chore(release): v3.24.0

Co-authored-by: Codex <noreply@openai.com>

.agents/skills/cpr-plugin-dev/references/implementation.md

@@ -6,7 +6,7 @@
 ## 清单与处理器
 
 - `publisher` 与机器短名 `name` 派生插件 ID，`displayName` 用于展示；复制示例后同时调整扩展项 ID 与注册结果
-- `contributes` 每种能力最多一项，普通贡献项可省略派生 ID、能力版本和固定阶段；中间件必须声明版本 `3` 并显式选择阶段。自定义完整扩展项 ID 属于自己的插件命名空间，运行注册与规范化清单一致
+- `contributes` 每种能力最多一项，普通贡献项可省略派生 ID、能力版本和固定阶段；中间件必须声明版本 `4` 并显式选择阶段，上游适配器必须声明版本 `2`。自定义完整扩展项 ID 属于自己的插件命名空间，运行注册与规范化清单一致
 - 作者清单用 `Manifest::from_author_slice` 规范化，不手写 `package`、固定阶段或重复注册；CLI 生成平台、协议与资源摘要，版本范围不能使用全版本通配
 - 安装后宿主会按 `configurationSchema` 准备默认配置，配置完整即可启用；默认绑定的空范围不限制请求。需要业务参数时声明真实必填项，通过 `secretFields` 声明敏感字段，不依赖用户再走一遍自建安装向导
 - Rust 插件只依赖公开 `gateway-plugin-sdk`；需要异步会话辅助时开启 `io`，使用 `PluginSession` 管理握手、回调关联、流控、取消和关闭

.github/workflows/release.yml

@@ -177,8 +177,6 @@ jobs:
           host_path = "backend/crates/gateway-plugin/runtime/plugin-host-compatibility.json"
           host = JSON.parse(File.read(host_path))
           abort "Invalid plugin host compatibility declaration: #{host_path}" unless host["schema_version"] == 2
-          # 保留旧更新器可解析的传输格式，实际支持范围仍取自当前宿主合同。
-          host = host.merge("schema_version" => 1, "permissions" => [])
           # 清单只依赖版本与兼容声明，平台归档和镜像消费同一份封口结果。
           manifest = {
             "schema_version" => 1,

backend/Cargo.lock

@@ -3289,6 +3289,7 @@ dependencies = [
  "native-tls",
  "openssl",
  "openssl-sys",
+ "regex",
  "reqwest",
  "roxmltree",
  "rustls",

backend/apps/gateway/src/bootstrap/server.rs

@@ -1,4 +1,4 @@
-//! 服务模式完成全部组装后交给 Host 监听，并在请求和 Worker 排空后关闭插件
+//! 服务模式完成全部组装后交给 Host 监听，并在停止监听与 Worker 收尾后关闭插件
 
 use gateway_host::ConfigError;
 
@@ -56,6 +56,12 @@ pub async fn run() -> Result<(), BootstrapError> {
         plugin_runtime,
         gateway_host::plugin_distribution::HttpPluginDistribution::new(plugin_http)
     ));
+    let analytics_worker = or_shutdown!(
+        plugin_runtime,
+        store.request_analytics_worker(std::sync::Arc::new(
+            gateway_admin::ProviderUsageBillingProjector::new(providers.admin.clone()),
+        ))
+    );
     let mut admin = or_shutdown!(
         plugin_runtime,
         gateway_admin::initialize_with_plugin_accounts(
@@ -142,6 +148,7 @@ pub async fn run() -> Result<(), BootstrapError> {
     );
 
     let mut plan = store.take_worker_contributions();
+    plan.push(analytics_worker);
     plan.push(or_shutdown!(
         plugin_runtime,
         gateway_host::retention::worker(store.retention())

backend/crates/gateway-admin/src/lib.rs

@@ -35,7 +35,7 @@ pub use use_case::{
     client_keys::ClientKeyService,
     credentials::{CredentialsService, ProviderCredentials},
     import_tasks::ImportTasksService,
-    observability::ObservabilityService,
+    observability::{ObservabilityService, ProviderUsageBillingProjector},
     proxies::ProxiesService,
     settings::SettingsService,
     system::SystemService,
@@ -441,11 +441,14 @@ async fn initialize_inner(
         plugin_inspector.clone(),
     ));
     let system = Arc::new(DefaultSystemService::new(system, system_preflight));
+    let observations: Arc<dyn ports::store::ObservabilityStore> = Arc::new(
+        use_case::observability::CachedObservabilityStore::new(store.observability()),
+    );
     let key_usage = Arc::new(use_case::key_usage::DefaultKeyUsageService::new(
         auth.clone(),
         client_key_verifier,
         store.client_keys(),
-        store.observability(),
+        observations.clone(),
         system.clone(),
         timezone,
     ));
@@ -506,7 +509,7 @@ async fn initialize_inner(
         )),
         client_distribution: Arc::new(DefaultClientDistributionService::new(client_distribution)),
         observability: Arc::new(DefaultObservabilityService::new(
-            store.observability(),
+            observations.clone(),
             store.accounts(),
             store.settings(),
             registry.clone(),

backend/crates/gateway-admin/src/model/accounts.rs

@@ -146,9 +146,9 @@ pub struct AccountUsage {
     pub success_count: u64,
     pub input_tokens: Option<u64>,
     pub output_tokens: Option<u64>,
-    pub cached_tokens: Option<u64>,
-    pub cache_write_tokens: Option<u64>,
-    pub reasoning_tokens: Option<u64>,
+    pub cached_input_tokens: Option<u64>,
+    pub cache_write_input_tokens: Option<u64>,
+    pub reasoning_output_tokens: Option<u64>,
     pub image_input_tokens: Option<u64>,
     pub image_output_tokens: Option<u64>,
     pub image_request_count: u64,

backend/crates/gateway-admin/src/model/analytics.rs

@@ -0,0 +1,65 @@
+//! 统计投影的新鲜度、覆盖范围与预计算费用合同
+
+use chrono::{DateTime, Utc};
+
+use super::observability::{DecimalAmount, RequestMetricPoint, UsageOverview};
+
+/// 数据可见性状态，不以缺失投影冒充零统计
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
+pub enum AnalyticsState {
+    Ready,
+    #[default]
+    Building,
+    Lagging,
+    Stale,
+}
+
+impl AnalyticsState {
+    #[must_use]
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::Ready => "ready",
+            Self::Building => "building",
+            Self::Lagging => "lagging",
+            Self::Stale => "stale",
+        }
+    }
+}
+
+/// 与统计结果在同一读取快照内取得的覆盖和版本事实
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub struct AnalyticsMetadata {
+    pub coverage_start: Option<DateTime<Utc>>,
+    pub coverage_end: Option<DateTime<Utc>>,
+    pub generated_at: DateTime<Utc>,
+    pub lag_seconds: u64,
+    pub state: AnalyticsState,
+    pub percentiles_approximate: bool,
+    pub schema_version: u32,
+    pub histogram_version: u32,
+    /// 派生数据版本供缓存判断失效，不作为源事务提交顺序
+    pub generation: u64,
+}
+
+/// 单次请求经 Provider 费用合同确认后可累加的 USD 情景金额
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub struct UsageBillingProjection {
+    pub standard_amount: Option<DecimalAmount>,
+    pub no_cache_amount: Option<DecimalAmount>,
+}
+
+/// 时间桶内的情景费用，未知金额不改写为零
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct UsageProjectedCostPoint {
+    pub bucket_start: DateTime<Utc>,
+    pub standard_amount: Option<DecimalAmount>,
+    pub no_cache_amount: Option<DecimalAmount>,
+}
+
+/// 同一数据库快照内的完整洞察输入
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct UsageInsightsObservation {
+    pub overview: UsageOverview,
+    pub trend: Vec<RequestMetricPoint>,
+    pub costs: Vec<UsageProjectedCostPoint>,
+}

backend/crates/gateway-admin/src/model/mod.rs

@@ -4,6 +4,7 @@ use std::num::{NonZeroU16, NonZeroU64};
 
 pub mod account_groups;
 pub mod accounts;
+pub mod analytics;
 pub mod audit;
 pub mod auth;
 pub mod backup;

backend/crates/gateway-admin/src/model/observability.rs

@@ -5,6 +5,10 @@ use std::{num::NonZeroU16, str::FromStr};
 use chrono::{DateTime, TimeDelta, Utc};
 
 use super::AdminModelError;
+pub use super::analytics::{
+    AnalyticsMetadata, AnalyticsState, UsageBillingProjection, UsageInsightsObservation,
+    UsageProjectedCostPoint,
+};
 
 /// 观测记录查询的页大小，由 HTTP、管理用例和存储端口共同使用
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
@@ -48,7 +52,7 @@ impl CalendarPeriod {
 }
 
 /// 外部观测查询的 UTC 时间范围
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
 pub struct TimeRange {
     pub start: DateTime<Utc>,
     pub end: DateTime<Utc>,
@@ -89,7 +93,7 @@ impl TimeRange {
 }
 
 /// 请求结果状态
-#[derive(Debug, Clone, PartialEq, Eq)]
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
 pub enum RequestOutcome {
     Running,
     Succeeded,
@@ -100,7 +104,7 @@ pub enum RequestOutcome {
 }
 
 /// 未知但有界的请求结果值；私有字段禁止绕过 [`RequestOutcome::new`] 构造
-#[derive(Debug, Clone, PartialEq, Eq)]
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
 pub struct OtherRequestOutcome(String);
 
 impl RequestOutcome {
@@ -151,8 +155,9 @@ impl OtherRequestOutcome {
 }
 
 /// 用量记录过滤条件
-#[derive(Debug, Clone, Default, PartialEq, Eq)]
+#[derive(Debug, Clone, Default, PartialEq, Eq, Hash)]
 pub struct UsageFilter {
+    pub routing_group_refs: Vec<String>,
     pub client_api_key_ref: Option<String>,
     pub request_id: Option<String>,
     pub provider_account_ref: Option<String>,
@@ -178,7 +183,7 @@ pub struct UsageQuery {
 }
 
 /// Admin 确定概览的数量、趋势粒度及最近请求筛选，Store 只执行该选择
-#[derive(Debug, Clone, PartialEq, Eq)]
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
 pub struct DashboardQuery {
     pub range: TimeRange,
     pub granularity: Granularity,
@@ -206,6 +211,7 @@ impl DashboardQuery {
 /// 运维错误过滤条件
 #[derive(Debug, Clone, Default, PartialEq, Eq)]
 pub struct OpsErrorFilter {
+    pub routing_group_refs: Vec<String>,
     pub client_api_key_ref: Option<String>,
     pub request_id: Option<String>,
     pub provider_kind: Option<String>,
@@ -230,7 +236,7 @@ pub struct OpsErrorQuery {
 }
 
 /// 用量诊断维度
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
 pub enum DiagnosticDimension {
     Provider,
     Model,
@@ -363,8 +369,8 @@ pub struct ProviderBillingInput {
     pub service_tier: Option<String>,
     pub input_tokens: Option<u64>,
     pub output_tokens: Option<u64>,
-    pub cached_tokens: Option<u64>,
-    pub cache_write_tokens: Option<u64>,
+    pub cached_input_tokens: Option<u64>,
+    pub cache_write_input_tokens: Option<u64>,
     pub total: CurrencyCost,
 }
 
@@ -380,8 +386,8 @@ pub struct UsageCalculatedBillingFact {
     pub service_tier: Option<String>,
     pub input_tokens: Option<u64>,
     pub output_tokens: Option<u64>,
-    pub cached_tokens: Option<u64>,
-    pub cache_write_tokens: Option<u64>,
+    pub cached_input_tokens: Option<u64>,
+    pub cache_write_input_tokens: Option<u64>,
     pub total: CurrencyCost,
 }
 
@@ -408,7 +414,7 @@ pub struct CalculatedBillingBreakdown {
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct ImageBillingBreakdown {
     pub input_tokens: u64,
-    pub cached_tokens: u64,
+    pub cached_input_tokens: u64,
     pub input_amount: CurrencyCost,
     pub cache_read_amount: CurrencyCost,
     pub input_price_per_million: CurrencyCost,
@@ -454,9 +460,9 @@ pub struct RequestMetrics {
     pub caller_error_count: u64,
     pub input_tokens: u64,
     pub output_tokens: u64,
-    pub cached_tokens: u64,
-    pub cache_write_tokens: u64,
-    pub reasoning_tokens: u64,
+    pub cached_input_tokens: u64,
+    pub cache_write_input_tokens: u64,
+    pub reasoning_output_tokens: u64,
     pub total_tokens: u64,
     pub first_token_latency_sum_ms: u64,
     pub first_token_latency_count: u64,
@@ -496,7 +502,7 @@ pub struct AttemptMetrics {
 }
 
 /// 时间序列粒度
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
 pub enum Granularity {
     FifteenMinutes,
     Hour,
@@ -556,9 +562,9 @@ pub struct AccountModelUsage {
     pub success_count: u64,
     pub input_tokens: Option<u64>,
     pub output_tokens: Option<u64>,
-    pub cached_tokens: Option<u64>,
-    pub cache_write_tokens: Option<u64>,
-    pub reasoning_tokens: Option<u64>,
+    pub cached_input_tokens: Option<u64>,
+    pub cache_write_input_tokens: Option<u64>,
+    pub reasoning_output_tokens: Option<u64>,
     pub image_input_tokens: Option<u64>,
     pub image_output_tokens: Option<u64>,
     pub image_request_count: u64,
@@ -591,9 +597,9 @@ pub struct DashboardAccountUsage {
     pub success_count: u64,
     pub input_tokens: Option<u64>,
     pub output_tokens: Option<u64>,
-    pub cached_tokens: Option<u64>,
-    pub cache_write_tokens: Option<u64>,
-    pub reasoning_tokens: Option<u64>,
+    pub cached_input_tokens: Option<u64>,
+    pub cache_write_input_tokens: Option<u64>,
+    pub reasoning_output_tokens: Option<u64>,
     pub image_input_tokens: Option<u64>,
     pub image_output_tokens: Option<u64>,
     pub image_request_count: u64,
@@ -628,7 +634,7 @@ pub struct DashboardRuntimeSlots {
 pub struct DashboardTotals {
     pub request_count: u64,
     pub input_tokens: u64,
-    pub cached_tokens: u64,
+    pub cached_input_tokens: u64,
     pub total_tokens: u64,
     pub billing_usd: Option<DecimalAmount>,
 }
@@ -636,6 +642,7 @@ pub struct DashboardTotals {
 /// 仪表盘所需的当前区间事实及全历史累计
 #[derive(Debug, Clone, PartialEq)]
 pub struct DashboardObservation {
+    pub analytics: AnalyticsMetadata,
     pub range: TimeRange,
     pub totals: DashboardTotals,
     pub provider_accounts: AccountPoolMetrics,
@@ -657,9 +664,9 @@ pub struct UsageListRecord {
     pub provider_account_ref: Option<String>,
     pub provider_account_name: Option<String>,
     pub provider_account_email: Option<String>,
-    /// 账号当前备注，按内部账号 ID 关联，不属于请求历史快照
+    /// 请求选号时冻结的账号备注，未采集时保持未知
     pub provider_account_notes: Option<String>,
-    /// 账号当前套餐，不属于请求历史快照
+    /// 请求选号时冻结的账号套餐
     pub provider_account_plan_type: Option<String>,
     pub provider_account_plan_type_display: Option<String>,
     pub provider_account_authentication_kind: Option<String>,
@@ -669,9 +676,9 @@ pub struct UsageListRecord {
     pub service_tier: Option<String>,
     pub input_tokens: Option<u64>,
     pub output_tokens: Option<u64>,
-    pub cached_tokens: Option<u64>,
-    pub cache_write_tokens: Option<u64>,
-    pub reasoning_tokens: Option<u64>,
+    pub cached_input_tokens: Option<u64>,
+    pub cache_write_input_tokens: Option<u64>,
+    pub reasoning_output_tokens: Option<u64>,
     pub image_input_tokens: Option<u64>,
     pub image_output_tokens: Option<u64>,
     pub total_tokens: Option<u64>,
@@ -750,9 +757,9 @@ pub struct UsageRecord {
     pub retry_after_ms: Option<u64>,
     pub input_tokens: Option<u64>,
     pub output_tokens: Option<u64>,
-    pub cached_tokens: Option<u64>,
-    pub cache_write_tokens: Option<u64>,
-    pub reasoning_tokens: Option<u64>,
+    pub cached_input_tokens: Option<u64>,
+    pub cache_write_input_tokens: Option<u64>,
+    pub reasoning_output_tokens: Option<u64>,
     pub image_input_tokens: Option<u64>,
     pub image_output_tokens: Option<u64>,
     pub total_tokens: Option<u64>,
@@ -830,9 +837,9 @@ pub struct UsageAttempt {
     pub message: Option<String>,
     pub input_tokens: Option<u64>,
     pub output_tokens: Option<u64>,
-    pub cached_tokens: Option<u64>,
-    pub cache_write_tokens: Option<u64>,
-    pub reasoning_tokens: Option<u64>,
+    pub cached_input_tokens: Option<u64>,
+    pub cache_write_input_tokens: Option<u64>,
+    pub reasoning_output_tokens: Option<u64>,
     pub total_tokens: Option<u64>,
     pub cost_source: Option<String>,
     pub cost_amount: Option<DecimalAmount>,
@@ -862,6 +869,7 @@ pub struct ProviderObservation {
 /// 用量总览
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct UsageOverview {
+    pub analytics: AnalyticsMetadata,
     pub range: TimeRange,
     pub requests: RequestMetrics,
     pub attempts: AttemptMetrics,
@@ -878,6 +886,7 @@ pub struct UsageSummary {
 /// 诊断聚合结果，分母包含截取展示项之前的全部匹配请求
 #[derive(Debug, Clone, Default, PartialEq, Eq)]
 pub struct DiagnosticsObservation {
+    pub analytics: AnalyticsMetadata,
     pub total_request_count: u64,
     pub items: Vec<DiagnosticObservation>,
 }
@@ -1001,7 +1010,7 @@ pub struct TrendSummary {
     pub request_count: u64,
     pub input_tokens: u64,
     pub output_tokens: u64,
-    pub cached_tokens: u64,
+    pub cached_input_tokens: u64,
     pub total_tokens: u64,
     pub service_failure_count: u64,
     pub average_latency_ms: Option<u64>,
@@ -1019,6 +1028,7 @@ pub struct TrendSummary {
 /// 趋势结果；API 再决定图表标签与数字格式
 #[derive(Debug, Clone, PartialEq)]
 pub struct Trend {
+    pub analytics: AnalyticsMetadata,
     pub kind: TrendKind,
     pub points: Vec<TrendPoint>,
     pub summary: TrendSummary,
@@ -1134,7 +1144,7 @@ pub struct DashboardPeriodMetrics {
     pub request_count: u64,
     pub input_tokens: u64,
     pub output_tokens: u64,
-    pub cached_tokens: u64,
+    pub cached_input_tokens: u64,
     pub total_tokens: u64,
     pub cached_token_rate: f64,
     pub observed_cached_token_rate: Option<f64>,
@@ -1224,7 +1234,7 @@ pub struct UsageInsightsCostPoint {
     pub bucket_start: DateTime<Utc>,
     pub input_tokens: u64,
     pub output_tokens: u64,
-    pub cached_tokens: u64,
+    pub cached_input_tokens: u64,
     pub total_tokens: u64,
     pub estimated_cost: Option<DecimalAmount>,
     pub standard_cost: Option<DecimalAmount>,
@@ -1249,7 +1259,7 @@ pub struct UsageInsightsCost {
     pub cache_hit_request_rate: Option<f64>,
     pub input_tokens: u64,
     pub output_tokens: u64,
-    pub cached_tokens: u64,
+    pub cached_input_tokens: u64,
     pub total_tokens: u64,
     pub points: Vec<UsageInsightsCostPoint>,
     pub costs: Vec<CurrencyCost>,
@@ -1259,6 +1269,7 @@ pub struct UsageInsightsCost {
 /// 用量洞察的完整用例结果；API 只负责标签、时区与字符串格式化
 #[derive(Debug, Clone, PartialEq)]
 pub struct UsageInsights {
+    pub analytics: AnalyticsMetadata,
     pub granularity: Granularity,
     pub health: UsageInsightsHealth,
     pub performance: UsageInsightsPerformance,
@@ -1294,6 +1305,7 @@ pub struct DiagnosticsItem {
 /// 诊断结果
 #[derive(Debug, Clone, PartialEq)]
 pub struct DiagnosticsResult {
+    pub analytics: AnalyticsMetadata,
     pub dimension: DiagnosticDimension,
     pub items: Vec<DiagnosticsItem>,
 }

