_preserving_handshake
                .unwrap();
            let baseline = settings.runtime.as_ref().unwrap();
            let mut values = serde_json::to_value(baseline.values()).unwrap();
-            values["request_interval_ms"] = json!(0);
+            values["max_account_rotations"] = json!(0);
            settings.runtime = Some(
                baseline
                    .replace(serde_json::from_value(values).unwrap(), "handshake")
@@ -292,7 +292,7 @@ async fn turns_refresh_host_settings_and_key_identity_while_preserving_handshake
    for round in 0..3 {
        if round == 1 {
            let mut settings = serde_json::to_value(initial.settings()).unwrap();
-            settings["request_interval_ms"] = json!(50);
+            settings["max_account_rotations"] = json!(5);
            settings["responses_max_decompressed_body_bytes"] = json!(2048);
            snapshots.publish(
                initial
@@ -337,8 +337,8 @@ async fn turns_refresh_host_settings_and_key_identity_while_preserving_handshake
            observed[1]["runtime"]["responses_max_decompressed_body_bytes"],
            2048
        );
-        assert_eq!(observed[0]["runtime"]["request_interval_ms"], 0);
-        assert_eq!(observed[1]["runtime"]["request_interval_ms"], 0);
+        assert_eq!(observed[0]["runtime"]["max_account_rotations"], 0);
+        assert_eq!(observed[1]["runtime"]["max_account_rotations"], 0);
    }
    socket.close(None).await.unwrap();
    server.abort();
@@ -106,10 +106,18 @@ async fn next_error(socket: &mut TestSocket) -> Value {
 }

 async fn assert_no_duplicate_failure(socket: &mut TestSocket) {
-    // 后续入站帧只会在本轮收敛后处理，比固定等待窗口更可靠地检查没有重复失败终态
-    socket.send(Message::Text("{".into())).await.unwrap();
+    // 无效创建帧仍走串行队列，以本地业务校验作为本轮收敛后的屏障
+    socket
+        .send(Message::Text(
+            json!({"type":"response.create","model":"model-a","stream":false})
+                .to_string()
+                .into(),
+        ))
+        .await
+        .unwrap();
    let error = next_event(socket).await;
-    assert_eq!(error["error"]["code"], "invalid_json");
+    assert_eq!(error["error"]["code"], "invalid_value");
+    assert_eq!(error["error"]["param"], "stream");
    assert_eq!(error["status"], 400);
    assert_eq!(error["headers"]["x-request-id"], error["request_id"]);
    assert_eq!(
@@ -1,12 +1,73 @@
-//! 验证 Responses WebSocket 中断向当前执行传递并释放相关资源
+//! 验证未知控制消息、迟到中断、结算期间收发和创建请求的串行准入

 use super::*;
-use gateway_core::engine::response_control::{ResponseControl, ResponseInterruptError};
+use gateway_core::engine::response_control::{
+    ResponseControlTransport, ResponseControlUnavailable,
+};
+
+struct ControlTransport {
+    id: String,
+    active: std::sync::atomic::AtomicBool,
+    requests: Mutex<Vec<String>>,
+    sender: tokio::sync::mpsc::Sender<Value>,
+    receiver: tokio::sync::Mutex<tokio::sync::mpsc::Receiver<Value>>,
+}
+
+impl ControlTransport {
+    fn new(id: String) -> Self {
+        let (sender, receiver) = tokio::sync::mpsc::channel(32);
+        Self {
+            id,
+            active: std::sync::atomic::AtomicBool::new(true),
+            requests: Mutex::default(),
+            sender,
+            receiver: tokio::sync::Mutex::new(receiver),
+        }
+    }
+}
+
+#[async_trait]
+impl ResponseControlTransport for ControlTransport {
+    async fn send(&self, payload: &str) -> Result<(), ResponseControlUnavailable> {
+        self.requests.lock().unwrap().push(payload.to_owned());
+        let original: Value =
+            serde_json::from_str(payload).unwrap_or_else(|_| Value::String(payload.to_owned()));
+        let event = if original["type"] == "future.reject" {
+            upstream_control_error()
+        } else if original["type"] == "response.interrupt"
+            && original["response_id"] == self.id
+            && original["mode"] == "discard_partial_items"
+            && self.active.load(Ordering::SeqCst)
+        {