backend/crates/gateway-admin/src/model/quota_forecast_sampling.rs

@@ -15,7 +15,7 @@ pub struct QuotaForecastUsage {
     pub tokens: u64,
     pub input_tokens: u64,
     pub output_tokens: u64,
-    pub cached_tokens: u64,
+    pub cached_input_tokens: u64,
     pub missing_token_count: u64,
     pub known_cost_count: u64,
     pub unavailable_cost_count: u64,
@@ -35,7 +35,9 @@ impl QuotaForecastUsage {
             tokens: self.tokens.checked_sub(baseline.tokens)?,
             input_tokens: self.input_tokens.checked_sub(baseline.input_tokens)?,
             output_tokens: self.output_tokens.checked_sub(baseline.output_tokens)?,
-            cached_tokens: self.cached_tokens.checked_sub(baseline.cached_tokens)?,
+            cached_input_tokens: self
+                .cached_input_tokens
+                .checked_sub(baseline.cached_input_tokens)?,
             missing_token_count: self
                 .missing_token_count
                 .checked_sub(baseline.missing_token_count)?,

backend/crates/gateway-admin/src/model/settings.rs

@@ -45,6 +45,7 @@ pub use gateway_core::account::RotationStrategy;
 /// 运行设置的共同值；版本、Provider 画像更新和数据库秘密由外层类型拥有
 #[derive(Debug, Clone, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
 pub struct RuntimeSettingsValues {
+    pub codex_privacy_policy: gateway_core::settings::privacy::CodexPrivacyPolicy,
     pub request_location_enabled: bool,
     pub request_location: gateway_core::account::RequestLocation,
     pub refresh_margin_seconds: u64,

backend/crates/gateway-admin/src/ports/provider.rs

@@ -130,6 +130,32 @@ struct ProviderAdminDiagnostic {
 /// 运行时资源通知只在事务成功后发生
 #[async_trait]
 pub trait ProviderAdmin: Send + Sync {
+    fn compile_privacy_policy(
+        &self,
+        _policy: &gateway_core::settings::privacy::CodexPrivacyPolicy,
+    ) -> Result<
+        Arc<dyn gateway_core::settings::privacy::CompiledPrivacyPolicy>,
+        gateway_core::settings::privacy::PrivacyError,
+    > {
+        Err(gateway_core::settings::privacy::PrivacyError {
+            rule_index: 0,
+            reason: "Provider 不支持隐私策略",
+        })
+    }
+
+    fn preview_privacy_policy(
+        &self,
+        _request: gateway_core::settings::privacy::PrivacyPreviewRequest,
+    ) -> Result<
+        gateway_core::settings::privacy::PrivacyPreviewResult,
+        gateway_core::settings::privacy::PrivacyError,
+    > {
+        Err(gateway_core::settings::privacy::PrivacyError {
+            rule_index: 0,
+            reason: "Provider 不支持隐私策略",
+        })
+    }
+
     /// 只读内置价目；没有本地计价能力的 Provider 返回空目录
     fn pricing_catalog(&self) -> crate::model::pricing::ProviderPricingCatalog {
         Default::default()

backend/crates/gateway-admin/src/ports/store.rs

@@ -6,7 +6,6 @@ use std::{collections::BTreeMap, net::IpAddr, sync::Arc, time::Duration};
 
 use async_trait::async_trait;
 use chrono::{DateTime, Utc};
-use futures::stream::BoxStream;
 
 use super::backup::BackupStorePorts;
 use crate::model::{
@@ -30,7 +29,8 @@ use crate::model::{
     observability::{
         DashboardObservation, DashboardQuery, DiagnosticDimension, DiagnosticsObservation,
         Granularity, OpsErrorPage, OpsErrorQuery, RequestMetricPoint, TimeRange,
-        UsageCalculatedBillingFact, UsageDetail, UsageFilter, UsageOverview, UsagePage, UsageQuery,
+        UsageBillingProjection, UsageCalculatedBillingFact, UsageDetail, UsageFilter,
+        UsageInsightsObservation, UsageOverview, UsagePage, UsageQuery,
     },
     provider_credentials::{
         AuthorizationCommit, CredentialDetails, CredentialImportCommit, CredentialImportResult,
@@ -421,13 +421,20 @@ pub trait AccountGroupStore: Send + Sync {
     ) -> AdminStoreResult<AccountGroupMutation>;
 }
 
-/// 逐条读取的已计算费用事实；消费结束或丢弃时释放查询资源
-pub type UsageCalculatedBillingStream<'a> =
-    BoxStream<'a, AdminStoreResult<UsageCalculatedBillingFact>>;
+/// 后台投影复用 Admin 与 Provider 的费用规则，Store 不重新解释价格
+pub trait UsageBillingProjector: Send + Sync {
+    fn project(
+        &self,
+        fact: &UsageCalculatedBillingFact,
+    ) -> Result<UsageBillingProjection, crate::model::AdminError>;
+}
 
 /// 用量、趋势、诊断与运维错误的只读能力
 #[async_trait]
 pub trait ObservabilityStore: Send + Sync {
+    /// 缓存必须与删除和后台投影提交的版本一致
+    async fn analytics_cache_generation(&self) -> AdminStoreResult<u64>;
+
     /// 返回历史统计区间和指定观测时刻下的实时账号状态
     async fn dashboard_summary(
         &self,
@@ -448,14 +455,13 @@ pub trait ObservabilityStore: Send + Sync {
         granularity: Granularity,
     ) -> AdminStoreResult<Vec<RequestMetricPoint>>;
 
-    /// 流式返回可由 Provider 重新校验的已计算费用事实，不保证顺序
-    /// 查询及解码错误由流返回；调用方应逐条聚合，避免收集整个区间
-    fn usage_calculated_billing_facts(
+    /// 同一读取快照中的汇总、趋势和已投影情景费用
+    async fn usage_insights_observation(
         &self,
         range: TimeRange,
         filter: UsageFilter,
         granularity: Granularity,
-    ) -> UsageCalculatedBillingStream<'_>;
+    ) -> AdminStoreResult<UsageInsightsObservation>;
 
     async fn list_usage_records(&self, query: UsageQuery) -> AdminStoreResult<UsagePage>;
 

backend/crates/gateway-admin/src/public_service/settings.rs

@@ -25,6 +25,13 @@ pub(super) fn register(
         }};
     }
     register!(Load, load, (), ());
+    register!(
+        PreviewPrivacyPolicy,
+        preview_privacy_policy,
+        gateway_core::settings::privacy::PrivacyPreviewRequest,
+        request,
+        request
+    );
     register!(
         Replace,
         replace,

backend/crates/gateway-admin/src/use_case/key_usage.rs

@@ -192,10 +192,12 @@ impl KeyUsageService for DefaultKeyUsageService {
                 .ok_or_else(|| AdminError::internal("时间超出支持范围"))?,
             end: now,
         };
-        let (overview, trend, health_points) = futures::try_join!(
-            self.observations.usage_summary(query.range, filter.clone()),
-            self.observations
-                .usage_trend(query.range, filter, Granularity::for_range(query.range)),
+        let (observation, health_points) = futures::try_join!(
+            self.observations.usage_insights_observation(
+                query.range,
+                filter,
+                Granularity::for_range(query.range)
+            ),
             self.observations.usage_trend(
                 today,
                 usage_filter(&id, None),
@@ -205,8 +207,8 @@ impl KeyUsageService for DefaultKeyUsageService {
         .map_err(|error| map_store_error(error, "key usage overview"))?;
         Ok(Some(KeyUsageOverview {
             key,
-            overview,
-            trend,
+            overview: observation.overview,
+            trend: observation.trend,
             health_timeline: health_timeline_at(&health_points, now, self.timezone)?,
         }))
     }

backend/crates/gateway-admin/src/use_case/observability/mod.rs

@@ -4,12 +4,10 @@ use std::{
     collections::{BTreeMap, HashMap, btree_map::Entry},
     str::FromStr,
     sync::Arc,
-    time::{Duration as StdDuration, Instant},
 };
 
 use async_trait::async_trait;
 use chrono::{DateTime, Duration, Utc};
-use futures::TryStreamExt;
 use gateway_core::{account::ProviderAccountId, routing::ProviderKind};
 
 use crate::{
@@ -21,16 +19,16 @@ use crate::{
             DiagnosticDimension, DiagnosticsItem, DiagnosticsResult, Granularity, HealthStatus,
             HealthTimeline, HealthTimelinePoint, OpsErrorPage, OpsErrorQuery, ProviderBillingInput,
             RequestMetricPoint, RequestMetrics, TimeRange, Trend, TrendKind, TrendPoint,
-            TrendSummary, UsageBilling, UsageCalculatedBillingFact, UsageDetail, UsageFilter,
-            UsageInsights, UsageInsightsCost, UsageInsightsCostPoint, UsageInsightsHealth,
-            UsageInsightsHealthPoint, UsageInsightsPerformance, UsageInsightsPerformancePoint,
-            UsageOverview, UsagePage, UsageQuery, UsageSummary,
+            TrendSummary, UsageBilling, UsageBillingProjection, UsageCalculatedBillingFact,
+            UsageDetail, UsageFilter, UsageInsights, UsageInsightsCost, UsageInsightsCostPoint,
+            UsageInsightsHealth, UsageInsightsHealthPoint, UsageInsightsPerformance,
+            UsageInsightsPerformancePoint, UsageOverview, UsagePage, UsageQuery, UsageSummary,
         },
         provider_credentials::ProviderQuotaRequest,
     },
     ports::{
         provider::{ProviderAdminErrorKind, ProviderAdminRegistry},
-        store::{AccountStore, ObservabilityStore, SettingsStore, UsageCalculatedBillingStream},
+        store::{AccountStore, ObservabilityStore, SettingsStore, UsageBillingProjector},
     },
 };
 
@@ -40,58 +38,8 @@ const HEALTH_TIMELINE_SLOT_MINUTES: i64 = 15;
 const HEALTH_TIMELINE_MIN_SAMPLE_SIZE: u64 = 10;
 const HEALTH_TIMELINE_UNAVAILABLE_FAILURE_THRESHOLD: u64 = 3;
 const HEALTH_TIMELINE_STABLE_RELIABILITY: f64 = 99.0;
-const DASHBOARD_QUERY_BUCKET_SECONDS: i64 = 2;
-const DASHBOARD_QUERY_CACHE_RETENTION: StdDuration = StdDuration::from_secs(2);
-
-#[derive(Clone, Copy, PartialEq, Eq, Hash)]
-struct DashboardQueryKey {
-    start: DateTime<Utc>,
-    end_bucket: i64,
-}
-
-impl DashboardQueryKey {
-    fn new(range: TimeRange) -> Self {
-        Self {
-            start: range.start,
-            end_bucket: range
-                .end
-                .timestamp()
-                .div_euclid(DASHBOARD_QUERY_BUCKET_SECONDS),
-        }
-    }
-}
-
-struct DashboardQueryEntry {
-    created_at: Instant,
-    result: Arc<tokio::sync::OnceCell<Result<DashboardResult, AdminError>>>,
-}
-
-#[derive(Default)]
-struct DashboardQueryCache {
-    entries: tokio::sync::Mutex<HashMap<DashboardQueryKey, DashboardQueryEntry>>,
-}
-
-impl DashboardQueryCache {
-    async fn result_cell(
-        &self,
-        key: DashboardQueryKey,
-    ) -> Arc<tokio::sync::OnceCell<Result<DashboardResult, AdminError>>> {
-        let now = Instant::now();
-        let mut entries = self.entries.lock().await;
-        entries.retain(|_, entry| {
-            now.duration_since(entry.created_at) < DASHBOARD_QUERY_CACHE_RETENTION
-        });
-        Arc::clone(
-            &entries
-                .entry(key)
-                .or_insert_with(|| DashboardQueryEntry {
-                    created_at: now,
-                    result: Arc::new(tokio::sync::OnceCell::new()),
-                })
-                .result,
-        )
-    }
-}
+mod store_cache;
+pub(crate) use store_cache::CachedObservabilityStore;
 
 /// API 消费的观测控制面服务
 #[async_trait]
@@ -130,7 +78,6 @@ pub(crate) struct DefaultObservabilityService {
     accounts: Arc<dyn AccountStore>,
     settings: Arc<dyn SettingsStore>,
     providers: ProviderAdminRegistry,
-    dashboard_queries: DashboardQueryCache,
 }
 
 impl DefaultObservabilityService {
@@ -148,7 +95,6 @@ impl DefaultObservabilityService {
             accounts,
             settings,
             providers,
-            dashboard_queries: DashboardQueryCache::default(),
         }
     }
 
@@ -185,7 +131,7 @@ impl DefaultObservabilityService {
         let yesterday = dashboard_period_metrics(&observation.trend, yesterday_start, today_start);
         let total_billing_usd = observation.totals.billing_usd.clone();
         let total_cached_token_rate = rate_or_zero(
-            observation.totals.cached_tokens,
+            observation.totals.cached_input_tokens,
             observation.totals.input_tokens,
         );
         let (first_token_latency_sum_ms, first_token_latency_count) = observation
@@ -199,7 +145,11 @@ impl DefaultObservabilityService {
             });
         let average_first_token_latency_ms =
             average(first_token_latency_sum_ms, first_token_latency_count);
-        let trend = trend(TrendKind::Usage, observation.trend.clone())?;
+        let trend = trend(
+            TrendKind::Usage,
+            observation.trend.clone(),
+            observation.analytics.clone(),
+        )?;
         let health_timeline =
             health_timeline_at(&observation.trend, observation.range.end, self.timezone)?;
         let wire_profiles = self
@@ -247,15 +197,12 @@ impl ObservabilityService for DefaultObservabilityService {
         range: TimeRange,
         kind: TrendKind,
     ) -> Result<DashboardResult, AdminError> {
-        let cell = self
-            .dashboard_queries
-            .result_cell(DashboardQueryKey::new(range))
-            .await;
-        let mut result = cell
-            .get_or_init(|| self.load_dashboard_summary(range))
-            .await
-            .clone()?;
-        result.trend = trend(kind, result.observation.trend.clone())?;
+        let mut result = self.load_dashboard_summary(range).await?;
+        result.trend = trend(
+            kind,
+            result.observation.trend.clone(),
+            result.observation.analytics.clone(),
+        )?;
         Ok(result)
     }
 
@@ -264,12 +211,16 @@ impl ObservabilityService for DefaultObservabilityService {
         range: TimeRange,
         kind: TrendKind,
     ) -> Result<Trend, AdminError> {
-        let points = self
+        let observation = self
             .store
-            .dashboard_trend(range, Granularity::for_range(range))
+            .usage_insights_observation(
+                range,
+                UsageFilter::default(),
+                Granularity::for_range(range),
+            )
             .await
             .map_err(|error| map_store_error(error, "dashboard trend"))?;
-        trend(kind, points)
+        trend(kind, observation.trend, observation.overview.analytics)
     }
 
     async fn usage_records(&self, query: UsageQuery) -> Result<UsagePage, AdminError> {
@@ -321,21 +272,22 @@ impl ObservabilityService for DefaultObservabilityService {
         filter: UsageFilter,
     ) -> Result<UsageInsights, AdminError> {
         let granularity = Granularity::for_range(range);
-        let aggregates = async {
-            futures::try_join!(
-                self.store.usage_summary(range, filter.clone()),
-                self.store.usage_trend(range, filter.clone(), granularity),
-            )
-            .map_err(|error| map_store_error(error, "usage insights"))
-        };
-        let ((overview, trend), standard_costs) = futures::try_join!(
-            aggregates,
-            recover_standard_costs(
-                &self.providers,
-                self.store
-                    .usage_calculated_billing_facts(range, filter.clone(), granularity),
-            ),
-        )?;
+        let observation = self
+            .store
+            .usage_insights_observation(range, filter, granularity)
+            .await
+            .map_err(|error| map_store_error(error, "usage insights"))?;
+        let mut standard_costs = UsageCostScenarios::default();
+        for point in observation.costs {
+            if let Some(amount) = point.standard_amount {
+                standard_costs.standard.add(point.bucket_start, amount)?;
+            }
+            if let Some(amount) = point.no_cache_amount {
+                standard_costs.no_cache.add(point.bucket_start, amount)?;
+            }
+        }
+        let overview = observation.overview;
+        let trend = observation.trend;
         build_usage_insights(overview, trend, standard_costs)
     }
 
@@ -389,7 +341,11 @@ impl ObservabilityService for DefaultObservabilityService {
                 }
             })
             .collect::<Vec<_>>();
-        Ok(DiagnosticsResult { dimension, items })
+        Ok(DiagnosticsResult {
+            analytics: observation.analytics,
+            dimension,
+            items,
+        })
     }
 
     async fn ops_errors(&self, query: OpsErrorQuery) -> Result<OpsErrorPage, AdminError> {
@@ -533,14 +489,14 @@ fn build_usage_insights(
         tier_premium,
         tokens_per_request: rate_or_zero(requests.total_tokens, requests.request_count),
         cost_per_successful_request,
-        cached_token_rate: rate_or_zero(requests.cached_tokens, requests.input_tokens),
+        cached_token_rate: rate_or_zero(requests.cached_input_tokens, requests.input_tokens),
         cache_hit_request_rate: ratio(
             requests.cache_hit_request_count,
             requests.cache_eligible_request_count,
         ),
         input_tokens: requests.input_tokens,
         output_tokens: requests.output_tokens,
-        cached_tokens: requests.cached_tokens,
+        cached_input_tokens: requests.cached_input_tokens,
         total_tokens: requests.total_tokens,
         points: trend
             .iter()
@@ -548,7 +504,7 @@ fn build_usage_insights(
                 bucket_start: point.bucket_start,
                 input_tokens: point.metrics.input_tokens,
                 output_tokens: point.metrics.output_tokens,
-                cached_tokens: point.metrics.cached_tokens,
+                cached_input_tokens: point.metrics.cached_input_tokens,
                 total_tokens: point.metrics.total_tokens,
                 estimated_cost: usd_cost(&point.costs),
                 standard_cost: standard_costs_by_bucket.get(&point.bucket_start).cloned(),
@@ -558,7 +514,7 @@ fn build_usage_insights(
                     usd_cost(&point.costs).as_ref(),
                 ),
                 cached_token_rate: rate_or_zero(
-                    point.metrics.cached_tokens,
+                    point.metrics.cached_input_tokens,
                     point.metrics.input_tokens,
                 ),
                 cache_hit_request_rate: ratio(
@@ -571,6 +527,7 @@ fn build_usage_insights(
         coverage: overview.attempts.cost_coverage.clone(),
     };
     Ok(UsageInsights {
+        analytics: overview.analytics,
         granularity,
         health,
         performance,
@@ -620,58 +577,65 @@ struct UsageCostScenarios {
     no_cache: ScenarioCosts,
 }
 
-async fn recover_standard_costs(
-    providers: &ProviderAdminRegistry,
-    mut facts: UsageCalculatedBillingStream<'_>,
-) -> Result<UsageCostScenarios, AdminError> {
-    let mut scenarios = UsageCostScenarios::default();
-    while let Some(mut fact) = facts
-        .try_next()
-        .await
-        .map_err(|error| map_store_error(error, "usage billing facts"))?
-    {
+/// 在后台投影时恢复费用场景，查询不再逐请求读取计费快照
+pub struct ProviderUsageBillingProjector {
+    providers: ProviderAdminRegistry,
+}
+
+impl ProviderUsageBillingProjector {
+    #[must_use]
+    pub fn new(providers: ProviderAdminRegistry) -> Self {
+        Self { providers }
+    }
+}
+
+impl UsageBillingProjector for ProviderUsageBillingProjector {
+    fn project(
+        &self,
+        fact: &UsageCalculatedBillingFact,
+    ) -> Result<UsageBillingProjection, AdminError> {
         let Ok(provider_kind) = ProviderKind::new(fact.provider_kind.clone()) else {
-            continue;
+            return Ok(UsageBillingProjection::default());
         };
         let input = ProviderBillingInput {
             upstream_model_id: fact.upstream_model_id.clone(),
             service_tier: fact.service_tier.clone(),
             input_tokens: fact.input_tokens,
             output_tokens: fact.output_tokens,
-            cached_tokens: fact.cached_tokens,
-            cache_write_tokens: fact.cache_write_tokens,
+            cached_input_tokens: fact.cached_input_tokens,
+            cache_write_input_tokens: fact.cache_write_input_tokens,
             total: fact.total.clone(),
         };
         let breakdown = match fact
             .breakdown
-            .take()
-            .filter(|b| b.total_amount == input.total)
+            .as_ref()
+            .filter(|breakdown| breakdown.total_amount == input.total)
+            .cloned()
             .map_or_else(
-                || providers.calculated_billing(&provider_kind, &input),
-                |b| Ok(Some(b)),
+                || self.providers.calculated_billing(&provider_kind, &input),
+                |breakdown| Ok(Some(breakdown)),
             ) {
             Ok(breakdown) => breakdown,
-            Err(error) if error.kind() == ProviderAdminErrorKind::Unsupported => continue,
+            Err(error) if error.kind() == ProviderAdminErrorKind::Unsupported => {
+                return Ok(UsageBillingProjection::default());
+            }
             Err(error) => return Err(map_provider_error(error, "usage billing")),
         };
         let Some(breakdown) = breakdown else {
-            continue;
+            return Ok(UsageBillingProjection::default());
         };
         if !breakdown
             .standard_amount
             .currency
             .eq_ignore_ascii_case("USD")
         {
-            continue;
-        }
-        scenarios
-            .standard
-            .add(fact.bucket_start, breakdown.standard_amount.amount.clone())?;
-        if let Some(no_cache_cost) = no_cache_cost(&fact, &breakdown) {
-            scenarios.no_cache.add(fact.bucket_start, no_cache_cost)?;
+            return Ok(UsageBillingProjection::default());
         }
+        Ok(UsageBillingProjection {
+            standard_amount: Some(breakdown.standard_amount.amount.clone()),
+            no_cache_amount: no_cache_cost(fact, &breakdown),
+        })
     }
-    Ok(scenarios)
 }
 
 fn no_cache_cost(
@@ -682,19 +646,21 @@ fn no_cache_cost(
     let input_tokens = fact
         .input_tokens?
         .checked_sub(image.map_or(0, |i| i.input_tokens))?;
-    let cached_tokens = fact
-        .cached_tokens
+    let cached_input_tokens = fact
+        .cached_input_tokens
         .unwrap_or_default()
-        .checked_sub(image.map_or(0, |i| i.cached_tokens))?
+        .checked_sub(image.map_or(0, |i| i.cached_input_tokens))?
         .min(input_tokens);
-    let cache_write_tokens = fact
-        .cache_write_tokens
+    let cache_write_input_tokens = fact
+        .cache_write_input_tokens
         .unwrap_or_default()
-        .min(input_tokens.saturating_sub(cached_tokens));
+        .min(input_tokens.saturating_sub(cached_input_tokens));
     let input_rate = decimal(&breakdown.input_price_per_million.amount)?;
     let replaced_input_amount = input_rate
         .scaled()
-        .checked_mul(u128::from(cached_tokens.saturating_add(cache_write_tokens)))?
+        .checked_mul(u128::from(
+            cached_input_tokens.saturating_add(cache_write_input_tokens),
+        ))?
         .checked_div(1_000_000)?;
     let mut total = decimal(&breakdown.total_amount.amount)?
         .scaled()
@@ -704,7 +670,7 @@ fn no_cache_cost(
     if let Some(image) = image {
         let image_no_cache = decimal(&image.input_price_per_million.amount)?
             .scaled()
-            .checked_mul(u128::from(image.cached_tokens))?
+            .checked_mul(u128::from(image.cached_input_tokens))?
             .checked_div(1_000_000)?;
         total = total
             .checked_sub(decimal(&image.cache_read_amount.amount)?.scaled())?
@@ -829,8 +795,8 @@ impl DefaultObservabilityService {
                 service_tier: record.service_tier.clone(),
                 input_tokens: record.input_tokens,
                 output_tokens: record.output_tokens,
-                cached_tokens: record.cached_tokens,
-                cache_write_tokens: record.cache_write_tokens,
+                cached_input_tokens: record.cached_input_tokens,
+                cache_write_input_tokens: record.cache_write_input_tokens,
                 total: total.clone(),
             };
             if let Ok(Some(breakdown)) = self.providers.calculated_billing(&provider_kind, &input) {
@@ -861,8 +827,8 @@ impl DefaultObservabilityService {
                 service_tier: record.service_tier.clone(),
                 input_tokens: record.input_tokens,
                 output_tokens: record.output_tokens,
-                cached_tokens: record.cached_tokens,
-                cache_write_tokens: record.cache_write_tokens,
+                cached_input_tokens: record.cached_input_tokens,
+                cache_write_input_tokens: record.cache_write_input_tokens,
                 total: total.clone(),
             };
             if let Ok(Some(breakdown)) = self.providers.calculated_billing(&provider_kind, &input) {
@@ -951,7 +917,11 @@ pub(super) fn health_timeline_at(
     })
 }
 
-fn trend(kind: TrendKind, points: Vec<RequestMetricPoint>) -> Result<Trend, AdminError> {
+fn trend(
+    kind: TrendKind,
+    points: Vec<RequestMetricPoint>,
+    analytics: crate::model::analytics::AnalyticsMetadata,
+) -> Result<Trend, AdminError> {
     let mut metrics = RequestMetrics::default();
     let mut coverage = CostCoverage::default();
     let mut costs = BTreeMap::<String, DecimalAmount>::new();
@@ -1007,13 +977,14 @@ fn trend(kind: TrendKind, points: Vec<RequestMetricPoint>) -> Result<Trend, Admi
         .filter_map(|point| point.metrics.output_throughput_p50)
         .min();
     Ok(Trend {
+        analytics,
         kind,
         points: points.into_iter().map(trend_point).collect(),
         summary: TrendSummary {
             request_count: metrics.request_count,
             input_tokens: metrics.input_tokens,
             output_tokens: metrics.output_tokens,
-            cached_tokens: metrics.cached_tokens,
+            cached_input_tokens: metrics.cached_input_tokens,
             total_tokens: metrics.total_tokens,
             service_failure_count,
             average_latency_ms,
@@ -1044,7 +1015,10 @@ fn trend_point(point: RequestMetricPoint) -> TrendPoint {
             point.metrics.first_token_latency_sum_ms,
             point.metrics.first_token_latency_count,
         ),
-        cached_token_rate: rate_or_zero(point.metrics.cached_tokens, point.metrics.input_tokens),
+        cached_token_rate: rate_or_zero(
+            point.metrics.cached_input_tokens,
+            point.metrics.input_tokens,
+        ),
         cache_hit_request_rate: ratio(
             point.metrics.cache_hit_request_count,
             point.metrics.cache_eligible_request_count,
@@ -1070,11 +1044,13 @@ fn dashboard_period_metrics(
         result.request_count = result.request_count.saturating_add(metrics.request_count);
         result.input_tokens = result.input_tokens.saturating_add(metrics.input_tokens);
         result.output_tokens = result.output_tokens.saturating_add(metrics.output_tokens);
-        result.cached_tokens = result.cached_tokens.saturating_add(metrics.cached_tokens);
+        result.cached_input_tokens = result
+            .cached_input_tokens
+            .saturating_add(metrics.cached_input_tokens);
         result.total_tokens = result.total_tokens.saturating_add(metrics.total_tokens);
     }
-    result.cached_token_rate = rate_or_zero(result.cached_tokens, result.input_tokens);
-    result.observed_cached_token_rate = ratio(result.cached_tokens, result.input_tokens);
+    result.cached_token_rate = rate_or_zero(result.cached_input_tokens, result.input_tokens);
+    result.observed_cached_token_rate = ratio(result.cached_input_tokens, result.input_tokens);
     result
 }
 
@@ -1091,13 +1067,15 @@ fn add_request_metrics(total: &mut RequestMetrics, value: &RequestMetrics) {
         .saturating_add(value.caller_error_count);
     total.input_tokens = total.input_tokens.saturating_add(value.input_tokens);
     total.output_tokens = total.output_tokens.saturating_add(value.output_tokens);
-    total.cached_tokens = total.cached_tokens.saturating_add(value.cached_tokens);
-    total.cache_write_tokens = total
-        .cache_write_tokens
-        .saturating_add(value.cache_write_tokens);
-    total.reasoning_tokens = total
-        .reasoning_tokens
-        .saturating_add(value.reasoning_tokens);
+    total.cached_input_tokens = total
+        .cached_input_tokens
+        .saturating_add(value.cached_input_tokens);
+    total.cache_write_input_tokens = total
+        .cache_write_input_tokens
+        .saturating_add(value.cache_write_input_tokens);
+    total.reasoning_output_tokens = total
+        .reasoning_output_tokens
+        .saturating_add(value.reasoning_output_tokens);
     total.total_tokens = total.total_tokens.saturating_add(value.total_tokens);
     total.first_token_latency_sum_ms = total
         .first_token_latency_sum_ms

backend/crates/gateway-admin/src/use_case/observability/store_cache.rs

@@ -0,0 +1,298 @@
+//! 有界统计缓存：身份和完整筛选参与键，删除版本阻止旧数据复活
+
+use crate::model::observability::*;
+use crate::ports::store::{
+    AdminStoreError, AdminStoreErrorKind, AdminStoreResult, ObservabilityStore,
+};
+use async_trait::async_trait;
+use chrono::{DateTime, Utc};
+use std::{collections::HashMap, future::Future, hash::Hash, sync::Arc, time::Duration};
+use tokio::{sync::Mutex, time::Instant};
+
+const CAPACITY: usize = 64;
+const TTL: Duration = Duration::from_secs(15);
+const MAX_STALE: Duration = Duration::from_secs(60);
+const REQUEST_TIMEOUT: Duration = Duration::from_secs(10);
+
+type Slot<T> = Arc<Mutex<Option<Cached<T>>>>;
+struct Cached<T> {
+    value: T,
+    created: Instant,
+}
+struct Entry<T> {
+    slot: Slot<T>,
+    touched: Instant,
+}
+struct Cache<K, T> {
+    entries: Mutex<HashMap<K, Entry<T>>>,
+}
+impl<K, T> Default for Cache<K, T> {
+    fn default() -> Self {
+        Self {
+            entries: Mutex::new(HashMap::new()),
+        }
+    }
+}
+
+trait AnalyticsValue: Clone {
+    fn metadata(&mut self) -> &mut AnalyticsMetadata;
+}
+impl AnalyticsValue for DashboardObservation {
+    fn metadata(&mut self) -> &mut AnalyticsMetadata {
+        &mut self.analytics
+    }
+}
+impl AnalyticsValue for UsageOverview {
+    fn metadata(&mut self) -> &mut AnalyticsMetadata {
+        &mut self.analytics
+    }
+}
+impl AnalyticsValue for UsageInsightsObservation {
+    fn metadata(&mut self) -> &mut AnalyticsMetadata {
+        &mut self.overview.analytics
+    }
+}
+impl AnalyticsValue for DiagnosticsObservation {
+    fn metadata(&mut self) -> &mut AnalyticsMetadata {
+        &mut self.analytics
+    }
+}
+
+impl<K: Eq + Hash, T: AnalyticsValue> Cache<K, T> {
+    async fn get<F, Fut>(
+        &self,
+        key: K,
+        store: &dyn ObservabilityStore,
+        ttl: Duration,
+        load: F,
+    ) -> AdminStoreResult<T>
+    where
+        F: FnOnce() -> Fut,
+        Fut: Future<Output = AdminStoreResult<T>>,
+    {
+        // 刷新失败后的同键等待也计入预算，避免串行重试把延迟放大为队列长度倍数
+        tokio::time::timeout(
+            REQUEST_TIMEOUT,
+            self.get_within_budget(key, store, ttl, load),
+        )
+        .await
+        .map_err(|source| {
+            AdminStoreError::new(
+                AdminStoreErrorKind::Unavailable,
+                "observability cache",
+                "observability cache execution budget is exhausted",
+            )
+            .with_source(source)
+        })?
+    }
+
+    async fn get_within_budget<F, Fut>(
+        &self,
+        key: K,
+        store: &dyn ObservabilityStore,
+        ttl: Duration,
+        load: F,
+    ) -> AdminStoreResult<T>
+    where
+        F: FnOnce() -> Fut,
+        Fut: Future<Output = AdminStoreResult<T>>,
+    {
+        let slot = {
+            let mut entries = self.entries.lock().await;
+            if !entries.contains_key(&key) && entries.len() >= CAPACITY {
+                let oldest = entries
+                    .iter()
+                    .filter(|(_, entry)| Arc::strong_count(&entry.slot) == 1)
+                    .min_by_key(|(_, entry)| entry.touched)
+                    .map(|(_, entry)| entry.touched);
+                if let Some(oldest) = oldest {
+                    entries.retain(|_, entry| entry.touched != oldest);
+                }
+            }
+            if !entries.contains_key(&key) && entries.len() >= CAPACITY {
+                drop(entries);
+                return load().await;
+            }
+            let entry = entries.entry(key).or_insert_with(|| Entry {
+                slot: Arc::new(Mutex::new(None)),
+                touched: Instant::now(),
+            });
+            entry.touched = Instant::now();
+            entry.slot.clone()
+        };
+        // 同键刷新只执行一次；失败不会缓存成成功，也不延长旧结果寿命
+        let mut cached = slot.lock().await;
+        // 等锁期间代次可能推进；取得同键锁后再核对，失败时也不能回用已删除事实
+        let generation = store.analytics_cache_generation().await?;
+        if let Some(entry) = cached.as_mut()
+            && entry.value.metadata().generation == generation
+            && entry.created.elapsed() < ttl
+        {
+            return Ok(with_age(entry.value.clone(), false));
+        }
+        match load().await {
+            Ok(value) => {
+                *cached = Some(Cached {
+                    value: value.clone(),
+                    created: Instant::now(),
+                });
+                Ok(value)
+            }
+            Err(error) => {
+                if ttl == TTL
+                    && error.kind() == AdminStoreErrorKind::Unavailable
+                    && let Some(entry) = cached.as_mut()
+                    && entry.created.elapsed() <= MAX_STALE
+                    && Utc::now()
+                        .signed_duration_since(entry.value.metadata().generated_at)
+                        .to_std()
+                        .unwrap_or_default()
+                        <= MAX_STALE
+                    && entry.value.metadata().state != AnalyticsState::Building
+                    && entry.value.metadata().generation
+                        == store.analytics_cache_generation().await?
+                {
+                    return Ok(with_age(entry.value.clone(), true));
+                }
+                Err(error)
+            }
+        }
+    }
+}
+
+fn with_age<T: AnalyticsValue>(mut value: T, stale: bool) -> T {
+    let metadata = value.metadata();
+    metadata.lag_seconds = metadata.lag_seconds.saturating_add(
+        Utc::now()
+            .signed_duration_since(metadata.generated_at)
+            .num_seconds()
+            .max(0) as u64,
+    );
+    if stale {
+        metadata.state = AnalyticsState::Stale;
+    }
+    value
+}
+
+fn normalized(mut filter: UsageFilter) -> UsageFilter {
+    filter.routing_group_refs.sort_unstable();
+    filter.routing_group_refs.dedup();
+    filter
+}
+
+type UsageKey = (TimeRange, UsageFilter);
+pub(crate) struct CachedObservabilityStore {
+    inner: Arc<dyn ObservabilityStore>,
+    dashboard: Cache<DashboardQuery, DashboardObservation>,
+    summaries: Cache<UsageKey, UsageOverview>,
+    insights: Cache<(UsageKey, Granularity), UsageInsightsObservation>,
+    diagnostics: Cache<(UsageKey, DiagnosticDimension, u16), DiagnosticsObservation>,
+}
+impl CachedObservabilityStore {
+    pub(crate) fn new(inner: Arc<dyn ObservabilityStore>) -> Self {
+        Self {
+            inner,
+            dashboard: Cache::default(),
+            summaries: Cache::default(),
+            insights: Cache::default(),
+            diagnostics: Cache::default(),
+        }
+    }
+}
+
+#[async_trait]
+impl ObservabilityStore for CachedObservabilityStore {
+    async fn analytics_cache_generation(&self) -> AdminStoreResult<u64> {
+        self.inner.analytics_cache_generation().await
+    }
+    async fn dashboard_summary(
+        &self,
+        query: DashboardQuery,
+        observed_at: DateTime<Utc>,
+    ) -> AdminStoreResult<DashboardObservation> {
+        // 复合概览还包含账号容量和最近请求，保持原有两秒实时刷新上限
+        self.dashboard
+            .get(
+                query.clone(),
+                self.inner.as_ref(),
+                Duration::from_secs(2),
+                || self.inner.dashboard_summary(query, observed_at),
+            )
+            .await
+    }
+    async fn dashboard_trend(
+        &self,
+        range: TimeRange,
+        granularity: Granularity,
+    ) -> AdminStoreResult<Vec<RequestMetricPoint>> {
+        self.inner.dashboard_trend(range, granularity).await
+    }
+    async fn usage_trend(
+        &self,
+        range: TimeRange,
+        filter: UsageFilter,
+        granularity: Granularity,
+    ) -> AdminStoreResult<Vec<RequestMetricPoint>> {
+        self.inner.usage_trend(range, filter, granularity).await
+    }
+    async fn usage_insights_observation(
+        &self,
+        range: TimeRange,
+        filter: UsageFilter,
+        granularity: Granularity,
+    ) -> AdminStoreResult<UsageInsightsObservation> {
+        let filter = normalized(filter);
+        self.insights
+            .get(
+                ((range, filter.clone()), granularity),
+                self.inner.as_ref(),
+                TTL,
+                || {
+                    self.inner
+                        .usage_insights_observation(range, filter, granularity)
+                },
+            )
+            .await
+    }
+    async fn usage_summary(
+        &self,
+        range: TimeRange,
+        filter: UsageFilter,
+    ) -> AdminStoreResult<UsageOverview> {
+        let filter = normalized(filter);
+        self.summaries
+            .get((range, filter.clone()), self.inner.as_ref(), TTL, || {
+                self.inner.usage_summary(range, filter)
+            })
+            .await
+    }
+    async fn usage_diagnostics(
+        &self,
+        range: TimeRange,
+        filter: UsageFilter,
+        dimension: DiagnosticDimension,
+        limit: u16,
+    ) -> AdminStoreResult<DiagnosticsObservation> {
+        let filter = normalized(filter);
+        self.diagnostics
+            .get(
+                ((range, filter.clone()), dimension, limit),
+                self.inner.as_ref(),
+                TTL,
+                || {
+                    self.inner
+                        .usage_diagnostics(range, filter, dimension, limit)
+                },
+            )
+            .await
+    }
+    async fn list_usage_records(&self, query: UsageQuery) -> AdminStoreResult<UsagePage> {
+        self.inner.list_usage_records(query).await
+    }
+    async fn usage_record_detail(&self, request_id: &str) -> AdminStoreResult<UsageDetail> {
+        self.inner.usage_record_detail(request_id).await
+    }
+    async fn list_ops_errors(&self, query: OpsErrorQuery) -> AdminStoreResult<OpsErrorPage> {
+        self.inner.list_ops_errors(query).await
+    }
+}

backend/crates/gateway-admin/src/use_case/settings.rs

@@ -22,6 +22,13 @@ use super::{map_store_error, publish_committed};
 /// API 消费的 Runtime settings 管理服务
 #[async_trait]
 pub trait SettingsService: Send + Sync {
+    async fn preview_privacy_policy(
+        &self,
+        _request: gateway_core::settings::privacy::PrivacyPreviewRequest,
+    ) -> Result<gateway_core::settings::privacy::PrivacyPreviewResult, AdminError> {
+        Err(AdminError::invalid("隐私预览不可用"))
+    }
+
     async fn preview_pricing_sync(
         &self,
     ) -> Result<crate::model::pricing::PricingSyncPreview, AdminError>;
@@ -117,6 +124,21 @@ fn validate_settings(command: &ReplaceRuntimeSettings) -> Result<(), AdminError>
 