+            json!({"type":"response.incomplete", "response":{"id":self.id,"model":"model-a","status":"incomplete","output":[],"incomplete_details":{"reason":"interrupted"}}})
+        } else {
+            json!({"type":"future.control.ack", "original":original})
+        };
+        self.sender
+            .send(event)
+            .await
+            .map_err(|_| ResponseControlUnavailable)
+    }
+    async fn receive(&self) -> Result<String, ResponseControlUnavailable> {
+        self.receiver
+            .lock()
+            .await
+            .recv()
+            .await
+            .map(|event| event.to_string())
+            .ok_or(ResponseControlUnavailable)
+    }
+}

 #[derive(Default)]
 struct InterruptProvider {
    calls: AtomicUsize,
-    controls: Mutex<Vec<ResponseControl>>,
+    fail_first: bool,
+    retry_started: tokio::sync::Notify,
+    retry_release: tokio::sync::Notify,
+    transport: Mutex<Option<Arc<ControlTransport>>>,
+    complete: tokio::sync::Notify,
+    initial_messages: Mutex<std::collections::VecDeque<ProtocolWireEvent>>,
 }

 #[async_trait]
@@ -29,56 +90,97 @@ impl Provider for InterruptProvider {
        context: AttemptContext,
    ) -> Result<ProviderStream, ProviderError> {
        let number = self.calls.fetch_add(1, Ordering::SeqCst);
+        if number == 1 && self.fail_first {
+            self.retry_started.notify_one();
+            self.retry_release.notified().await;
+            assert!(
+                context
+                    .excluded_accounts()
+                    .contains(&ProviderAccountId::new("acct_api_test").unwrap())
+            );
+        }
        let id = format!("resp_interrupt_{number}");
-        let control = context
-            .response_control()
-            .expect("root control propagated through Core")
-            .clone();
-        let active = control.activate(id.clone()).unwrap();
-        self.controls.lock().unwrap().push(control);
+        let transport = Arc::new(ControlTransport::new(id));
+        let owner: Arc<dyn ResponseControlTransport> = transport.clone();
+        context.response_control().unwrap().bind(&owner);
+        *self.transport.lock().unwrap() = Some(transport.clone());
        let candidate = request.candidate();
        let metadata = ProviderCallMetadata::new(
            candidate.provider().clone(),
            candidate.upstream_model().unwrap().clone(),
-            ProviderAccountId::new("acct_api_test").unwrap(),
+            ProviderAccountId::new(if self.fail_first && number > 0 {
+                "acct_api_retry"
+            } else {
+                "acct_api_test"
+            })
+            .unwrap(),
            UpstreamTransport::new("websocket").unwrap(),
        );
        let body = futures::stream::unfold(
-            (0, Some(active), id),
-            |(phase, mut active, id)| async move {
-                let (event_type, status, event) = match phase {
+            (0, transport, self),
+            |(phase, transport, provider)| async move {
+                let pending = if phase == 1 {
+                    provider.initial_messages.lock().unwrap().pop_front()
+                } else {
+                    None
+                };
+                if let Some(wire) = pending {
+                    return Some((Ok(ProviderEvent::wire(wire)), (phase, transport, provider)));
+                }
+                if phase == 1 && provider.fail_first && transport.id == "resp_interrupt_0" {
+                    provider.complete.notified().await;
+                    transport.active.store(false, Ordering::SeqCst);
+                    return Some((
+                        Err(ProviderError::new(
+                            gateway_core::error::ProviderErrorKind::QuotaExhausted,
+                            UpstreamSendState::Sent,
+                        )
+                        .with_replay_safe()),
+                        (2, transport, provider),
+                    ));
+                }