 #[async_trait]
 impl SettingsService for DefaultSettingsService {
+    async fn preview_privacy_policy(
+        &self,
+        request: gateway_core::settings::privacy::PrivacyPreviewRequest,
+    ) -> Result<gateway_core::settings::privacy::PrivacyPreviewResult, AdminError> {
+        self.profile_provider("openai")?
+            .preview_privacy_policy(request)
+            .map_err(|error| {
+                AdminError::invalid(format!(
+                    "第 {} 条规则：{}",
+                    error.rule_index + 1,
+                    error.reason
+                ))
+            })
+    }
+
     async fn preview_pricing_sync(
         &self,
     ) -> Result<crate::model::pricing::PricingSyncPreview, AdminError> {
@@ -342,6 +364,17 @@ impl SettingsService for DefaultSettingsService {
         mut command: ReplaceRuntimeSettings,
     ) -> Result<RuntimeSettings, AdminError> {
         validate_settings(&command)?;
+        if command.values.codex_privacy_policy != Default::default() {
+            self.profile_provider("openai")?
+                .compile_privacy_policy(&command.values.codex_privacy_policy)
+                .map_err(|error| {
+                    AdminError::invalid(format!(
+                        "第 {} 条规则：{}",
+                        error.rule_index + 1,
+                        error.reason
+                    ))
+                })?;
+        }
         if command
             .request_profile_updates
             .values()

backend/crates/gateway-admin/tests/main.rs

@@ -170,9 +170,9 @@ fn usage_window_should_not_use_daily_rolling_usage_for_weekly_statistics() {
         success_count: 5,
         input_tokens: Some(100),
         output_tokens: Some(20),
-        cached_tokens: Some(80),
-        cache_write_tokens: Some(0),
-        reasoning_tokens: Some(0),
+        cached_input_tokens: Some(80),
+        cache_write_input_tokens: Some(0),
+        reasoning_output_tokens: Some(0),
         image_input_tokens: Some(0),
         image_output_tokens: Some(0),
         image_request_count: 0,

backend/crates/gateway-admin/tests/model/provider_credentials.rs

@@ -115,9 +115,9 @@ fn usage_window(key: &str, group: &str, seconds: u64) -> ProviderQuotaWindow {
             success_count: 0,
             input_tokens: None,
             output_tokens: None,
-            cached_tokens: None,
-            cache_write_tokens: None,
-            reasoning_tokens: None,
+            cached_input_tokens: None,
+            cache_write_input_tokens: None,
+            reasoning_output_tokens: None,
             image_input_tokens: None,
             image_output_tokens: None,
             image_request_count: 0,

backend/crates/gateway-admin/tests/model/quota_forecast.rs

@@ -32,9 +32,9 @@ fn window(key: &str, days: u64) -> ProviderQuotaWindow {
             success_count: 10,
             input_tokens: Some(900),
             output_tokens: Some(100),
-            cached_tokens: Some(800),
-            cache_write_tokens: None,
-            reasoning_tokens: None,
+            cached_input_tokens: Some(800),
+            cache_write_input_tokens: None,
+            reasoning_output_tokens: None,
             image_input_tokens: None,
             image_output_tokens: None,
             image_request_count: 0,
@@ -84,7 +84,7 @@ fn samples(quota: &ProviderQuota) -> Vec<QuotaForecastSample> {
                 tokens: usage.total_tokens.unwrap_or(0),
                 input_tokens: usage.input_tokens.unwrap_or(0),
                 output_tokens: usage.output_tokens.unwrap_or(0),
-                cached_tokens: usage.cached_tokens.unwrap_or(0),
+                cached_input_tokens: usage.cached_input_tokens.unwrap_or(0),
                 missing_token_count: u64::from(usage.total_tokens.is_none()),
                 known_cost_count: if usd.is_some() {
                     usage.cost_coverage.known_count()

backend/crates/gateway-admin/tests/use_case/accounts.rs

@@ -1115,6 +1115,7 @@ impl SettingsStore for StaticSettingsStore {
             rotation_strategy: RotationStrategy::Smart,
             updated_at: Utc::now(),
             values: gateway_admin::model::settings::RuntimeSettingsValues {
+                codex_privacy_policy: Default::default(),
                 request_location_enabled: false,
                 request_location: Default::default(),
                 refresh_margin_seconds: 300,
@@ -3031,9 +3032,9 @@ fn quota_local_usage(account_id: &str, total_tokens: u64) -> AccountUsage {
         success_count: 1,
         input_tokens: Some(total_tokens),
         output_tokens: Some(0),
-        cached_tokens: Some(0),
-        cache_write_tokens: Some(0),
-        reasoning_tokens: Some(0),
+        cached_input_tokens: Some(0),
+        cache_write_input_tokens: Some(0),
+        reasoning_output_tokens: Some(0),
         image_input_tokens: Some(0),
         image_output_tokens: Some(0),
         image_request_count: 0,

backend/crates/gateway-admin/tests/use_case/freeze_recovery.rs

@@ -32,6 +32,7 @@ fn runtime_settings(enabled: bool, probe_enabled: bool, adaptive: bool) -> Runti
         rotation_strategy: gateway_admin::model::settings::RotationStrategy::Smart,
         updated_at: Utc::now(),
         values: gateway_admin::model::settings::RuntimeSettingsValues {
+            codex_privacy_policy: Default::default(),
             request_location_enabled: false,
             request_location: Default::default(),
             refresh_margin_seconds: 300,

backend/crates/gateway-admin/tests/use_case/mod.rs

@@ -772,15 +772,17 @@ impl ObservabilityStore for UnavailableStore {
         Err(unavailable("usage trend"))
     }
 
-    fn usage_calculated_billing_facts(
+    async fn analytics_cache_generation(&self) -> AdminStoreResult<u64> {
+        Err(unavailable("analytics generation"))
+    }
+
+    async fn usage_insights_observation(
         &self,
         _: TimeRange,
         _: UsageFilter,
         _: Granularity,
-    ) -> gateway_admin::ports::store::UsageCalculatedBillingStream<'_> {
-        Box::pin(futures::stream::once(async {
-            Err(unavailable("usage billing facts"))
-        }))
+    ) -> AdminStoreResult<gateway_admin::model::observability::UsageInsightsObservation> {
+        Err(unavailable("usage insights"))
     }
 
     async fn list_usage_records(&self, _: UsageQuery) -> AdminStoreResult<UsagePage> {

backend/crates/gateway-admin/tests/use_case/observability/mod.rs

@@ -17,13 +17,13 @@ use gateway_admin::{
     model::{
         MutationContext, Revision,
         observability::{
-            AccountPoolMetrics, AttemptMetrics, CostCoverage, CurrencyCost, DashboardAccountUsage,
-            DashboardObservation, DashboardQuery, DashboardRuntimeSlots, DiagnosticDimension,
-            DiagnosticObservation, DiagnosticsObservation, Granularity, HealthStatus,
-            LatencyPercentiles, ObservabilityPageSize, OpsErrorPage, OpsErrorQuery,
+            AccountPoolMetrics, AnalyticsState, AttemptMetrics, CostCoverage, CurrencyCost,
+            DashboardAccountUsage, DashboardObservation, DashboardQuery, DashboardRuntimeSlots,
+            DiagnosticDimension, DiagnosticObservation, DiagnosticsObservation, Granularity,
+            HealthStatus, LatencyPercentiles, ObservabilityPageSize, OpsErrorPage, OpsErrorQuery,
             PercentileMilliseconds, RequestMetricPoint, RequestMetrics, TimeRange, TrendKind,
-            UsageBilling, UsageCalculatedBillingFact, UsageDetail, UsageFilter, UsageListRecord,
-            UsageOverview, UsagePage, UsageQuery,
+            UsageBilling, UsageDetail, UsageFilter, UsageInsightsObservation, UsageListRecord,
+            UsageOverview, UsagePage, UsageProjectedCostPoint, UsageQuery,
         },
         settings::{
             AdminApiKey, AdminApiKeyMutation, ReplaceRuntimeSettings, RotationStrategy,
@@ -300,7 +300,7 @@ async fn dashboard_summary_should_observe_current_accounts_for_a_historical_rang
 }
 
 #[tokio::test]
-async fn dashboard_summary_should_coalesce_concurrent_requests_in_one_short_window() {
+async fn dashboard_summary_should_keep_distinct_exact_ranges_in_one_short_window() {
     let end_bucket = Utc::now().timestamp().div_euclid(2) * 2;
     let first_end = DateTime::from_timestamp(end_bucket, 100_000_000).expect("first end");
     let second_end = DateTime::from_timestamp(end_bucket, 900_000_000).expect("second end");
@@ -330,7 +330,7 @@ async fn dashboard_summary_should_coalesce_concurrent_requests_in_one_short_wind
 
     first.expect("first dashboard summary");
     second.expect("second dashboard summary");
-    assert_eq!(store.dashboard_summary_calls(), 1);
+    assert_eq!(store.dashboard_summary_calls(), 2);
 }
 
 #[tokio::test]
@@ -403,6 +403,7 @@ async fn observability_services_should_calculate_usage_insights_and_diagnostic_s
         ..RequestMetrics::default()
     };
     store.replace_overview(UsageOverview {
+        analytics: Default::default(),
         range,
         requests: metrics.clone(),
         attempts: AttemptMetrics {
@@ -431,23 +432,13 @@ async fn observability_services_should_calculate_usage_insights_and_diagnostic_s
                 .expect("bucket USD cost"),
         }],
     }]);
-    store.replace_calculated_billing_facts(vec![UsageCalculatedBillingFact {
-        breakdown: None,
+    store.replace_projected_costs(vec![UsageProjectedCostPoint {
         bucket_start: quarter_hour_start(now),
-        provider_kind: "openai".to_owned(),
-        upstream_model_id: "gpt-5.5".to_owned(),
-        service_tier: None,
-        input_tokens: Some(800),
-        output_tokens: Some(200),
-        cached_tokens: Some(0),
-        cache_write_tokens: Some(0),
-        total: CurrencyCost {
-            currency: "USD".to_owned(),
-            amount: gateway_admin::model::observability::DecimalAmount::from_str("1.25")
-                .expect("calculated total"),
-        },
+        standard_amount: Some("1".parse().expect("standard cost")),
+        no_cache_amount: Some("1.25".parse().expect("no-cache cost")),
     }]);
     store.replace_diagnostics(DiagnosticsObservation {
+        analytics: Default::default(),
         total_request_count: 4,
         items: vec![diagnostic("openai", 3), diagnostic("xai", 1)],
     });
@@ -543,6 +534,7 @@ async fn diagnostics_should_preserve_request_order_when_a_small_sample_fails() {
     failure.success_count = 0;
     failure.failure_count = 1;
     store.replace_diagnostics(DiagnosticsObservation {
+        analytics: Default::default(),
         total_request_count: 101,
         items: vec![success, failure],
     });
@@ -566,6 +558,7 @@ async fn diagnostics_should_use_the_total_before_truncating_groups() {
     let range = observation_range(Utc::now());
     let store = Arc::new(FixtureObservabilityStore::new(range));
     store.replace_diagnostics(DiagnosticsObservation {
+        analytics: Default::default(),
         total_request_count: 200,
         items: (0..100)
             .map(|index| diagnostic(&format!("model-{index}"), 1))
@@ -591,6 +584,7 @@ async fn diagnostics_should_count_each_retried_request_once() {
     item.retry_count = 6;
     item.retried_request_count = 2;
     store.replace_diagnostics(DiagnosticsObservation {
+        analytics: Default::default(),
         total_request_count: 8,
         items: vec![item],
     });
@@ -691,26 +685,16 @@ async fn usage_records_should_enrich_provider_reported_totals_when_pricing_match
 }
 
 #[tokio::test]
-async fn usage_insights_should_reject_partial_costs_when_billing_stream_fails() {
+async fn usage_insights_should_reject_partial_costs_when_insights_fail() {
     let now = Utc::now();
     let range = observation_range(now);
     let store = Arc::new(FixtureObservabilityStore::new(range));
-    store.replace_calculated_billing_facts(vec![UsageCalculatedBillingFact {
-        breakdown: None,
+    store.replace_projected_costs(vec![UsageProjectedCostPoint {
         bucket_start: quarter_hour_start(now),
-        provider_kind: "openai".to_owned(),
-        upstream_model_id: "gpt-5.5".to_owned(),
-        service_tier: None,
-        input_tokens: Some(800),
-        output_tokens: Some(200),
-        cached_tokens: Some(0),
-        cache_write_tokens: Some(0),
-        total: CurrencyCost {
-            currency: "USD".to_owned(),
-            amount: "1.25".parse().expect("cost"),
-        },
+        standard_amount: Some("1".parse().expect("standard cost")),
+        no_cache_amount: Some("1.25".parse().expect("no-cache cost")),
     }]);
-    store.billing_stream_fails.store(true, Ordering::SeqCst);
+    store.insights_fail.store(true, Ordering::SeqCst);
     let services = observability_services_with_calculated_billing(store).await;
     assert!(
         services
@@ -741,9 +725,9 @@ async fn dashboard_should_preserve_provider_plan_names() {
             success_count: 0,
             input_tokens: None,
             output_tokens: None,
-            cached_tokens: None,
-            cache_write_tokens: None,
-            reasoning_tokens: None,
+            cached_input_tokens: None,
+            cache_write_input_tokens: None,
+            reasoning_output_tokens: None,
             image_input_tokens: None,
             image_output_tokens: None,
             image_request_count: 0,
@@ -783,8 +767,9 @@ async fn dashboard_should_preserve_provider_plan_names() {
 struct FixtureObservabilityStore {
     trend: Mutex<Vec<RequestMetricPoint>>,
     overview: Mutex<UsageOverview>,
-    calculated_billing_facts: Mutex<Vec<UsageCalculatedBillingFact>>,
-    billing_stream_fails: AtomicBool,
+    projected_costs: Mutex<Vec<UsageProjectedCostPoint>>,
+    insights_fail: AtomicBool,
+    summary_fail: AtomicBool,
     diagnostics: Mutex<DiagnosticsObservation>,
     runtime_slots: Mutex<Option<DashboardRuntimeSlots>>,
     summary_observed_at: Mutex<Option<DateTime<Utc>>>,
@@ -794,6 +779,7 @@ struct FixtureObservabilityStore {
     account_usage: Mutex<Vec<DashboardAccountUsage>>,
     dashboard_delay: Mutex<StdDuration>,
     dashboard_summary_calls: AtomicUsize,
+    usage_summary_filters: Mutex<Vec<UsageFilter>>,
 }
 
 impl FixtureObservabilityStore {
@@ -801,13 +787,15 @@ impl FixtureObservabilityStore {
         Self {
             trend: Mutex::new(Vec::new()),
             overview: Mutex::new(UsageOverview {
+                analytics: Default::default(),
                 range,
                 requests: RequestMetrics::default(),
                 attempts: AttemptMetrics::default(),
                 providers: Vec::new(),
             }),
-            calculated_billing_facts: Mutex::new(Vec::new()),
-            billing_stream_fails: AtomicBool::new(false),
+            projected_costs: Mutex::new(Vec::new()),
+            insights_fail: AtomicBool::new(false),
+            summary_fail: AtomicBool::new(false),
             diagnostics: Mutex::new(DiagnosticsObservation::default()),
             runtime_slots: Mutex::new(None),
             summary_observed_at: Mutex::new(None),
@@ -817,6 +805,7 @@ impl FixtureObservabilityStore {
             account_usage: Mutex::new(Vec::new()),
             dashboard_delay: Mutex::new(StdDuration::ZERO),
             dashboard_summary_calls: AtomicUsize::new(0),
+            usage_summary_filters: Mutex::new(Vec::new()),
         }
     }
 
@@ -836,11 +825,8 @@ impl FixtureObservabilityStore {
         *self.overview.lock().expect("overview") = overview;
     }
 
-    fn replace_calculated_billing_facts(&self, facts: Vec<UsageCalculatedBillingFact>) {
-        *self
-            .calculated_billing_facts
-            .lock()
-            .expect("calculated billing facts") = facts;
+    fn replace_projected_costs(&self, facts: Vec<UsageProjectedCostPoint>) {
+        *self.projected_costs.lock().expect("projected costs") = facts;
     }
 
     fn replace_diagnostics(&self, diagnostics: DiagnosticsObservation) {
@@ -874,6 +860,7 @@ impl ObservabilityStore for FixtureObservabilityStore {
             tokio::time::sleep(dashboard_delay).await;
         }
         Ok(DashboardObservation {
+            analytics: self.overview.lock().expect("overview").analytics.clone(),
             range: query.range,
             totals: Default::default(),
             provider_accounts: AccountPoolMetrics::default(),
@@ -902,25 +889,29 @@ impl ObservabilityStore for FixtureObservabilityStore {
         Ok(self.trend.lock().expect("trend").clone())
     }
 
-    fn usage_calculated_billing_facts(
+    async fn analytics_cache_generation(&self) -> AdminStoreResult<u64> {
+        Ok(self.overview.lock().expect("overview").analytics.generation)
+    }
+
+    async fn usage_insights_observation(
         &self,
         _: TimeRange,
         _: UsageFilter,
         granularity: Granularity,
-    ) -> gateway_admin::ports::store::UsageCalculatedBillingStream<'_> {
+    ) -> AdminStoreResult<UsageInsightsObservation> {
         self.usage_granularities.lock().unwrap().push(granularity);
-        let facts = self
-            .calculated_billing_facts
-            .lock()
-            .expect("calculated billing facts")
-            .clone();
-        let error = self
-            .billing_stream_fails
-            .load(Ordering::SeqCst)
-            .then(|| Err(super::unavailable("billing stream failed")));
-        Box::pin(futures::stream::iter(
-            facts.into_iter().map(Ok).chain(error),
-        ))
+        if self.insights_fail.load(Ordering::SeqCst) {
+            return Err(super::unavailable("projection read failed"));
+        }
+        Ok(UsageInsightsObservation {
+            overview: self.overview.lock().expect("overview").clone(),
+            trend: self.trend.lock().expect("trend").clone(),
+            costs: self
+                .projected_costs
+                .lock()
+                .expect("projected costs")
+                .clone(),
+        })
     }
 
     async fn list_usage_records(&self, query: UsageQuery) -> AdminStoreResult<UsagePage> {
@@ -938,8 +929,26 @@ impl ObservabilityStore for FixtureObservabilityStore {
         Err(super::unavailable("usage detail"))
     }
 
-    async fn usage_summary(&self, _: TimeRange, _: UsageFilter) -> AdminStoreResult<UsageOverview> {
-        Ok(self.overview.lock().expect("overview").clone())
+    async fn usage_summary(
+        &self,
+        range: TimeRange,
+        filter: UsageFilter,
+    ) -> AdminStoreResult<UsageOverview> {
+        self.usage_summary_filters
+            .lock()
+            .expect("summary filters")
+            .push(filter);
+        let delay = *self.dashboard_delay.lock().expect("query delay");
+        if !delay.is_zero() {
+            tokio::time::sleep(delay).await;
+        }
+        if self.summary_fail.load(Ordering::SeqCst) {
+            return Err(super::unavailable("projection summary failed"));
+        }
+        Ok(UsageOverview {
+            range,
+            ..self.overview.lock().expect("overview").clone()
+        })
     }
 