+                let (wire, events, next_phase) = match phase {
                    0 => (
-                        "response.created",
-                        "in_progress",
-                        GatewayEvent::Started(ResponseMeta::new(&id, "model-a")),
+                        json!({"type":"response.created","response":{"id":transport.id,"model":"model-a","status":"in_progress","output":[]}}),
+                        vec![GatewayEvent::Started(ResponseMeta::new(
+                            &transport.id,
+                            "model-a",
+                        ))],
+                        1,
                    ),
                    1 => {
-                        active.as_ref().unwrap().requested().await;
-                        drop(active.take());
-                        (
-                            "response.incomplete",
-                            "incomplete",
-                            GatewayEvent::Completed(ResponseMeta::new(&id, "model-a")),
-                        )
+                        let wire = tokio::select! {
+                            reply = transport.receive() => serde_json::from_str::<Value>(&reply.unwrap()).unwrap(),
+                            () = provider.complete.notified() => json!({"type":"response.completed","response":{"id":transport.id,"model":"model-a","status":"completed","output":[]}}),
+                        };
+                        if matches!(
+                            wire["type"].as_str(),
+                            Some("response.completed" | "response.incomplete")
+                        ) {
+                            transport.active.store(false, Ordering::SeqCst);
+                            (
+                                wire,
+                                vec![GatewayEvent::Completed(ResponseMeta::new(
+                                    &transport.id,
+                                    "model-a",
+                                ))],
+                                2,
+                            )
+                        } else {
+                            (wire, Vec::new(), 1)
+                        }
                    }
                    _ => return None,
                };
-                let mut response = json!({"id":id,"model":"model-a","status":status,"output":[]});
-                if phase == 1 {
-                    response["incomplete_details"] = json!({"reason":"interrupted"});
-                }
-                let event = ProviderEvent::canonical_with_wire(
-                    vec![event],
-                    ProtocolWireEvent::json(
-                        "openai",
-                        Some(event_type.to_owned()),
-                        json!({
-                            "type":event_type, "response":response
-                        }),
-                    )
-                    .unwrap(),
+                let event_type = wire["type"].as_str().unwrap().to_owned();
+                let mut event = ProviderEvent::canonical_with_wire(
+                    events,
+                    ProtocolWireEvent::json("openai", Some(event_type), wire).unwrap(),
                );
-                Some((Ok(event), (phase + 1, active, id)))
+                if phase == 0 && provider.fail_first {
+                    event = event.with_replayable_prelude();
+                }
+                Some((Ok(event), (next_phase, transport, provider)))
            },
        );
        Ok(ProviderStream::new(metadata, body, ()))
@@ -88,6 +190,8 @@ impl Provider for InterruptProvider {
 #[derive(Default)]
 struct InterruptAdmissions {
    active: AtomicUsize,
+    release_started: tokio::sync::Notify,
+    release_gate: Mutex<Option<tokio::sync::oneshot::Receiver<()>>>,
 }

 impl ClientAdmissionPort for InterruptAdmissions {
@@ -109,6 +213,11 @@ impl ClientAdmissionPort for InterruptAdmissions {
        _: &'a ModelRequestId,
    ) -> BoxFuture<'a, Result<bool, ClientAdmissionError>> {
        Box::pin(async {