     async fn usage_diagnostics(
@@ -988,6 +997,7 @@ impl SettingsStore for FixtureSettingsStore {
             rotation_strategy: RotationStrategy::Smart,
             updated_at: Utc::now(),
             values: gateway_admin::model::settings::RuntimeSettingsValues {
+                codex_privacy_policy: Default::default(),
                 request_location_enabled: false,
                 request_location: Default::default(),
                 refresh_margin_seconds: 300,
@@ -1113,9 +1123,9 @@ fn total_record(
         service_tier: None,
         input_tokens: Some(800),
         output_tokens: Some(200),
-        cached_tokens: Some(0),
-        cache_write_tokens: Some(0),
-        reasoning_tokens: Some(0),
+        cached_input_tokens: Some(0),
+        cache_write_input_tokens: Some(0),
+        reasoning_output_tokens: Some(0),
         image_input_tokens: None,
         image_output_tokens: None,
         total_tokens: Some(1_000),
@@ -1228,9 +1238,204 @@ async fn admin_selects_dashboard_defaults_and_matching_usage_buckets_at_range_bo
             .usage_insights(range, UsageFilter::default())
             .await
             .unwrap();
-        assert_eq!(
-            *store.usage_granularities.lock().unwrap(),
-            vec![expected, expected]
+        assert_eq!(*store.usage_granularities.lock().unwrap(), vec![expected]);
+    }
+}
+
+#[tokio::test]
+async fn usage_summary_cache_should_coalesce_identical_queries_and_invalidate_deleted_generation() {
+    let range = observation_range(Utc::now());
+    let store = Arc::new(FixtureObservabilityStore::new(range));
+    store.set_dashboard_delay(StdDuration::from_millis(20));
+    let services = observability_services(store.clone()).await;
+    let service = services.observability();
+    let filter = UsageFilter {
+        client_api_key_ref: Some("deleted-key".to_owned()),
+        ..Default::default()
+    };
+    let (first, second) = tokio::join!(
+        service.usage_summary(range, filter.clone()),
+        service.usage_summary(range, filter.clone()),
+    );
+    first.expect("first summary");
+    second.expect("coalesced summary");
+    assert_eq!(store.usage_summary_filters.lock().unwrap().len(), 1);
+    {
+        let mut overview = store.overview.lock().unwrap();
+        overview.analytics.generation = 1;
+        overview.requests.request_count = 7;
+    }
+    let refreshed = service
+        .usage_summary(range, filter)
+        .await
+        .expect("generation refresh");
+    assert_eq!(refreshed.overview.analytics.generation, 1);
+    assert_eq!(refreshed.overview.requests.request_count, 7);
+    assert_eq!(store.usage_summary_filters.lock().unwrap().len(), 2);
+}
+
+#[tokio::test(start_paused = true)]
+async fn usage_summary_cache_should_coalesce_when_generation_advances_during_the_first_load() {
+    let range = observation_range(Utc::now());
+    let store = Arc::new(FixtureObservabilityStore::new(range));
+    store.set_dashboard_delay(StdDuration::from_millis(20));
+    let services = observability_services(store.clone()).await;
+    let service = services.observability();
+    let (first, second, ()) = tokio::join!(
+        service.usage_summary(range, UsageFilter::default()),
+        service.usage_summary(range, UsageFilter::default()),
+        async {
+            tokio::time::sleep(StdDuration::from_millis(5)).await;
+            store.overview.lock().unwrap().analytics.generation = 1;
+        },
+    );
+    assert_eq!(
+        first.expect("first summary").overview.analytics.generation,
+        1
+    );
+    assert_eq!(
+        second
+            .expect("coalesced summary")
+            .overview
+            .analytics
+            .generation,
+        1
+    );
+    assert_eq!(store.usage_summary_filters.lock().unwrap().len(), 1);
+}
+
+#[tokio::test]
+async fn usage_summary_cache_should_isolate_key_identity_and_normalize_group_sets() {
+    let range = observation_range(Utc::now());
+    let store = Arc::new(FixtureObservabilityStore::new(range));
+    let services = observability_services(store.clone()).await;
+    let service = services.observability();
+    for (key, groups) in [
+        ("key-a", vec!["deleted-b", "deleted-a", "deleted-b"]),
+        ("key-a", vec!["deleted-a", "deleted-b"]),
+        ("key-b", vec!["deleted-a", "deleted-b"]),
+        ("key-a", vec!["deleted-a"]),
+    ] {
+        service
+            .usage_summary(
+                range,
+                UsageFilter {
+                    client_api_key_ref: Some(key.to_owned()),
+                    routing_group_refs: groups.into_iter().map(str::to_owned).collect(),
+                    ..Default::default()
+                },
+            )
+            .await
+            .expect("isolated summary");
+    }
+    let calls = store.usage_summary_filters.lock().unwrap();
+    assert_eq!(calls.len(), 3);
+    assert_eq!(calls[0].routing_group_refs, ["deleted-a", "deleted-b"]);
+    assert_eq!(calls[1].client_api_key_ref.as_deref(), Some("key-b"));
+    assert_eq!(calls[2].routing_group_refs, ["deleted-a"]);
+}
+
+#[tokio::test(start_paused = true)]
+async fn usage_summary_cache_should_bound_waiting_after_failed_refresh_and_allow_recovery() {
+    let range = observation_range(Utc::now());
+    let store = Arc::new(FixtureObservabilityStore::new(range));
+    store.set_dashboard_delay(StdDuration::from_secs(7));
+    store.summary_fail.store(true, Ordering::SeqCst);
+    let services = observability_services(store.clone()).await;
+    let service = services.observability();
+    let started = tokio::time::Instant::now();
+    let (first, second, third, fourth) = tokio::join!(
+        service.usage_summary(range, UsageFilter::default()),
+        service.usage_summary(range, UsageFilter::default()),
+        service.usage_summary(range, UsageFilter::default()),
+        service.usage_summary(range, UsageFilter::default()),
+    );
+    assert!(first.is_err() && second.is_err() && third.is_err() && fourth.is_err());
+    assert!(
+        started.elapsed() <= StdDuration::from_secs(10),
+        "同键失败不能使后续请求逐个等待完整数据库超时: {:?}",
+        started.elapsed()
+    );
+
+    store.summary_fail.store(false, Ordering::SeqCst);
+    store.set_dashboard_delay(StdDuration::ZERO);
+    service
+        .usage_summary(range, UsageFilter::default())
+        .await
+        .expect("cancelled cache refresh releases its slot for recovery");
+}
+
+#[tokio::test(start_paused = true)]
+async fn insights_cache_should_bound_stale_lifetime_without_renewing_failed_refreshes() {
+    let range = observation_range(Utc::now());
+    let store = Arc::new(FixtureObservabilityStore::new(range));
+    {
+        let mut overview = store.overview.lock().unwrap();
+        overview.analytics.state = AnalyticsState::Ready;
+        overview.analytics.generated_at = Utc::now();
+        overview.analytics.lag_seconds = 7;
+        overview.requests.request_count = 19;
+    }
+    let services = observability_services(store.clone()).await;
+    let service = services.observability();
+    service
+        .usage_insights(range, UsageFilter::default())
+        .await
+        .unwrap();
+    store.insights_fail.store(true, Ordering::SeqCst);
+    tokio::time::advance(StdDuration::from_secs(16)).await;
+    let stale = service
+        .usage_insights(range, UsageFilter::default())
+        .await
+        .unwrap();
+    assert_eq!(stale.analytics.state, AnalyticsState::Stale);
+    assert!(stale.analytics.lag_seconds >= 7);
+    assert_eq!(stale.health.total_requests, 19);
+    tokio::time::advance(StdDuration::from_secs(45)).await;
+    assert!(
+        service
+            .usage_insights(range, UsageFilter::default())
+            .await
+            .is_err()
+    );
+}
+
+#[tokio::test(start_paused = true)]
+async fn insights_cache_should_reject_deleted_building_and_old_generation_times() {
+    for reason in ["deleted", "building", "generated-too-long-ago"] {
+        let range = observation_range(Utc::now());
+        let store = Arc::new(FixtureObservabilityStore::new(range));
+        {
+            let mut overview = store.overview.lock().unwrap();
+            overview.analytics.state = if reason == "building" {
+                AnalyticsState::Building
+            } else {
+                AnalyticsState::Ready
+            };
+            overview.analytics.generated_at = Utc::now()
+                - Duration::seconds(if reason == "generated-too-long-ago" {
+                    61
+                } else {
+                    0
+                });
+        }
+        let services = observability_services(store.clone()).await;
+        let service = services.observability();
+        service
+            .usage_insights(range, UsageFilter::default())
+            .await
+            .unwrap();
+        store.insights_fail.store(true, Ordering::SeqCst);
+        if reason == "deleted" {
+            store.overview.lock().unwrap().analytics.generation += 1;
+        }
+        tokio::time::advance(StdDuration::from_secs(16)).await;
+        assert!(
+            service
+                .usage_insights(range, UsageFilter::default())
+                .await
+                .is_err(),
+            "{reason}"
         );
     }
 }

backend/crates/gateway-admin/tests/use_case/service_contract.rs

@@ -57,6 +57,7 @@ impl VisitMut for WireTypes {
             let last = path.path.segments.last().unwrap().clone();
             *ty = match last.ident.to_string().as_str() {
                 "DateTime" | "Tz" | "TokenPrice" | "AdminApiKey" => parse_quote!(String),
+                "Value" => parse_quote!(serde_json::Value),
                 "OpaqueProviderData" => parse_quote!(serde_json::Map<String, serde_json::Value>),
                 _ => Type::Path(syn::TypePath {
                     attrs: std::mem::take(&mut path.attrs),
@@ -79,6 +80,10 @@ fn contract_type(mut item: Item, name: &str) -> Item {
                     | "ReplaceRuntimeSettings"
                     | "AdminApiKeyMutation"
                     | "RegeneratedAdminApiKey"
+                    | "CodexPrivacyPolicy"
+                    | "PrivacyRule"
+                    | "PrivacyPreviewRequest"
+                    | "PrivacyPreviewResult"
             );
             (
                 &mut item.attrs,
@@ -107,6 +112,13 @@ fn contract_type(mut item: Item, name: &str) -> Item {
             field.vis = parse_quote!(pub);
         }
     }
+    if let Item::Enum(item) = &mut item {
+        for variant in &mut item.variants {
+            variant
+                .attrs
+                .retain(|attr| !attr.path().is_ident("default"));
+        }
+    }
     WireTypes.visit_item_mut(&mut item);
     item
 }
@@ -117,6 +129,19 @@ fn sdk_settings_contract_matches_host_declarations() {
     let mut types = Vec::new();
     let mut replacement_fields = Vec::new();
     for (path, names) in [
+        (
+            "../gateway-core/src/settings/privacy.rs",
+            &[
+                "CodexPrivacyPolicy",
+                "PrivacyFailureMode",
+                "PrivacyScope",
+                "PrivacyAction",
+                "PrivacyRule",
+                "PrivacyRuleOutcome",
+                "PrivacyPreviewRequest",
+                "PrivacyPreviewResult",
+            ][..],
+        ),
         (
             "src/model/settings.rs",
             &[

backend/crates/gateway-admin/tests/use_case/settings.rs

@@ -280,6 +280,7 @@ async fn settings_should_reject_zero_refresh_margin_before_store_call() {
                 model_mappings: Default::default(),
                 rotation_strategy: RotationStrategy::Smart,
                 values: gateway_admin::model::settings::RuntimeSettingsValues {
+                    codex_privacy_policy: Default::default(),
                     request_location_enabled: false,
                     request_location: Default::default(),
                     refresh_margin_seconds: 0,

backend/crates/gateway-api/src/admin/accounts/presenter.rs

@@ -308,8 +308,8 @@ pub(super) fn quota_local_usage(usage: &AccountUsage, time: crate::time::TimePre
         "inputTokensDisplay": display_optional_tokens(usage.input_tokens),
         "outputTokens": usage.output_tokens.unwrap_or_default(),
         "outputTokensDisplay": display_optional_tokens(usage.output_tokens),
-        "cachedTokens": usage.cached_tokens.unwrap_or_default(),
-        "cachedTokensDisplay": display_optional_tokens(usage.cached_tokens),
+        "cachedInputTokens": usage.cached_input_tokens.unwrap_or_default(),
+        "cachedInputTokensDisplay": display_optional_tokens(usage.cached_input_tokens),
         "imageInputTokens": usage.image_input_tokens.unwrap_or_default(),
         "imageInputTokensDisplay": display_optional_tokens(usage.image_input_tokens),
         "imageOutputTokens": usage.image_output_tokens.unwrap_or_default(),
@@ -355,10 +355,10 @@ pub(super) fn account_usage_view(
         input_tokens_display: display_optional_tokens(usage.input_tokens),
         output_tokens: usage.output_tokens,
         output_tokens_display: display_optional_tokens(usage.output_tokens),
-        cached_tokens: usage.cached_tokens,
-        cached_tokens_display: display_optional_tokens(usage.cached_tokens),
-        reasoning_tokens: usage.reasoning_tokens,
-        reasoning_tokens_display: display_optional_tokens(usage.reasoning_tokens),
+        cached_input_tokens: usage.cached_input_tokens,
+        cached_input_tokens_display: display_optional_tokens(usage.cached_input_tokens),
+        reasoning_output_tokens: usage.reasoning_output_tokens,
+        reasoning_output_tokens_display: display_optional_tokens(usage.reasoning_output_tokens),
         image_input_tokens: usage.image_input_tokens,
         image_input_tokens_display: display_optional_tokens(usage.image_input_tokens),
         image_output_tokens: usage.image_output_tokens,
@@ -369,10 +369,8 @@ pub(super) fn account_usage_view(
         image_request_failed_count_display: format_number(usage.image_request_failed_count),
         total_tokens: usage.total_tokens,
         total_tokens_display: display_optional_tokens(usage.total_tokens),
-        created_tokens: usage.cache_write_tokens,
-        created_tokens_display: display_optional_tokens(usage.cache_write_tokens),
-        read_tokens: usage.cached_tokens,
-        read_tokens_display: display_optional_tokens(usage.cached_tokens),
+        cache_write_input_tokens: usage.cache_write_input_tokens,
+        cache_write_input_tokens_display: display_optional_tokens(usage.cache_write_input_tokens),
         last_used_at: usage.last_used_at.map(|value| time.rfc3339(&value)),
         last_used_at_full_display: usage.last_used_at.map(|value| time.datetime(&value)),
         last_used_at_display: usage
@@ -429,8 +427,8 @@ pub(super) fn account_model_usage_view(
         input_tokens_display: display_optional_tokens(usage.input_tokens),
         output_tokens: usage.output_tokens,
         output_tokens_display: display_optional_tokens(usage.output_tokens),
-        cached_tokens: usage.cached_tokens,
-        cached_tokens_display: display_optional_tokens(usage.cached_tokens),
+        cached_input_tokens: usage.cached_input_tokens,
+        cached_input_tokens_display: display_optional_tokens(usage.cached_input_tokens),
         image_input_tokens: usage.image_input_tokens,
         image_input_tokens_display: display_optional_tokens(usage.image_input_tokens),
         image_output_tokens: usage.image_output_tokens,
@@ -478,10 +476,10 @@ pub(super) fn empty_account_usage() -> AccountUsageView {
         input_tokens_display: "—".to_owned(),
         output_tokens: None,
         output_tokens_display: "—".to_owned(),
-        cached_tokens: None,
-        cached_tokens_display: "—".to_owned(),
-        reasoning_tokens: None,
-        reasoning_tokens_display: "—".to_owned(),
+        cached_input_tokens: None,
+        cached_input_tokens_display: "—".to_owned(),
+        reasoning_output_tokens: None,
+        reasoning_output_tokens_display: "—".to_owned(),
         image_input_tokens: None,
         image_input_tokens_display: "—".to_owned(),
         image_output_tokens: None,
@@ -492,10 +490,8 @@ pub(super) fn empty_account_usage() -> AccountUsageView {
         image_request_failed_count_display: "—".to_owned(),
         total_tokens: None,
         total_tokens_display: "—".to_owned(),
-        created_tokens: None,
-        created_tokens_display: "—".to_owned(),
-        read_tokens: None,
-        read_tokens_display: "—".to_owned(),
+        cache_write_input_tokens: None,
+        cache_write_input_tokens_display: "—".to_owned(),
         last_used_at: None,
         last_used_at_full_display: None,
         last_used_at_display: "—".to_owned(),

backend/crates/gateway-api/src/admin/accounts/wire.rs

@@ -435,10 +435,10 @@ pub struct AccountUsageView {
     pub input_tokens_display: String,
     pub output_tokens: Option<u64>,
     pub output_tokens_display: String,
-    pub cached_tokens: Option<u64>,
-    pub cached_tokens_display: String,
-    pub reasoning_tokens: Option<u64>,
-    pub reasoning_tokens_display: String,
+    pub cached_input_tokens: Option<u64>,
+    pub cached_input_tokens_display: String,
+    pub reasoning_output_tokens: Option<u64>,
+    pub reasoning_output_tokens_display: String,
     pub image_input_tokens: Option<u64>,
     pub image_input_tokens_display: String,
     pub image_output_tokens: Option<u64>,
@@ -449,10 +449,8 @@ pub struct AccountUsageView {
     pub image_request_failed_count_display: String,
     pub total_tokens: Option<u64>,
     pub total_tokens_display: String,
-    pub created_tokens: Option<u64>,
-    pub created_tokens_display: String,
-    pub read_tokens: Option<u64>,
-    pub read_tokens_display: String,
+    pub cache_write_input_tokens: Option<u64>,
+    pub cache_write_input_tokens_display: String,
     pub last_used_at: Option<String>,
     pub last_used_at_display: String,
     pub last_used_at_full_display: Option<String>,
@@ -477,8 +475,8 @@ pub struct ModelUsageView {
     pub input_tokens_display: String,
     pub output_tokens: Option<u64>,
     pub output_tokens_display: String,
-    pub cached_tokens: Option<u64>,
-    pub cached_tokens_display: String,
+    pub cached_input_tokens: Option<u64>,
+    pub cached_input_tokens_display: String,
     pub image_input_tokens: Option<u64>,
     pub image_input_tokens_display: String,
     pub image_output_tokens: Option<u64>,

backend/crates/gateway-api/src/admin/observability/presenter.rs

@@ -58,9 +58,9 @@ pub(crate) fn request_metrics_view(metrics: &domain::RequestMetrics) -> RequestM
         caller_error_count: metrics.caller_error_count,
         input_tokens: metrics.input_tokens,
         output_tokens: metrics.output_tokens,
-        cached_tokens: metrics.cached_tokens,
-        cache_write_tokens: metrics.cache_write_tokens,
-        reasoning_tokens: metrics.reasoning_tokens,
+        cached_input_tokens: metrics.cached_input_tokens,
+        cache_write_input_tokens: metrics.cache_write_input_tokens,
+        reasoning_output_tokens: metrics.reasoning_output_tokens,
         total_tokens: metrics.total_tokens,
     }
 }
@@ -103,9 +103,9 @@ pub(crate) fn token_details(record: &domain::UsageRecord) -> TokenDetailsView {
     TokenDetailsView {
         input_tokens: record.input_tokens,
         output_tokens: record.output_tokens,
-        cached_tokens: record.cached_tokens,
-        cache_write_tokens: record.cache_write_tokens,
-        reasoning_tokens: record.reasoning_tokens,
+        cached_input_tokens: record.cached_input_tokens,
+        cache_write_input_tokens: record.cache_write_input_tokens,
+        reasoning_output_tokens: record.reasoning_output_tokens,
         image_input_tokens: record.image_input_tokens,
         image_output_tokens: record.image_output_tokens,
         total_tokens: record.total_tokens,
@@ -115,14 +115,14 @@ pub(crate) fn token_details(record: &domain::UsageRecord) -> TokenDetailsView {
         output_tokens_display: record
             .output_tokens
             .map_or_else(|| "-".to_owned(), format_number),
-        cached_tokens_display: record
-            .cached_tokens
+        cached_input_tokens_display: record
+            .cached_input_tokens
             .map_or_else(|| "-".to_owned(), format_compact_number),
-        cache_write_tokens_display: record
-            .cache_write_tokens
+        cache_write_input_tokens_display: record
+            .cache_write_input_tokens
             .map_or_else(|| "-".to_owned(), format_compact_number),
-        reasoning_tokens_display: record
-            .reasoning_tokens
+        reasoning_output_tokens_display: record
+            .reasoning_output_tokens
             .map_or_else(|| "-".to_owned(), format_number),
         image_input_tokens_display: record
             .image_input_tokens
@@ -140,9 +140,9 @@ pub(crate) fn usage_list_token_details(record: &domain::UsageListRecord) -> Toke
     TokenDetailsView {
         input_tokens: record.input_tokens,
         output_tokens: record.output_tokens,
-        cached_tokens: record.cached_tokens,
-        cache_write_tokens: record.cache_write_tokens,
-        reasoning_tokens: record.reasoning_tokens,
+        cached_input_tokens: record.cached_input_tokens,
+        cache_write_input_tokens: record.cache_write_input_tokens,
+        reasoning_output_tokens: record.reasoning_output_tokens,
         image_input_tokens: record.image_input_tokens,
         image_output_tokens: record.image_output_tokens,
         total_tokens: record.total_tokens,
@@ -152,14 +152,14 @@ pub(crate) fn usage_list_token_details(record: &domain::UsageListRecord) -> Toke
         output_tokens_display: record
             .output_tokens
             .map_or_else(|| "-".to_owned(), format_number),
-        cached_tokens_display: record
-            .cached_tokens
+        cached_input_tokens_display: record
+            .cached_input_tokens
             .map_or_else(|| "-".to_owned(), format_compact_number),
-        cache_write_tokens_display: record
-            .cache_write_tokens
+        cache_write_input_tokens_display: record
+            .cache_write_input_tokens
             .map_or_else(|| "-".to_owned(), format_compact_number),
-        reasoning_tokens_display: record
-            .reasoning_tokens
+        reasoning_output_tokens_display: record
+            .reasoning_output_tokens
             .map_or_else(|| "-".to_owned(), format_number),
         image_input_tokens_display: record
             .image_input_tokens
@@ -430,9 +430,9 @@ pub(crate) fn usage_record_view(
         latency_ms: record.latency_ms,
         input_tokens: record.input_tokens,
         output_tokens: record.output_tokens,
-        cached_tokens: record.cached_tokens,
-        cache_write_tokens: record.cache_write_tokens,
-        reasoning_tokens: record.reasoning_tokens,
+        cached_input_tokens: record.cached_input_tokens,
+        cache_write_input_tokens: record.cache_write_input_tokens,
+        reasoning_output_tokens: record.reasoning_output_tokens,
         image_input_tokens: record.image_input_tokens,
         image_output_tokens: record.image_output_tokens,
         message,
@@ -526,7 +526,7 @@ pub(crate) fn usage_attempt_view(attempt: domain::UsageAttempt) -> UsageAttemptV
         estimated_cost_currency: attempt.cost_currency,
         input_tokens: attempt.input_tokens,
         output_tokens: attempt.output_tokens,
-        cached_tokens: attempt.cached_tokens,
+        cached_input_tokens: attempt.cached_input_tokens,
         total_tokens: attempt.total_tokens,
         first_token_ms: None,
         latency_ms: attempt.latency_ms,
@@ -683,8 +683,8 @@ pub(crate) fn trend_point_view(
         input_tokens_value: point.metrics.input_tokens,
         output_tokens: format_compact_number(point.metrics.output_tokens),
         output_tokens_value: point.metrics.output_tokens,
-        cached_tokens: format_compact_number(point.metrics.cached_tokens),
-        cached_tokens_value: point.metrics.cached_tokens,
+        cached_input_tokens: format_compact_number(point.metrics.cached_input_tokens),
+        cached_input_tokens_value: point.metrics.cached_input_tokens,
         cache_hit_rate_value: point.cached_token_rate,
         tokens_value: point.metrics.total_tokens,
         errors: format_compact_number(point.service_failure_count),
@@ -749,7 +749,7 @@ pub(crate) fn trend_summary_view(
             },
             TrendSummaryView {
                 label: "缓存".to_owned(),
-                value: format_compact_number(summary.cached_tokens),
+                value: format_compact_number(summary.cached_input_tokens),
                 ratio: None,
             },
         ],
@@ -800,6 +800,7 @@ pub(crate) fn trend_view(
     time: crate::time::TimePresenter,
 ) -> TrendData {
     TrendData {
+        analytics: analytics_view(trend.analytics, time),
         kind,
         summary: trend_summary_view(kind, &trend.summary),
         points: trend
@@ -913,6 +914,7 @@ pub(crate) fn dashboard_view(
         rotation_strategy,
     } = result;
     let domain::DashboardObservation {
+        analytics,
         runtime_slots: _,
         range,
         totals,
@@ -982,6 +984,7 @@ pub(crate) fn dashboard_view(
         .saturating_sub(provider_accounts.normal);
 