+            let gate = self.release_gate.lock().unwrap().take();
+            self.release_started.notify_one();
+            if let Some(gate) = gate {
+                gate.await.unwrap();
+            }
            self.active.fetch_sub(1, Ordering::SeqCst);
            Ok(true)
        })
@@ -151,15 +260,24 @@ async fn next(socket: &mut TestSocket) -> Value {
    }
 }

-#[tokio::test]
-async fn interrupt_is_live_scoped_and_keeps_queued_creates_serial() {
-    let provider = Arc::new(InterruptProvider::default());
-    let admissions = Arc::new(InterruptAdmissions::default());
+async fn connect(
+    provider: Arc<InterruptProvider>,
+    admissions: Arc<InterruptAdmissions>,
+) -> (TestSocket, Server) {
    let execution = Arc::new(DefaultExecutionService::new(
-        RuntimeSnapshotHandle::new(snapshot("sk_ws_interrupt", "openai")),
+        RuntimeSnapshotHandle::new(if provider.fail_first {
+            crate::openai::snapshot_with_accounts(
+                "sk_ws_interrupt",
+                "openai",
+                "key_api_test",
+                &["acct_api_test", "acct_api_retry"],
+            )
+        } else {
+            snapshot("sk_ws_interrupt", "openai")
+        }),
        Arc::new(SettlementPorts::default()),
-        ProviderRegistry::new([provider.clone() as Arc<dyn Provider>]).unwrap(),
-        admissions.clone(),
+        ProviderRegistry::new([provider as Arc<dyn Provider>]).unwrap(),
+        admissions,
        Arc::new(UnusedContinuation),
        Arc::new(IgnoredClientApiKeyUsage),
        Arc::new(crate::support::RecordingDiagnostics::default()),
@@ -167,7 +285,7 @@ async fn interrupt_is_live_scoped_and_keeps_queued_creates_serial() {
    let app = api_router(execution).await;
    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
    let address = listener.local_addr().unwrap();
-    let _server = Server(tokio::spawn(async move {
+    let server = Server(tokio::spawn(async move {
        axum::serve(listener, app).await.unwrap()
    }));
    let mut request = format!("ws://{address}/v1/responses")
@@ -177,29 +295,136 @@ async fn interrupt_is_live_scoped_and_keeps_queued_creates_serial() {
        AUTHORIZATION,
        HeaderValue::from_static("Bearer sk_ws_interrupt"),
    );
-    let (mut socket, _) = connect_async(request).await.unwrap();
+    let (socket, _) = connect_async(request).await.unwrap();
+    (socket, server)
+}
+
+fn upstream_control_error() -> Value {
+    json!({"type":"error", "status":400, "error":{"type":"invalid_request_error","code":"future_rejected","message":"Synthetic upstream rejection","param":"type"},"vendor_extension":true})
+}
+
+fn interrupt(id: &str, mode: &str) -> Value {
+    json!({"type":"response.interrupt","response_id":id,"mode":mode,"future_extension":true})
+}
+
+#[tokio::test]
+async fn late_interrupt_after_terminal_is_sent_upstream_and_keeps_the_connection_reusable() {
+    let provider = Arc::new(InterruptProvider::default());
+    let admissions = Arc::new(InterruptAdmissions::default());
+    let (mut socket, _server) = connect(provider.clone(), admissions.clone()).await;
+    let create = json!({"type":"response.create","model":"model-a","input":"hello"});
+    for (number, terminal) in [(0, "response.completed"), (1, "response.incomplete")] {
+        let id = format!("resp_interrupt_{number}");
+        send(&mut socket, create.clone()).await;
+        assert_eq!(next(&mut socket).await["type"], "response.created");
+        if number == 0 {
+            provider.complete.notify_one();
+        } else {
+            send(&mut socket, interrupt(&id, "discard_partial_items")).await;
+        }
+        assert_eq!(next(&mut socket).await["type"], terminal);
+        tokio::time::timeout(Duration::from_secs(5), async {
+            while admissions.active.load(Ordering::SeqCst) != 0 {
+                tokio::task::yield_now().await;
+            }
+        })
+        .await
+        .unwrap();
+        for control in [
+            interrupt(&id, "discard_partial_items"),
+            interrupt(&id, "future_mode"),
+            json!({"type":"future.control","extra":[1,2]}),
+        ] {
+            send(&mut socket, control.clone()).await;
+            assert_eq!(
+                next(&mut socket).await,
+                json!({"type":"future.control.ack","original":control})
+            );
+        }
+        send(&mut socket, json!({"type":"future.reject"})).await;
+        assert_eq!(next(&mut socket).await, upstream_control_error());
+        assert_eq!(provider.calls.load(Ordering::SeqCst), number + 1);
+        assert_eq!(admissions.active.load(Ordering::SeqCst), 0);
+    }
+    socket.close(None).await.unwrap();
+}
+
+#[tokio::test]
+async fn late_interrupt_during_terminal_settlement_does_not_abort_or_reorder_requests() {
+    let provider = Arc::new(InterruptProvider::default());
+    let (release, wait_for_release) = tokio::sync::oneshot::channel();
+    let admissions = Arc::new(InterruptAdmissions {
+        release_gate: Mutex::new(Some(wait_for_release)),
+        ..Default::default()
+    });
+    let (mut socket, _server) = connect(provider.clone(), admissions.clone()).await;
    let create = json!({"type":"response.create","model":"model-a","input":"hello"});
-    let interrupt =
-        |id: &str, mode: &str| json!({"type":"response.interrupt","response_id":id,"mode":mode});
-    send(
-        &mut socket,
-        interrupt("resp_interrupt_0", "discard_partial_items"),
-    )
-    .await;
-    assert_eq!(next(&mut socket).await["type"], "error");
-    assert_eq!(provider.calls.load(Ordering::SeqCst), 0);
    send(&mut socket, create.clone()).await;
    assert_eq!(next(&mut socket).await["type"], "response.created");
+    provider.complete.notify_one();
+    assert_eq!(next(&mut socket).await["type"], "response.completed");
+    tokio::time::timeout(
+        Duration::from_secs(5),
+        admissions.release_started.notified(),
+    )
+    .await
+    .unwrap();
    send(&mut socket, create).await;
-    for invalid in [
-        interrupt("resp_other", "discard_partial_items"),
-        interrupt("resp_interrupt_0", "unknown"),
-        interrupt("", "discard_partial_items"),
+    let late = interrupt("resp_interrupt_0", "discard_partial_items");
+    send(&mut socket, late.clone()).await;
+    assert_eq!(
+        next(&mut socket).await,
+        json!({"type":"future.control.ack", "original":late})
+    );
+    assert_eq!(provider.calls.load(Ordering::SeqCst), 1);
+    assert_eq!(admissions.active.load(Ordering::SeqCst), 1);
+    release.send(()).unwrap();
+    assert_eq!(
+        next(&mut socket).await["response"]["id"],
+        "resp_interrupt_1"
+    );
+    socket.close(None).await.unwrap();
+}
+
+#[tokio::test]
+async fn unknown_controls_preserve_bytes_and_do_not_admit_queued_creates() {
+    let provider = Arc::new(InterruptProvider::default());
+    let admissions = Arc::new(InterruptAdmissions::default());
+    let (mut socket, _server) = connect(provider.clone(), admissions.clone()).await;
+    let create = json!({"type":"response.create","model":"model-a","input":"hello"});
+    send(&mut socket, json!({"type":"future.control"})).await;
+    let error = next(&mut socket).await;
+    assert_eq!(error["type"], "error");
+    assert_ne!(error["error"]["param"], "type");
+    assert_eq!(provider.calls.load(Ordering::SeqCst), 0);
+    send(&mut socket, create).await;
+    assert_eq!(next(&mut socket).await["type"], "response.created");
+    // 重复 type 仍是创建请求，不能借投影解码失败绕过串行准入
+    socket.send(ClientMessage::Text(r#"{"type":"response.create","type":"response.create","model":"model-a","input":"next"}"#.into())).await.unwrap();
+    for raw in [
+        r#"{ "type": "future.control", "mode": "unknown", "extension": [1, 2] }"#,
+        r#"{"extension":"no local type contract"}"#,
+        r#"{"type":42,"extension":true}"#,
+        "not-json",
    ] {
-        send(&mut socket, invalid).await;