     DashboardDataView {
+        analytics: analytics_view(analytics, time),
         as_of: range.end,
         as_of_display: time.datetime(&range.end),
         cards: DashboardCardsView {
@@ -1013,7 +1016,7 @@ pub(crate) fn dashboard_view(
                 today_hit_rate_value: today.observed_cached_token_rate,
                 yesterday_hit_rate_value: yesterday.observed_cached_token_rate,
                 total_hit_rate: display_rate(total_cached_token_rate),
-                total_cached_tokens: format_compact_number(totals.cached_tokens),
+                total_cached_input_tokens: format_compact_number(totals.cached_input_tokens),
                 average_first_token_latency_ms: display_duration(average_first_token_latency_ms),
             },
         },
@@ -1046,14 +1049,18 @@ pub(crate) fn dashboard_view(
     }
 }
 
-pub(crate) fn usage_summary_view(summary: domain::UsageSummary) -> UsageSummaryView {
+pub(crate) fn usage_summary_view(
+    summary: domain::UsageSummary,
+    time: crate::time::TimePresenter,
+) -> UsageSummaryView {
     let overview = summary.overview;
     UsageSummaryView {
+        analytics: analytics_view(overview.analytics, time),
         total_requests: format_compact_number(overview.requests.request_count),
         input_tokens: format_compact_number(overview.requests.input_tokens),
         output_tokens: format_compact_number(overview.requests.output_tokens),
-        cached_tokens: format_compact_number(overview.requests.cached_tokens),
-        cache_write_tokens: format_compact_number(overview.requests.cache_write_tokens),
+        cached_input_tokens: format_compact_number(overview.requests.cached_input_tokens),
+        cache_write_input_tokens: format_compact_number(overview.requests.cache_write_input_tokens),
         total_tokens: format_compact_number(overview.requests.total_tokens),
         average_latency_ms: display_duration(summary.average_latency_ms),
         logical_requests: request_metrics_view(&overview.requests),
@@ -1139,7 +1146,7 @@ pub(crate) fn usage_insights_view(
             label: time.label(point.bucket_start, "%m-%d %H:%M"),
             input_tokens: point.input_tokens,
             output_tokens: point.output_tokens,
-            cached_tokens: point.cached_tokens,
+            cached_input_tokens: point.cached_input_tokens,
             total_tokens: point.total_tokens,
             estimated_cost: point.estimated_cost.as_ref().map(ToString::to_string),
             standard_cost: point.standard_cost.as_ref().map(ToString::to_string),
@@ -1150,6 +1157,7 @@ pub(crate) fn usage_insights_view(
         })
         .collect();
     UsageInsightsOverviewView {
+        analytics: analytics_view(insights.analytics, time),
         granularity: granularity_name(insights.granularity).to_owned(),
         health: OverviewHealthView {
             total_requests: insights.health.total_requests,
@@ -1270,7 +1278,7 @@ pub(crate) fn usage_insights_view(
             cache_hit_request_rate: insights.cost.cache_hit_request_rate,
             input_tokens: insights.cost.input_tokens,
             output_tokens: insights.cost.output_tokens,
-            cached_tokens: insights.cost.cached_tokens,
+            cached_input_tokens: insights.cost.cached_input_tokens,
             total_tokens: insights.cost.total_tokens,
             points: cost_points,
             costs: cost_views(&insights.cost.costs),
@@ -1302,8 +1310,10 @@ pub(crate) fn granularity_name(granularity: domain::Granularity) -> &'static str
 pub(crate) fn diagnostics_view(
     result: domain::DiagnosticsResult,
     dimension: DiagnosticDimension,
+    time: crate::time::TimePresenter,
 ) -> DiagnosticsView {
     DiagnosticsView {
+        analytics: analytics_view(result.analytics, time),
         dimension: dimension.display_name().to_owned(),
         items: result
             .items
@@ -1356,3 +1366,22 @@ pub(crate) fn map_wire_error(error: WireValidationError) -> AdminError {
 pub(crate) fn map_service_error(error: gateway_admin::model::AdminError) -> AdminError {
     map_admin_service_error(error)
 }
+
+pub(crate) fn analytics_view(
+    metadata: domain::AnalyticsMetadata,
+    time: crate::time::TimePresenter,
+) -> AnalyticsView {
+    AnalyticsView {
+        coverage_start: metadata.coverage_start,
+        coverage_start_display: metadata.coverage_start.map(|value| time.datetime(&value)),
+        coverage_end: metadata.coverage_end,
+        coverage_end_display: metadata.coverage_end.map(|value| time.datetime(&value)),
+        generated_at: metadata.generated_at,
+        generated_at_display: time.datetime(&metadata.generated_at),
+        lag_seconds: metadata.lag_seconds,
+        state: metadata.state.as_str().to_owned(),
+        percentiles_approximate: metadata.percentiles_approximate,
+        schema_version: metadata.schema_version,
+        histogram_version: metadata.histogram_version,
+    }
+}

backend/crates/gateway-api/src/admin/observability/query.rs

@@ -29,6 +29,7 @@ impl DashboardQuery {
 #[derive(Clone, Default, Deserialize)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct UsageQuery {
+    pub routing_group_refs: Option<String>,
     pub current_page: Option<u32>,
     pub page_size: Option<u16>,
     pub kind: Option<String>,
@@ -76,6 +77,7 @@ impl DetailQuery {
 #[derive(Clone, Default, Deserialize)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct DiagnosticsQuery {
+    pub routing_group_refs: Option<String>,
     pub dimension: Option<String>,
     pub period: Option<String>,
     pub as_of: Option<i64>,
@@ -98,6 +100,7 @@ impl DiagnosticsQuery {
 #[derive(Clone, Default, Deserialize)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct OpsQuery {
+    pub routing_group_refs: Option<String>,
     pub current_page: Option<u32>,
     pub page_size: Option<u16>,
     pub kind: Option<String>,
@@ -298,6 +301,7 @@ pub(crate) fn usage_filter(query: &UsageQuery) -> Result<domain::UsageFilter, Wi
         })
     });
     Ok(domain::UsageFilter {
+        routing_group_refs: routing_group_refs(query.routing_group_refs.as_deref())?,
         client_api_key_ref: non_empty(query.client_api_key_id.clone()),
         request_id: non_empty(query.request_id.clone()),
         provider_account_ref: non_empty(query.account_id.clone()),
@@ -357,6 +361,7 @@ pub(crate) fn ops_command(
             timezone,
         )?,
         filter: domain::OpsErrorFilter {
+            routing_group_refs: routing_group_refs(query.routing_group_refs.as_deref())?,
             client_api_key_ref: non_empty(query.client_api_key_id.clone()),
             request_id: non_empty(query.request_id.clone()),
             provider_kind: non_empty(query.provider.clone()),
@@ -395,3 +400,25 @@ fn validate_pagination(
     }
     Ok((current_page, page_size))
 }
+
+/// 逗号分隔的稳定分组身份按集合归一化，不要求分组当前仍存在
+pub(crate) fn routing_group_refs(value: Option<&str>) -> Result<Vec<String>, WireValidationError> {
+    let Some(value) = value else {
+        return Ok(Vec::new());
+    };
+    let mut refs = Vec::new();
+    for item in value.split(',') {
+        let item = item.trim();
+        if item.is_empty()
+            || item.len() > 128
+            || item.chars().any(char::is_control)
+            || refs.len() >= 32
+        {
+            return Err(WireValidationError::new("routingGroupRefs"));
+        }
+        refs.push(item.to_owned());
+    }
+    refs.sort();
+    refs.dedup();
+    Ok(refs)
+}

backend/crates/gateway-api/src/admin/observability/routes.rs

@@ -160,7 +160,10 @@ where
         .map_err(map_service_error)?;
     Ok(AdminResponse::new(
         StatusCode::OK,
-        AdminEnvelope::ok(usage_summary_view(result)),
+        AdminEnvelope::ok(usage_summary_view(
+            result,
+            crate::time::TimePresenter::new(state.admin_services().timezone()),
+        )),
     ))
 }
 
@@ -212,6 +215,8 @@ where
     )
     .map_err(map_wire_error)?;
     let filter = domain::UsageFilter {
+        routing_group_refs: routing_group_refs(query.routing_group_refs.as_deref())
+            .map_err(map_wire_error)?,
         provider_kind: non_empty(query.provider),
         model: non_empty(query.model),
         status_code: parse_status(query.status_code).map_err(map_wire_error)?,
@@ -226,7 +231,11 @@ where
         .map_err(map_service_error)?;
     Ok(AdminResponse::new(
         StatusCode::OK,
-        AdminEnvelope::ok(diagnostics_view(result, dimension)),
+        AdminEnvelope::ok(diagnostics_view(
+            result,
+            dimension,
+            crate::time::TimePresenter::new(state.admin_services().timezone()),
+        )),
     ))
 }
 

backend/crates/gateway-api/src/admin/observability/wire.rs

@@ -18,17 +18,17 @@ pub struct PageData<T> {
 pub struct TokenDetailsView {
     pub input_tokens: Option<u64>,
     pub output_tokens: Option<u64>,
-    pub cached_tokens: Option<u64>,
-    pub cache_write_tokens: Option<u64>,
-    pub reasoning_tokens: Option<u64>,
+    pub cached_input_tokens: Option<u64>,
+    pub cache_write_input_tokens: Option<u64>,
+    pub reasoning_output_tokens: Option<u64>,
     pub image_input_tokens: Option<u64>,
     pub image_output_tokens: Option<u64>,
     pub total_tokens: Option<u64>,
     pub input_tokens_display: String,
     pub output_tokens_display: String,
-    pub cached_tokens_display: String,
-    pub cache_write_tokens_display: String,
-    pub reasoning_tokens_display: String,
+    pub cached_input_tokens_display: String,
+    pub cache_write_input_tokens_display: String,
+    pub reasoning_output_tokens_display: String,
     pub image_input_tokens_display: String,
     pub image_output_tokens_display: String,
     pub total_tokens_display: String,
@@ -162,9 +162,9 @@ pub struct UsageRecordView {
     pub latency_ms: Option<u64>,
     pub input_tokens: Option<u64>,
     pub output_tokens: Option<u64>,
-    pub cached_tokens: Option<u64>,
-    pub cache_write_tokens: Option<u64>,
-    pub reasoning_tokens: Option<u64>,
+    pub cached_input_tokens: Option<u64>,
+    pub cache_write_input_tokens: Option<u64>,
+    pub reasoning_output_tokens: Option<u64>,
     pub image_input_tokens: Option<u64>,
     pub image_output_tokens: Option<u64>,
     pub message: String,
@@ -258,7 +258,7 @@ pub struct UsageAttemptView {
     pub estimated_cost_currency: Option<String>,
     pub input_tokens: Option<u64>,
     pub output_tokens: Option<u64>,
-    pub cached_tokens: Option<u64>,
+    pub cached_input_tokens: Option<u64>,
     pub total_tokens: Option<u64>,
     pub first_token_ms: Option<u64>,
     pub latency_ms: Option<u64>,
@@ -288,6 +288,7 @@ pub struct UsageRecordDetailView {
 #[derive(Debug, Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct TrendData {
+    pub analytics: AnalyticsView,
     pub kind: TrendKind,
     pub points: Vec<TrendPointView>,
     pub summary: Vec<TrendSummaryView>,
@@ -306,8 +307,8 @@ pub struct TrendPointView {
     pub input_tokens_value: u64,
     pub output_tokens: String,
     pub output_tokens_value: u64,
-    pub cached_tokens: String,
-    pub cached_tokens_value: u64,
+    pub cached_input_tokens: String,
+    pub cached_input_tokens_value: u64,
     pub cache_hit_rate_value: f64,
     pub tokens_value: u64,
     pub errors: String,
@@ -388,7 +389,7 @@ pub struct DashboardCacheCardView {
     pub today_hit_rate_value: Option<f64>,
     pub yesterday_hit_rate_value: Option<f64>,
     pub total_hit_rate: String,
-    pub total_cached_tokens: String,
+    pub total_cached_input_tokens: String,
     pub average_first_token_latency_ms: String,
 }
 
@@ -446,9 +447,9 @@ pub struct RequestMetricsView {
     pub caller_error_count: u64,
     pub input_tokens: u64,
     pub output_tokens: u64,
-    pub cached_tokens: u64,
-    pub cache_write_tokens: u64,
-    pub reasoning_tokens: u64,
+    pub cached_input_tokens: u64,
+    pub cache_write_input_tokens: u64,
+    pub reasoning_output_tokens: u64,
     pub total_tokens: u64,
 }
 
@@ -575,6 +576,7 @@ impl From<domain::DesktopReleaseStatus> for DashboardDesktopReleaseStatusView {
 #[derive(Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct DashboardDataView {
+    pub analytics: AnalyticsView,
     pub as_of: DateTime<Utc>,
     pub as_of_display: String,
     pub cards: DashboardCardsView,
@@ -592,11 +594,12 @@ pub struct DashboardDataView {
 #[derive(Debug, Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct UsageSummaryView {
+    pub analytics: AnalyticsView,
     pub total_requests: String,
     pub input_tokens: String,
     pub output_tokens: String,
-    pub cached_tokens: String,
-    pub cache_write_tokens: String,
+    pub cached_input_tokens: String,
+    pub cache_write_input_tokens: String,
     pub total_tokens: String,
     pub average_latency_ms: String,
     pub logical_requests: RequestMetricsView,
@@ -693,7 +696,7 @@ pub struct OverviewCostPointView {
     pub label: String,
     pub input_tokens: u64,
     pub output_tokens: u64,
-    pub cached_tokens: u64,
+    pub cached_input_tokens: u64,
     pub total_tokens: u64,
     pub estimated_cost: Option<String>,
     pub standard_cost: Option<String>,
@@ -719,7 +722,7 @@ pub struct OverviewCostView {
     pub cache_hit_request_rate: Option<f64>,
     pub input_tokens: u64,
     pub output_tokens: u64,
-    pub cached_tokens: u64,
+    pub cached_input_tokens: u64,
     pub total_tokens: u64,
     pub points: Vec<OverviewCostPointView>,
     pub costs: Vec<CostView>,
@@ -741,6 +744,7 @@ pub struct ProviderOverviewView {
 #[derive(Debug, Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct UsageInsightsOverviewView {
+    pub analytics: AnalyticsView,
     pub granularity: String,
     pub health: OverviewHealthView,
     pub performance: OverviewPerformanceView,
@@ -778,6 +782,7 @@ pub struct DiagnosticItemView {
 #[derive(Debug, Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct DiagnosticsView {
+    pub analytics: AnalyticsView,
     pub dimension: String,
     pub items: Vec<DiagnosticItemView>,
 }
@@ -852,3 +857,20 @@ pub struct OpsErrorMetadataView {
     pub recovery_retry_delay_ms: Option<u64>,
     pub recovery_total_latency_ms: Option<u64>,
 }
+
+/// 统计覆盖、新鲜度与近似口径，时间文案使用部署时区
+#[derive(Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct AnalyticsView {
+    pub coverage_start: Option<DateTime<Utc>>,
+    pub coverage_start_display: Option<String>,
+    pub coverage_end: Option<DateTime<Utc>>,
+    pub coverage_end_display: Option<String>,
+    pub generated_at: DateTime<Utc>,
+    pub generated_at_display: String,
+    pub lag_seconds: u64,
+    pub state: String,
+    pub percentiles_approximate: bool,
+    pub schema_version: u32,
+    pub histogram_version: u32,
+}

backend/crates/gateway-api/src/admin/settings.rs

@@ -36,6 +36,7 @@ pub type ProviderRequestProfileUpdates =
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct RuntimeSettingsFields {
+    pub codex_privacy_policy: gateway_core::settings::privacy::CodexPrivacyPolicy,
     pub request_location_enabled: bool,
     pub request_location: gateway_core::account::RequestLocation,
     pub refresh_margin_seconds: u64,
@@ -283,6 +284,10 @@ where
             "/api/admin/settings/client-profiles/{provider}/preview",
             post(preview_client_profile::<S>),
         )
+        .route(
+            "/api/admin/settings/privacy/preview",
+            post(preview_privacy::<S>),
+        )
         .route("/api/admin/settings/update", post(update_settings::<S>))
         .route(
             "/api/admin/settings/client-downloads/codex-desktop/windows",
@@ -719,6 +724,7 @@ impl RuntimeSettingsFields {
         self,
     ) -> Result<gateway_admin::model::settings::RuntimeSettingsValues, WireValidationError> {
         let values = gateway_admin::model::settings::RuntimeSettingsValues {
+            codex_privacy_policy: self.codex_privacy_policy,
             request_location_enabled: self.request_location_enabled,
             request_location: self
                 .request_location
@@ -767,6 +773,7 @@ impl RuntimeSettingsFields {
 impl From<gateway_admin::model::settings::RuntimeSettingsValues> for RuntimeSettingsFields {
     fn from(settings: gateway_admin::model::settings::RuntimeSettingsValues) -> Self {
         crate::admin::settings::RuntimeSettingsFields {
+            codex_privacy_policy: settings.codex_privacy_policy,
             request_location_enabled: settings.request_location_enabled,
             request_location: settings.request_location,
             refresh_margin_seconds: settings.refresh_margin_seconds,
@@ -837,3 +844,23 @@ fn settings_validation_error(field: &'static str) -> WireValidationError {
         _ => "settings",
     })
 }
+
+async fn preview_privacy<S>(
+    State(state): State<S>,
+    _auth: AdminAuth,
+    AdminJson(request): AdminJson<gateway_core::settings::privacy::PrivacyPreviewRequest>,
+) -> Result<impl IntoResponse, AdminError>
+where
+    S: SessionState + Send + Sync,
+{
+    let result = state
+        .admin_services()
+        .settings()
+        .preview_privacy_policy(request)
+        .await
+        .map_err(map_service_error)?;
+    Ok(AdminResponse::new(
+        StatusCode::OK,
+        AdminEnvelope::ok(result),
+    ))
+}

backend/crates/gateway-api/src/admin/system.rs

@@ -114,7 +114,6 @@ struct SystemUpdateDetailView {
     notes: Option<String>,
     cached: bool,
     update_supported: bool,
-    restart_confirmation_supported: bool,
     unsupported_reason: Option<String>,
     warning: Option<String>,
 }
@@ -134,7 +133,6 @@ impl From<SystemUpdateDetail> for SystemUpdateDetailView {
             notes: detail.notes,
             cached: detail.cached,
             update_supported: detail.update_supported,
-            restart_confirmation_supported: true,
             unsupported_reason: detail.unsupported_reason,
             warning: detail.warning,
         }

backend/crates/gateway-api/src/health.rs

@@ -1,10 +1,12 @@
 //! `/healthz` 对 Core、Store 与 Host 关键 worker 健康事实的聚合
 
-use std::sync::Arc;
+use std::sync::{Arc, Mutex};
 use std::time::Duration;
 
 use axum::{extract::State, http::StatusCode};
 use futures::future::join_all;
+use gateway_core::diagnostics::{OperationalDiagnostics, OperationalFailure};
+use gateway_core::error::{ErrorDetails, ErrorSource};
 use gateway_core::health::{
     HealthProbe, HealthState, WorkerHealthKey, WorkerHealthSnapshot, WorkerHealthSource,
     WorkerRuntimeState,
@@ -19,6 +21,16 @@ const HEALTH_CHECK_TIMEOUT: Duration = Duration::from_secs(2);
 pub(crate) struct HealthStatus {
     probes: Arc<[Arc<dyn HealthProbe>]>,
     workers: Arc<dyn WorkerHealthSource>,
+    diagnostics: Arc<dyn OperationalDiagnostics>,
+    failures: Arc<Mutex<Vec<HealthFailure>>>,
+}
+
+#[derive(Clone, PartialEq, Eq, Debug, thiserror::Error)]
+#[error("{component} is {state}: {reason}")]
+struct HealthFailure {
+    component: String,
+    state: &'static str,
+    reason: String,
 }
 
 impl HealthStatus {
@@ -26,31 +38,93 @@ impl HealthStatus {
     pub(crate) fn new(
         probes: Vec<Arc<dyn HealthProbe>>,
         workers: Arc<dyn WorkerHealthSource>,
+        diagnostics: Arc<dyn OperationalDiagnostics>,
     ) -> Self {
         Self {
             probes: probes.into(),
             workers,
+            diagnostics,
+            failures: Arc::default(),
         }
     }
 
     pub(crate) async fn healthy(&self) -> bool {
-        if !self
+        let mut failures: Vec<_> = self
             .workers
             .snapshot()
-            .iter()
-            .filter(|worker| worker_affects_healthz(worker))
-            .all(worker_is_healthy)
-        {
-            return false;
-        }
-        let checks = self.probes.iter().map(|probe| probe.check());
-        tokio::time::timeout(HEALTH_CHECK_TIMEOUT, join_all(checks))
-            .await
-            .is_ok_and(|states| {
-                states
-                    .into_iter()
-                    .all(|state| matches!(state, HealthState::Healthy))
+            .into_iter()
+            .filter(|worker| worker_affects_healthz(worker) && !worker_is_healthy(worker))
+            .map(|worker| HealthFailure {
+                component: match worker.key {
+                    WorkerHealthKey::Task(id) => format!("worker:{id}"),
+                    WorkerHealthKey::Disabled(kind) => format!("worker:{kind:?}"),
+                },
+                state: "unhealthy",
+                reason: format!(
+                    "state={:?}; last_error={}",
+                    worker.state,
+                    worker.last_error.as_deref().unwrap_or("none")
+                ),
             })
+            .collect();
+        // 逐个探针共享截止时间，保留已完成结果并指出具体超时组件
+        let deadline = tokio::time::Instant::now() + HEALTH_CHECK_TIMEOUT;
+        let checks = self.probes.iter().map(|probe| async move {
+            let (state, reason) = match tokio::time::timeout_at(deadline, probe.check()).await {
+                Ok(HealthState::Healthy) => return None,
+                Ok(HealthState::Degraded(reason)) => ("degraded", reason),
+                Ok(HealthState::Unhealthy(reason)) => ("unhealthy", reason),
+                Err(_) => ("timed_out", "health probe exceeded 2s deadline".to_owned()),
+            };
+            Some(HealthFailure {
+                component: format!("probe:{}", probe.name()),
+                state,
+                reason,
+            })
+        });
+        failures.extend(join_all(checks).await.into_iter().flatten());
+        let healthy = failures.is_empty();
+        let changed = {
+            let mut previous = self
+                .failures
+                .lock()
+                .unwrap_or_else(std::sync::PoisonError::into_inner);
+            let changed = failures
+                .iter()
+                .filter(|failure| !previous.contains(failure))
+                .cloned()
+                .collect::<Vec<_>>();
+            for recovered in previous
+                .iter()
+                .filter(|old| !failures.iter().any(|new| new.component == old.component))
+            {
+                tracing::info!(component = %recovered.component, "health component recovered");
+            }
+            *previous = failures;
+            changed
+        };
+        // 只记录故障变化；使用既有有界观测队列，文件日志失效时仍有独立的运维证据
+        for failure in changed {
+            tracing::warn!(component = %failure.component, state = failure.state, "health check failed");
+            let mut event = OperationalFailure::new(
+                "health",
+                "check",
+                "health_check_failed",
+                "Health check failed",
+            );
+            event.correlation_id = Some(failure.component.clone());
+            event.details =
+                ErrorDetails::capture(Some(&ErrorSource::new(failure.clone())), None, false);
+            if self.diagnostics.record_failure(event).await.is_err() {
+                tracing::warn!("health diagnostic could not be recorded");
+                // 入队失败不能抑制下次探测的记录机会，也不改变本次健康判定
+                self.failures
+                    .lock()
+                    .unwrap_or_else(std::sync::PoisonError::into_inner)
+                    .retain(|previous| previous != &failure);
+            }
+        }
+        healthy
     }
 }
 

backend/crates/gateway-api/src/key_usage/presenter.rs

@@ -49,6 +49,7 @@ pub(super) fn config(secret: ClientKeySecret) -> ConfigView {
 #[derive(Serialize)]
 #[serde(rename_all = "camelCase")]
 pub(super) struct OverviewView {
+    analytics: crate::admin::observability::AnalyticsView,
     as_of: DateTime<Utc>,
     as_of_display: String,
     start_time: DateTime<Utc>,
@@ -82,9 +83,9 @@ struct MetricsView {
     requests: u64,
     input_tokens: u64,
     output_tokens: u64,
-    cached_tokens: u64,
-    cache_write_tokens: u64,
-    reasoning_tokens: u64,
+    cached_input_tokens: u64,
+    cache_write_input_tokens: u64,
+    reasoning_output_tokens: u64,
     total_tokens: u64,
     cost_usd: Option<String>,
     cost_incomplete: bool,
@@ -95,9 +96,9 @@ fn metrics(value: &RequestMetrics, costs: &[CurrencyCost], coverage: &CostCovera
         requests: value.request_count,
         input_tokens: value.input_tokens,
         output_tokens: value.output_tokens,
-        cached_tokens: value.cached_tokens,
-        cache_write_tokens: value.cache_write_tokens,
-        reasoning_tokens: value.reasoning_tokens,
+        cached_input_tokens: value.cached_input_tokens,
+        cache_write_input_tokens: value.cache_write_input_tokens,
+        reasoning_output_tokens: value.reasoning_output_tokens,
         total_tokens: value.total_tokens,
         cost_usd: costs
             .iter()
@@ -121,6 +122,10 @@ struct TrendPointView {
 pub(super) fn overview(value: KeyUsageOverview, time: crate::time::TimePresenter) -> OverviewView {
     let key = value.key;
     OverviewView {
+        analytics: crate::admin::observability::analytics_view(
+            value.overview.analytics.clone(),
+            time,
+        ),
         as_of: value.overview.range.end,
         as_of_display: time.time(&value.overview.range.end),
         start_time: value.overview.range.start,

backend/crates/gateway-api/src/lib.rs

@@ -190,7 +190,7 @@ pub fn initialize(
     let state = ApiState {
         admin,
         openai: OpenAiService::new(execution, lifecycle),
-        health: HealthStatus::new(probes, worker_health),
+        health: HealthStatus::new(probes, worker_health, diagnostics.clone()),
     };
     let index = config.asset_directory.join("index.html");
     let mut router = Router::new()

backend/crates/gateway-api/src/openai/endpoint.rs

@@ -62,7 +62,7 @@ where
                 let started = match service
                     .start_prepared_provider_endpoint(
                         prepared, operation,
-                        // 图像/搜索等原生端点没有对应的上游模型权限。
+                        // 原生端点的模型语义由 Provider 从正文提取并检查账号政策
                         None, client_ip, user_agent, endpoint,
                     )
                     .await

backend/crates/gateway-api/src/openai/models.rs

@@ -86,7 +86,9 @@ async fn models_response(
             .iter()
             .enumerate()
             .map(|(index, entry)| match entry {
-                PublicModelDescriptor::Adapted(profile) => Ok(codex_model_json(profile, index)),
+                PublicModelDescriptor::Adapted(profile) => {
+                    Ok(adapted_codex_model_json(profile, index))
+                }
                 PublicModelDescriptor::Native { model, payload } => {
                     if payload.protocol() != "codex" {
                         return Err(());
@@ -192,7 +194,7 @@ fn openai_model_json(id: &str) -> Value {
     })
 }
 
-fn codex_model_json(profile: &PublicModelProfile, index: usize) -> Value {
+fn adapted_codex_model_json(profile: &PublicModelProfile, index: usize) -> Value {
     let id = profile.model().as_str();
     let presentation = profile.presentation();
     let reasoning_levels = presentation
@@ -265,6 +267,8 @@ fn codex_model_json(profile: &PublicModelProfile, index: usize) -> Value {
         "experimental_supported_tools": [],
         "input_modalities": input_modalities,
         "supports_search_tool": presentation.search_tool(),
+        // 通用画像没有 Responses Lite 支持依据，避免客户端启用未经声明的协议行为
+        // 原生目录由 Native 分支保留上游字段，不经过此处
         "use_responses_lite": false,
     })
 }

backend/crates/gateway-api/src/openai/responses/request.rs

@@ -95,15 +95,25 @@ impl OpenAiRequestHeaders {
         }
     }
 
-    /// 独立端点只消费会话身份与 turn metadata，不携带 Responses 的连接状态
+    /// 独立端点保留业务扩展头与会话身份，不携带 Responses 的连接状态
     pub(crate) fn session_context(&self) -> Map<String, Value> {
         let mut context = Map::new();
         insert_protocol_context(&mut context, "session_id", self.session_id.as_ref());
         insert_protocol_context(&mut context, "thread_id", self.thread_id.as_ref());
         insert_protocol_context(&mut context, "turn_metadata", self.turn_metadata.as_ref());
+        self.insert_passthrough_headers(&mut context);
         context
     }
 
+    fn insert_passthrough_headers(&self, context: &mut Map<String, Value>) {
+        if !self.passthrough_headers.is_empty() {
+            context.insert(
+                PASSTHROUGH_HEADERS_CONTEXT_KEY.to_owned(),
+                Value::Array(self.passthrough_headers.clone()),
+            );
+        }
+    }
+
     fn protocol_context(
         &self,
         use_websocket: Option<bool>,
@@ -153,12 +163,7 @@ impl OpenAiRequestHeaders {
         insert_protocol_context(&mut context, "turn_id", self.turn_id.as_ref());
         insert_protocol_context(&mut context, "responses_lite", self.responses_lite.as_ref());
         insert_protocol_context(&mut context, "memgen_request", self.memgen_request.as_ref());
-        if !self.passthrough_headers.is_empty() {
-            context.insert(
-                PASSTHROUGH_HEADERS_CONTEXT_KEY.to_owned(),
-                Value::Array(self.passthrough_headers.clone()),
-            );
-        }
+        self.insert_passthrough_headers(&mut context);
         if let Some(use_websocket) = use_websocket {
             context.insert("use_websocket".to_owned(), Value::Bool(use_websocket));
         }

backend/crates/gateway-api/src/openai/responses/response.rs

@@ -47,7 +47,7 @@ impl OpenAiResponsesEncoder {
             return Vec::new();
         };
         self.observe_wire(wire);
-        let projected = client_failure_payload(wire);
+        let projected = client_payload(wire);
         let data = projected.as_ref().unwrap_or_else(|| wire.data());
         // 当前 Codex 不消费 Responses `error` event，会在 EOF 时丢失失败原因
         // 在客户端 SSE 边界统一投影成它能识别的 `response.failed`
@@ -70,22 +70,29 @@ impl OpenAiResponsesEncoder {
         {
             return vec![raw_sse_frame.clone()];
         }
+        let data = if projected.is_none() {
+            wire.raw_websocket_message()
+                .map(str::to_owned)
+                .unwrap_or_else(|| data.to_string())
+        } else {
+            data.to_string()
+        };
         vec![Bytes::from(encode_sse_event_with_metadata(
             effective_event_type(wire).unwrap_or_default(),
-            &data.to_string(),
+            &data,
             wire.sse_id(),
             wire.sse_retry(),
         ))]
     }
 
-    /// 消费一个 Provider event，并返回 WebSocket JSON messages
+    /// 消费一个 Provider event，并返回完整 WebSocket 文本消息
     pub fn push_websocket(&mut self, event: &ProviderEvent) -> Vec<String> {
         self.observe_canonical_identity(event);
-        let Some(wire) = openai_wire(event).filter(|wire| wire.has_json_data()) else {
+        let Some(wire) = openai_wire(event) else {
             return Vec::new();
         };
         self.observe_wire(wire);
-        let projected = client_failure_payload(wire);
+        let projected = client_payload(wire);
         let data = projected.as_ref().unwrap_or_else(|| wire.data());
         // WS 客户端只对它无法消费的裸 `error` 帧做投影：codex 的 WS 端点
         // 会静默忽略缺少 status 且不含内置可重试错误码的 `error` 帧，客户
@@ -104,6 +111,14 @@ impl OpenAiResponsesEncoder {
         {
             return vec![data.to_string()];
         }
+        if projected.is_none()
+            && let Some(raw) = wire.raw_websocket_message()
+        {
+            return vec![raw.to_owned()];
+        }
+        if !wire.has_json_data() {
+            return Vec::new();
+        }
         vec![data.to_string()]
     }
 
@@ -248,15 +263,43 @@ fn effective_event_type(wire: &ProtocolWireEvent) -> Option<&str> {
         .or_else(|| wire.data().get("type").and_then(Value::as_str))
 }
 
-fn client_failure_payload(wire: &ProtocolWireEvent) -> Option<Value> {
+fn client_payload(wire: &ProtocolWireEvent) -> Option<Value> {
     if matches!(
         effective_event_type(wire),
         Some("error" | "response.failed")
     ) {
-        capacity_error_for_client(wire.data())
-    } else {
-        None
+        return capacity_error_for_client(wire.data());
     }
+    if !matches!(
+        effective_event_type(wire),
+        Some("response.metadata" | "codex.response.metadata")
+    ) {
+        return None;
+    }
+    let headers = wire.data().get("headers")?.as_object()?;
+    let connection_options: Vec<String> = headers
+        .iter()
+        .filter(|(name, _)| name.eq_ignore_ascii_case("connection"))
+        .flat_map(|(_, value)| match value {
+            Value::Array(values) => values.iter().filter_map(Value::as_str).collect::<Vec<_>>(),
+            _ => value.as_str().into_iter().collect(),
+        })
+        .flat_map(|value| value.split(','))
+        .map(|name| name.trim().to_ascii_lowercase())
+        .collect();
+    if headers
+        .keys()
+        .all(|name| super::response_header_is_forwardable(name, &connection_options))
+    {
+        return None;
+    }
+    // 只剥离既有响应头隔离策略禁止的字段，metadata 业务扩展保持不透明
+    let mut projected = wire.data().clone();
+    projected
+        .get_mut("headers")?
+        .as_object_mut()?
+        .retain(|name, _| super::response_header_is_forwardable(name, &connection_options));
+    Some(projected)
 }
 
 /// 判断 WS 上游的 `error` 帧是否已经是客户端可直接消费的形状

backend/crates/gateway-api/src/openai/responses/validation.rs

@@ -209,6 +209,11 @@ impl ResponsesDeliveryValidator {
         transformed: bool,
         facts: &ResponseValidationFacts,
     ) -> Result<(), ResponseValidationError> {
+        // 未改写的未知载荷不参与本地关联判断，不能因旁路解析失败截断原流
+        // 插件实际改写的载荷仍须满足交付合同
+        if parsed.is_err() && !transformed {
+            return Ok(());
+        }
         if !self.active && !transformed {
             if parsed.and_then(|frame| self.state.apply(frame)).is_err() {
                 self.invalid_prefix = true;
@@ -253,7 +258,7 @@ impl ResponsesDeliveryValidator {
                     return Err(ResponseValidationError);
                 }
             }
-            ParsedFrame::Event { .. } | ParsedFrame::Done => {}
+            ParsedFrame::Event { .. } | ParsedFrame::Done | ParsedFrame::NonEvent => {}
         }
         self.state.apply(parsed)
     }
@@ -292,6 +297,7 @@ impl ResponsesDeliveryValidator {
 enum ParsedFrame {
     Event { event_type: String, value: Value },
     Done,
+    NonEvent,
 }
 
 impl ParsedFrame {
@@ -301,6 +307,10 @@ impl ParsedFrame {
             return Ok(Self::Done);
         }
         let mut events = parse_sse_events(frame).map_err(|_| ResponseValidationError)?;
+        // 注释和仅含 SSE 元数据的帧不承载响应业务事实
+        if events.is_empty() {
+            return Ok(Self::NonEvent);
+        }
         if events.len() != 1 {
             return Err(ResponseValidationError);
         }
@@ -363,6 +373,9 @@ struct DeliveryState {
 
 impl DeliveryState {
     fn apply(&mut self, frame: ParsedFrame) -> Result<(), ResponseValidationError> {
+        if matches!(frame, ParsedFrame::NonEvent) {
+            return Ok(());
+        }
         if self.done {
             return Err(ResponseValidationError);
         }

backend/crates/gateway-api/src/openai/responses/websocket/forward.rs

@@ -12,7 +12,7 @@ use gateway_core::engine::middleware::{
     MiddlewareBody, MiddlewareError, MiddlewareFrame, MiddlewareFraming, MiddlewareHeader,
     MiddlewareResponse,
 };
-use gateway_core::engine::response_control::ResponseControl;
+use gateway_core::engine::response_control::{ResponseControl, ResponseControlUnavailable};
 use gateway_core::error::{GatewayError, GatewayErrorKind};
 use gateway_core::event::ProviderResponseHeader;
 use gateway_core::operation::ProviderSessionState;
@@ -25,7 +25,7 @@ use super::{
     super::{DecodedResponsesRequest, OpenAiResponsesEncoder, ProtocolErrorBody},
     connection::{ConnectionEvent, FramePhase, ResponsesWebSocketConnection, WriteContext},
     protocol::{
-        decode_response_interrupt, error_event, initial_engine_error_event, response_metadata_event,
+        error_event, initial_engine_error_event, is_response_create, response_metadata_event,
     },
 };
 