-        let error = next(&mut socket).await;
-        assert_eq!(error["type"], "error");
-        assert_eq!(error["status"], 400);
+        socket.send(ClientMessage::Text(raw.into())).await.unwrap();
+        let expected =
+            serde_json::from_str::<Value>(raw).unwrap_or_else(|_| Value::String(raw.to_owned()));
+        assert_eq!(next(&mut socket).await["original"], expected);
+        assert_eq!(
+            provider
+                .transport
+                .lock()
+                .unwrap()
+                .as_ref()
+                .unwrap()
+                .requests
+                .lock()
+                .unwrap()
+                .last()
+                .unwrap(),
+            raw
+        );
        assert_eq!(provider.calls.load(Ordering::SeqCst), 1);
    }
    send(
@@ -207,27 +432,12 @@ async fn interrupt_is_live_scoped_and_keeps_queued_creates_serial() {
        interrupt("resp_interrupt_0", "discard_partial_items"),
    )
    .await;
-    let terminal = next(&mut socket).await;
-    assert_eq!(terminal["type"], "response.incomplete");
-    assert_eq!(
-        terminal["response"]["incomplete_details"]["reason"],
-        "interrupted"
-    );
+    assert_eq!(next(&mut socket).await["type"], "response.incomplete");
    assert_eq!(
        next(&mut socket).await["response"]["id"],
        "resp_interrupt_1"
    );
    assert_eq!(provider.calls.load(Ordering::SeqCst), 2);
-    send(
-        &mut socket,
-        interrupt("resp_interrupt_0", "discard_partial_items"),
-    )
-    .await;
-    assert_eq!(next(&mut socket).await["type"], "error");
-    assert_eq!(
-        provider.controls.lock().unwrap()[0].interrupt("resp_interrupt_0"),
-        Err(ResponseInterruptError::Unavailable)
-    );
    socket.close(None).await.unwrap();
    tokio::time::timeout(Duration::from_secs(5), async {
        while admissions.active.load(Ordering::SeqCst) != 0 {
@@ -236,8 +446,145 @@ async fn interrupt_is_live_scoped_and_keeps_queued_creates_serial() {
    })
    .await
    .expect("disconnect releases active execution");
-    assert_eq!(
-        provider.controls.lock().unwrap()[1].interrupt("resp_interrupt_1"),
-        Err(ResponseInterruptError::Unavailable)
-    );
+}
+
+#[tokio::test]
+async fn active_websocket_delivery_preserves_unparsed_messages_and_business_metadata() {
+    let messages = vec![
+        "{ \"type\": \"future.event\", \"number\": 1e3, \"escaped\": \"\\u0061\" }\r\n".to_owned(),
+        r#"{"type":"response.metadata","metadata":{"type":"safety_buffering","use_cases":["cyber"],"reasons":["user_risk"],"future":{"keep":true}}}"#.to_owned(),
+        format!("{{\"type\":\"future.deep\",\"extension\":{}0{}}}", "[".repeat(140), "]".repeat(140)),
+        "future non-JSON text".to_owned(), "[DONE]".to_owned(),
+    ];
+    let provider = Arc::new(InterruptProvider::default());
+    *provider.initial_messages.lock().unwrap() = messages
+        .iter()
+        .map(|raw| match serde_json::from_str::<Value>(raw) {
+            Ok(value) => ProtocolWireEvent::json(
+                "openai",
+                value.get("type").and_then(Value::as_str).map(str::to_owned),
+                value,
+            )
+            .unwrap()
+            .with_raw_websocket_message(raw.as_str()),
+            Err(_) => ProtocolWireEvent::raw_websocket("openai", raw.as_str()).unwrap(),
+        })
+        .collect();
+    let (mut socket, _server) =
+        connect(provider.clone(), Arc::new(InterruptAdmissions::default())).await;
+    send(
+        &mut socket,
+        json!({"type":"response.create","model":"model-a","input":"synthetic"}),
+    )
+    .await;
+    assert_eq!(next(&mut socket).await["type"], "response.created");
+    for expected in &messages {
+        let actual = tokio::time::timeout(Duration::from_secs(5), socket.next())
+            .await
+            .unwrap()
+            .unwrap()
+            .unwrap();
+        assert_eq!(actual.to_text().unwrap(), expected);
+    }
+    provider.complete.notify_one();
+    assert_eq!(next(&mut socket).await["type"], "response.completed");
+}
+
+#[tokio::test]
+async fn prelude_retry_retains_interrupt_during_account_switch() {
+    for interrupt_before_new_created in [true, false] {
+        let provider = Arc::new(InterruptProvider {
+            fail_first: true,
+            ..Default::default()
+        });
+        let admissions = Arc::new(InterruptAdmissions::default());
+        let (mut socket, _server) = connect(provider.clone(), admissions.clone()).await;
+        send(
+            &mut socket,
+            json!({"type":"response.create","model":"model-a","input":"hello"}),
+        )
+        .await;
+        assert_eq!(
+            next(&mut socket).await["response"]["id"],
+            "resp_interrupt_0"
+        );
+        let old = provider.transport.lock().unwrap().clone().unwrap();
+        provider.complete.notify_one();
+        tokio::time::timeout(Duration::from_secs(5), provider.retry_started.notified())
+            .await
+            .unwrap();
+        if interrupt_before_new_created {
+            send(
+                &mut socket,
+                interrupt("resp_interrupt_0", "discard_partial_items"),
+            )
+            .await;
+            // 等待服务端处理控制帧，随后才允许新 attempt 建立连接
+            tokio::time::timeout(Duration::from_secs(5), async {
+                while old.requests.lock().unwrap().is_empty() {
+                    tokio::task::yield_now().await;
+                }
+            })
+            .await
+            .unwrap();
+        }
+        provider.retry_release.notify_one();
+        assert_eq!(
+            next(&mut socket).await["response"]["id"],
+            "resp_interrupt_1"
+        );
+        if !interrupt_before_new_created {
+            // 迟到的旧 ID 也应作用于当前逻辑响应
+            send(
+                &mut socket,
+                interrupt("resp_interrupt_0", "discard_partial_items"),
+            )
+            .await;
+        }
+        let terminal = next(&mut socket).await;
+        assert_eq!(terminal["type"], "response.incomplete");
+        assert_eq!(terminal["response"]["id"], "resp_interrupt_1");
+        let current = provider.transport.lock().unwrap().clone().unwrap();
+        let requests = current.requests.lock().unwrap().clone();
+        assert_eq!(requests.len(), 1);
+        assert_eq!(
+            serde_json::from_str::<Value>(&requests[0]).unwrap(),
+            interrupt("resp_interrupt_1", "discard_partial_items")
+        );
+        assert_eq!(provider.calls.load(Ordering::SeqCst), 2);
+        socket.close(None).await.unwrap();
+    }
+}
+
+#[tokio::test]
+async fn non_replayable_delivery_blocks_retry_even_after_a_replayable_prelude() {
+    for event in [
+        json!({"type":"response.output_text.delta","delta":"visible","output_index":0,"content_index":0}),
+        json!({"type":"response.future_progress","marker":"preserved"}),
+    ] {
+        let provider = Arc::new(InterruptProvider {
+            fail_first: true,
+            ..Default::default()
+        });
+        provider.initial_messages.lock().unwrap().push_back(
+            ProtocolWireEvent::json(
+                "openai",
+                Some(event["type"].as_str().unwrap().to_owned()),
+                event.clone(),
+            )
+            .unwrap(),
+        );
+        let (mut socket, _server) = connect(provider.clone(), Arc::default()).await;
+        send(
+            &mut socket,
+            json!({"type":"response.create","model":"model-a","input":"hello"}),
+        )
+        .await;
+        assert_eq!(next(&mut socket).await["type"], "response.created");
+        assert_eq!(next(&mut socket).await, event);
+        provider.complete.notify_one();
+        assert_eq!(next(&mut socket).await["type"], "error");
+        assert_eq!(provider.calls.load(Ordering::SeqCst), 1);
+        socket.close(None).await.unwrap();
+    }
 }
--- a/Show More
+++ b/Show More