@@ -137,7 +137,7 @@ pub(super) async fn forward_response(
     replay: &mut ConnectionReplaySnapshot,
     capture: ReplayCaptureHandle,
     validation: ResponseValidationFacts,
-    response_control: ResponseControl,
+    response_control: &ResponseControl,
 ) -> ForwardOutcome {
     let (protocol, status, headers, mut body, _) = response.into_parts();
     if protocol != "openai" || StatusCode::from_u16(status).is_err() {
@@ -150,8 +150,16 @@ pub(super) async fn forward_response(
             ProviderResponseHeader::new(name, value)
         })
         .collect::<Vec<_>>();
-    let first = match next_body_input(connection, body.as_mut(), &response_control, &request_id)
-        .await
+    let mut interrupt = super::interrupt::ResponseInterrupt::default();
+    let first = match next_body_input(
+        connection,
+        body.as_mut(),
+        response_control,
+        &mut interrupt,
+        &request_id,
+        false,
+    )
+    .await
     {
         BodyInput::Frame(Ok(Some(frame))) => frame,
         BodyInput::Frame(Ok(None)) => {
@@ -197,8 +205,15 @@ pub(super) async fn forward_response(
         let frame = match current.take() {
             Some(frame) => frame,
             None => {
-                match next_body_input(connection, body.as_mut(), &response_control, &request_id)
-                    .await
+                match next_body_input(
+                    connection,
+                    body.as_mut(),
+                    response_control,
+                    &mut interrupt,
+                    &request_id,
+                    terminal_seen,
+                )
+                .await
                 {
                     BodyInput::Frame(Ok(Some(frame))) => frame,
                     BodyInput::Frame(Ok(None)) if terminal_seen && body.is_finalized() => {
@@ -262,11 +277,24 @@ pub(super) async fn forward_response(
             (true, true) => FramePhase::Terminal,
             (true, false) => FramePhase::Data,
         };
+        let created_id = super::interrupt::ResponseInterrupt::created_id(&message);
         match connection
             .send_text(message, WriteContext::request(&request_id, phase))
             .await
         {
-            Ok(super::connection::WriteOutcome::Written) => first_frame_written = true,
+            Ok(super::connection::WriteOutcome::Written) => {
+                first_frame_written = true;
+                if let Some(id) = created_id {
+                    interrupt.observe_created(id, response_control);
+                    tokio::select! {
+                        _ = connection.wait_for_exit() => {
+                            detach_body(body);
+                            return ForwardOutcome::Disconnect;
+                        }
+                        () = interrupt.forward_pending(response_control) => {}
+                    }
+                }
+            }
             Ok(super::connection::WriteOutcome::Suppressed) => {}
             Err(_) => {
                 detach_body(body);
@@ -284,8 +312,10 @@ fn detach_body(body: Box<dyn MiddlewareBody>) {
 }
 
 fn validate_frame(frame: &MiddlewareFrame) -> Result<(), MiddlewareError> {
-    if frame.framing() != MiddlewareFraming::JsonDocument
-        || serde_json::from_slice::<serde::de::IgnoredAny>(frame.bytes()).is_err()
+    if !matches!(
+        frame.framing(),
+        MiddlewareFraming::JsonDocument | MiddlewareFraming::RawBytes
+    ) || std::str::from_utf8(frame.bytes()).is_err()
     {
         return Err(MiddlewareError::InvalidState);
     }
@@ -301,7 +331,9 @@ async fn next_body_input(
     connection: &mut ResponsesWebSocketConnection,
     body: &mut dyn MiddlewareBody,
     response_control: &ResponseControl,
+    interrupt: &mut super::interrupt::ResponseInterrupt,
     request_id: &Arc<str>,
+    terminal_seen: bool,
 ) -> BodyInput {
     // 处理控制帧时继续持有同一个读取 future，不能取消正在加工正文的中间件
     let frame = body.next_frame();
@@ -312,19 +344,18 @@ async fn next_body_input(
                 let Some(event) = event else { return BodyInput::Disconnect; };
                 match &event.event {
                     ConnectionEvent::Text(payload) => {
-                        let error = match decode_response_interrupt(payload) {
-                            Ok(Some(response_id)) => response_control.interrupt(&response_id).err().map(|_| {
-                                super::super::RequestDecodeError::InvalidValue { field: "response_id".to_owned() }.protocol_body()
-                            }),
-                            Ok(None) => {
-                                connection.defer(event);
-                                continue;
+                        if is_response_create(payload) {
+                            connection.defer(event);
+                            continue;
+                        }
+                        if !terminal_seen && interrupt.retain(payload) {
+                            tokio::select! {
+                                _ = connection.wait_for_exit() => return BodyInput::Disconnect,
+                                () = interrupt.forward_pending(response_control) => {}
                             }
-                            Err(error) => Some(error.protocol_body()),
-                        };
-                        if let Some(error) = error
-                            && send_protocol_error(connection, StatusCode::BAD_REQUEST, error, request_id).await == ForwardOutcome::Disconnect
-                        {
+                            continue;
+                        }
+                        if send_control(connection, response_control, payload, request_id).await == ForwardOutcome::Disconnect {
                             return BodyInput::Disconnect;
                         }
                     }
@@ -337,6 +368,11 @@ async fn next_body_input(
                     ConnectionEvent::Exited(_) => return BodyInput::Disconnect,
                 }
             }
+            event = response_control.receive(), if terminal_seen => {
+                if forward_control_event(connection, response_control, event).await == ForwardOutcome::Disconnect {
+                    return BodyInput::Disconnect;
+                }
+            }
             frame = &mut frame => return BodyInput::Frame(frame),
         }
     }
@@ -537,19 +573,26 @@ impl WebSocketExecutionBody {
                     self.transformed_pending = transformed;
                     continue;
                 }
-                messages.extend(encoded.into_iter().map(|message| (message, transformed)));
+                let framing = if event.wire_event().is_some_and(|wire| {
+                    wire.raw_websocket_message().is_some() && !wire.has_json_data()
+                }) {
+                    MiddlewareFraming::RawBytes
+                } else {
+                    MiddlewareFraming::JsonDocument
+                };
+                messages.extend(
+                    encoded
+                        .into_iter()
+                        .map(|message| (message, transformed, framing)),
+                );
                 self.transformed_pending = false;
             }
             let terminal = self.encoder.is_completed() || self.encoder.has_wire_failure();
             let last = messages.len().saturating_sub(1);
             self.pending.extend(messages.into_iter().enumerate().map(
-                |(index, (message, transformed))| {
-                    MiddlewareFrame::new(
-                        Bytes::from(message),
-                        MiddlewareFraming::JsonDocument,
-                        terminal && index == last,
-                    )
-                    .with_transformed(transformed)
+                |(index, (message, transformed, framing))| {
+                    MiddlewareFrame::new(Bytes::from(message), framing, terminal && index == last)
+                        .with_transformed(transformed)
                 },
             ));
             self.awaiting_terminal_eof = terminal;
@@ -720,3 +763,46 @@ async fn send_metadata(
         .await
         .is_ok()
 }
+
+pub(super) async fn send_control(
+    connection: &mut ResponsesWebSocketConnection,
+    control: &ResponseControl,
+    payload: &str,
+    request_id: &Arc<str>,
+) -> ForwardOutcome {
+    let result = tokio::select! {
+        _ = connection.wait_for_exit() => return ForwardOutcome::Disconnect,
+        result = control.send(payload) => result,
+    };
+    if result.is_err() {
+        return send_gateway_error(
+            connection,
+            &GatewayError::new(
+                GatewayErrorKind::InvalidRequest,
+                "No upstream WebSocket connection is available for control messages",
+            ),
+            request_id,
+        )
+        .await;
+    }
+    ForwardOutcome::Continue
+}
+
+pub(super) async fn forward_control_event(
+    connection: &mut ResponsesWebSocketConnection,
+    control: &ResponseControl,
+    event: Result<String, ResponseControlUnavailable>,
+) -> ForwardOutcome {
+    let Ok(payload) = event else {
+        control.clear();
+        return ForwardOutcome::Continue;
+    };
+    if connection
+        .send_text(payload, WriteContext::connection(FramePhase::Data))
+        .await
+        .is_err()
+    {
+        return ForwardOutcome::Disconnect;
+    }
+    ForwardOutcome::Continue
+}

backend/crates/gateway-api/src/openai/responses/websocket/interrupt.rs

@@ -0,0 +1,91 @@
+//! 当前逻辑响应的中断意图，跨重试连接保留并随新响应 ID 转发
+
+use std::{borrow::Cow, collections::BTreeSet};
+
+use gateway_core::engine::response_control::{ResponseControl, ResponseControlBinding};
+use serde::Deserialize;
+use serde_json::Value;
+
+#[derive(Deserialize)]
+struct EventIdentity<'a> {
+    #[serde(rename = "type", borrow)]
+    event_type: Cow<'a, str>,
+    #[serde(borrow)]
+    response: Option<ResponseIdentity<'a>>,
+}
+
+#[derive(Deserialize)]
+struct ResponseIdentity<'a> {
+    #[serde(borrow)]
+    id: Cow<'a, str>,
+}
+
+#[derive(Default)]
+pub(super) struct ResponseInterrupt {
+    delivered_ids: BTreeSet<String>,
+    current: Option<(String, ResponseControlBinding)>,
+    pending: Option<Value>,
+    sent: bool,
+}
+
+impl ResponseInterrupt {
+    pub(super) fn created_id(payload: &str) -> Option<String> {
+        let event: EventIdentity<'_> = serde_json::from_str(payload).ok()?;
+        (event.event_type == "response.created").then_some(())?;
+        Some(event.response?.id.into_owned())
+    }
+
+    /// 只在 created 实际写入下游后更新，不能把未交付的 ID 当成客户端目标
+    pub(super) fn observe_created(&mut self, id: String, control: &ResponseControl) {
+        let Some(binding) = control.binding() else {
+            return;
+        };
+        if self
+            .current
+            .as_ref()
+            .is_none_or(|(previous, old)| previous != &id || !old.same_binding(&binding))
+        {
+            self.sent = false;
+        }
+        self.delivered_ids.insert(id.clone());
+        self.current = Some((id, binding));
+    }
+
+    /// 未知控制消息、模式和其他逻辑响应的 ID 仍走原始透明通道
+    pub(super) fn retain(&mut self, payload: &str) -> bool {
+        let Ok(event) = serde_json::from_str::<Value>(payload) else {
+            return false;
+        };
+        if event["type"] != "response.interrupt"
+            || event["mode"] != "discard_partial_items"
+            || !event["response_id"]
+                .as_str()
+                .is_some_and(|id| self.delivered_ids.contains(id))
+        {
+            return false;
+        }
+        self.pending = Some(event);
+        self.sent = false;
+        true
+    }
+
+    pub(super) async fn forward_pending(&mut self, control: &ResponseControl) {
+        if self.sent {
+            return;
+        }
+        let (Some(payload), Some((id, binding))) = (&mut self.pending, &self.current) else {
+            return;
+        };
+        // 换号已绑定、created 尚未交付时等待新 ID；连接快照保证 await 期间也不会串号
+        if !control
+            .binding()
+            .is_some_and(|current| binding.same_binding(&current))
+        {
+            return;
+        }
+        payload["response_id"] = Value::String(id.clone());
+        if binding.send(&payload.to_string()).await.is_ok() {
+            self.sent = true;
+        }
+    }
+}

backend/crates/gateway-api/src/openai/responses/websocket/mod.rs

@@ -2,6 +2,7 @@
 
 pub mod connection;
 mod forward;
+mod interrupt;
 mod protocol;
 
 use std::{
@@ -24,6 +25,7 @@ use gateway_core::{
     engine::{
         execution::{AuthenticatedClient, ClientTransport},
         middleware::{FrozenMiddlewarePlan, MiddlewareError},
+        response_control::ResponseControl,
     },
     lifecycle::{ConnectionGuard, ConnectionLifecycle},
     operation::OperationKind,
@@ -46,11 +48,12 @@ use super::{
 };
 use connection::{ConnectionEvent, FramePhase, ResponsesWebSocketConnection, WriteContext};
 use forward::{
-    ConnectionReplaySnapshot, ForwardOutcome, execution_response, forward_response,
-    new_replay_capture, send_gateway_error, send_middleware_error, send_protocol_error,
+    ConnectionReplaySnapshot, ForwardOutcome, execution_response, forward_control_event,
+    forward_response, new_replay_capture, send_control, send_gateway_error, send_middleware_error,
+    send_protocol_error,
 };
-use protocol::connection_limit_event;
 pub use protocol::{ResponseCreateFrameError, decode_response_create_with_context};
+use protocol::{connection_limit_event, is_response_create};
 
 const TEXT_FRAMES_ONLY: &str = "Responses WebSocket accepts text frames only";
 const CONNECTION_LIMIT_CLOSE_REASON: &str = "Responses websocket connection limit reached";
@@ -191,10 +194,20 @@ async fn serve_responses_websocket(socket: WebSocket, session: ResponsesWebSocke
     );
     let mut request_count = 0_u64;
     let mut replay = ConnectionReplaySnapshot::default();
+    let mut response_control = ResponseControl::default();
 
     loop {
-        let Some(event) = connection.next_event().await else {
-            break;
+        let event = tokio::select! {
+            event = connection.next_event() => {
+                let Some(event) = event else { break };
+                event
+            }
+            event = response_control.receive() => {
+                if forward_control_event(&mut connection, &response_control, event).await == ForwardOutcome::Disconnect {
+                    break;
+                }
+                continue;
+            }
         };
         let payload = match event {
             ConnectionEvent::Text(payload) => payload,
@@ -212,8 +225,22 @@ async fn serve_responses_websocket(socket: WebSocket, session: ResponsesWebSocke
             expire_connection(&mut connection).await;
             break;
         }
-        request_count = request_count.saturating_add(1);
         let correlation_id = Arc::<str>::from(service.next_request_id());
+        if !is_response_create(&payload) {
+            if send_control(
+                &mut connection,
+                &response_control,
+                &payload,
+                &correlation_id,
+            )
+            .await
+                == ForwardOutcome::Disconnect
+            {
+                break;
+            }
+            continue;
+        }
+        request_count = request_count.saturating_add(1);
         // 初步解码只保留路由事实，避免整份正文跨越准入等待和响应交付
         let model_hint = match decode_response_create_with_context(&payload, &request_headers) {
             Ok(decoded) => Some(decoded.metadata().requested_model().to_owned()),
@@ -251,6 +278,7 @@ async fn serve_responses_websocket(socket: WebSocket, session: ResponsesWebSocke
             expire_connection(&mut connection).await;
             break;
         }
+        response_control.clear();
         let execution = service.execution();
         let preparation = async {
             // 握手的显式改写可继承，Key 策略与宿主设置仍在每轮执行前刷新
@@ -291,7 +319,7 @@ async fn serve_responses_websocket(socket: WebSocket, session: ResponsesWebSocke
             }
         };
         let request_id = Arc::<str>::from(prepared.request_id().to_string());
-        let response_control = prepared.response_control();
+        response_control = prepared.response_control();
         let capture = new_replay_capture();
         let validation = ResponseValidationFacts::default();
         let input = RequestInput {
@@ -381,7 +409,7 @@ async fn serve_responses_websocket(socket: WebSocket, session: ResponsesWebSocke
             &mut replay,
             capture,
             validation,
-            response_control,
+            &response_control,
         )
         .await
             == ForwardOutcome::Disconnect

backend/crates/gateway-api/src/openai/responses/websocket/protocol.rs

@@ -31,42 +31,22 @@ pub fn decode_response_create_with_context(
     decode_response_create_inner(payload, request_headers)
 }
 
-/// 中断只引用活动响应；普通创建帧仍交给原有解码与串行准入路径
-pub(super) fn decode_response_interrupt(
-    payload: &str,
-) -> Result<Option<String>, ResponseCreateFrameError> {
+/// 只识别需要本地准入的创建帧，其余文本不在网关解释
+pub(super) fn is_response_create(payload: &str) -> bool {
     #[derive(serde::Deserialize)]
     struct FrameType {
         #[serde(rename = "type")]
-        message_type: Option<String>,
+        message_type: String,
     }
-    // 非控制帧仍在原来的串行请求边界校验，不能抢先拒绝排队的普通请求
     // 只投影类型，避免为排队的大型 response.create 再构造完整 JSON 树
-    let Ok(frame) = serde_json::from_str::<FrameType>(payload) else {
-        return Ok(None);
-    };
-    if frame.message_type.as_deref() != Some("response.interrupt") {
-        return Ok(None);
+    match serde_json::from_str::<FrameType>(payload) {
+        Ok(frame) => frame.message_type == "response.create",
+        // struct 投影拒绝重复 type；沿用创建解码器的 JSON object 语义，
+        // 避免这类创建请求绕过准入进入透传路径
+        Err(_) => serde_json::from_str::<Value>(payload).is_ok_and(|frame| {
+            frame.get("type").and_then(Value::as_str) == Some("response.create")
+        }),
     }
-    let value: Value =
-        serde_json::from_str(payload).map_err(|_| ResponseCreateFrameError::InvalidJson)?;
-    if value.get("mode").and_then(Value::as_str) != Some("discard_partial_items") {
-        return Err(ResponseCreateFrameError::Request(
-            RequestDecodeError::InvalidValue {
-                field: "mode".to_owned(),
-            },
-        ));
-    }
-    let id = value
-        .get("response_id")
-        .and_then(Value::as_str)
-        .filter(|id| !id.is_empty())
-        .ok_or_else(|| {
-            ResponseCreateFrameError::Request(RequestDecodeError::InvalidValue {
-                field: "response_id".to_owned(),
-            })
-        })?;
-    Ok(Some(id.to_owned()))
 }
 
 fn decode_response_create_inner(

backend/crates/gateway-api/tests/admin/accounts/handlers.rs

@@ -12,13 +12,8 @@ use super::super::{AdminTestFixture, AdminTestState};
 #[tokio::test]
 async fn account_cooldown_returns_an_instant_and_server_formatted_recovery() {
     use chrono::{DateTime, Duration, Utc};
-    use gateway_admin::model::{
-        Revision,
-        accounts::{AccountCapacity, AccountPageItem, AccountRecord},
-    };
     use gateway_core::account::{
         AccountCooldown, AccountCooldownKind, AccountStatusFacts, CredentialState, QuotaState,
-        resolve_account_status,
     };
 
     for zone in ["Asia/Shanghai", "UTC", "Asia/Kathmandu", "America/New_York"] {
@@ -65,41 +60,7 @@ async fn account_cooldown_returns_an_instant_and_server_formatted_recovery() {
                 last_error_reason: None,
                 last_error_message: None,
             };
-            *fixture.account.lock().unwrap() = Some(AccountPageItem {
-                account: AccountRecord {
-                    id: "acct_cooldown".to_owned(),
-                    provider_kind: gateway_core::routing::ProviderKind::new("openai").unwrap(),
-                    groups: Vec::new(),
-                    name: "synthetic cooldown account".to_owned(),
-                    notes: None,
-                    email: None,
-                    upstream_user_id: None,
-                    upstream_account_id: None,
-                    plan_type: None,
-                    authentication_kind: "oauth".to_owned(),
-                    credential_revision: Revision::new(1).unwrap(),
-                    has_refresh_token: true,
-                    access_token_expires_at: None,
-                    next_refresh_at: None,
-                    enabled: true,
-                    concurrency_limit: None,
-                    weight: Default::default(),
-                    model_access: Default::default(),
-                    outbound_proxy: None,
-                    credential_state: facts.credential_state,
-                    credential_observed_at: now,
-                    quota: facts.quota,
-                    last_error_reason: None,
-                    last_error_message: None,
-                    created_at: now,
-                    updated_at: now,
-                },
-                capacity: AccountCapacity {
-                    used_slots: None,
-                    total_slots: None,
-                },
-                projection: resolve_account_status(&facts, now.into()),
-            });
+            *fixture.account.lock().unwrap() = Some(account_page_item(facts, now, "oauth"));
             let response = admin::accounts::router::<AdminTestState>()
                 .with_state(fixture.state())
                 .oneshot(
@@ -138,6 +99,132 @@ async fn account_cooldown_returns_an_instant_and_server_formatted_recovery() {
     }
 }
 
+fn account_page_item(
+    facts: gateway_core::account::AccountStatusFacts,
+    now: chrono::DateTime<chrono::Utc>,
+    authentication_kind: &str,
+) -> gateway_admin::model::accounts::AccountPageItem {
+    use gateway_admin::model::{
+        Revision,
+        accounts::{AccountCapacity, AccountPageItem, AccountRecord},
+    };
+    use gateway_core::account::resolve_account_status;
+
+    AccountPageItem {
+        account: AccountRecord {
+            id: "acct_cooldown".to_owned(),
+            provider_kind: gateway_core::routing::ProviderKind::new("openai").unwrap(),
+            groups: Vec::new(),
+            name: "synthetic cooldown account".to_owned(),
+            notes: None,
+            email: None,
+            upstream_user_id: None,
+            upstream_account_id: None,
+            plan_type: None,
+            authentication_kind: authentication_kind.to_owned(),
+            credential_revision: Revision::new(1).unwrap(),
+            has_refresh_token: authentication_kind == "oauth",
+            access_token_expires_at: None,
+            next_refresh_at: None,
+            enabled: true,
+            concurrency_limit: None,
+            weight: Default::default(),
+            model_access: Default::default(),
+            outbound_proxy: None,
+            credential_state: facts.credential_state,
+            credential_observed_at: now,
+            quota: facts.quota,
+            last_error_reason: None,
+            last_error_message: None,
+            created_at: now,
+            updated_at: now,
+        },
+        capacity: AccountCapacity {
+            used_slots: None,
+            total_slots: None,
+        },
+        projection: resolve_account_status(&facts, now.into()),
+    }
+}
+
+#[tokio::test]
+async fn account_usage_returns_distinct_cache_read_and_write_tokens_without_aliases() {
+    use chrono::Utc;
+    use gateway_admin::model::accounts::AccountUsage;
+    use gateway_core::account::{AccountStatusFacts, CredentialState, QuotaState};
+
+    let fixture = AdminTestFixture::new().await;
+    fixture.auth.insert_session("valid-session");
+    let now = Utc::now();
+    let facts = AccountStatusFacts {
+        enabled: true,
+        credential_state: CredentialState::Ready,
+        access_token_expires_at: None,
+        quota: QuotaState::unknown(),
+        cooldown: None,
+        last_error_reason: None,
+        last_error_message: None,
+    };
+    *fixture.account.lock().unwrap() = Some(account_page_item(facts, now, "api_key"));
+    for (read, write) in [(Some(13), Some(7)), (None, None)] {
+        *fixture.account_usage.lock().unwrap() = vec![AccountUsage {
+            account_id: "acct_cooldown".to_owned(),
+            request_count: 1,
+            success_count: 1,
+            input_tokens: Some(100),
+            output_tokens: Some(20),
+            cached_input_tokens: read,
+            cache_write_input_tokens: write,
+            reasoning_output_tokens: Some(3),
+            image_input_tokens: None,
+            image_output_tokens: None,
+            image_request_count: 0,
+            image_request_failed_count: 0,
+            total_tokens: Some(120),
+            cost_coverage: Default::default(),
+            costs: Vec::new(),
+            last_used_at: Some(now),
+            request_buckets: Vec::new(),
+            models: Vec::new(),
+        }];
+        let response = admin::accounts::router::<AdminTestState>()
+            .with_state(fixture.state())
+            .oneshot(
+                Request::builder()
+                    .uri("/api/admin/accounts")
+                    .header("x-request-id", "req_account_usage_contract")
+                    .header(header::COOKIE, "cpr_session=valid-session")
+                    .body(Body::empty())
+                    .unwrap(),
+            )
+            .await
+            .unwrap();
+        let status = response.status();
+        let body = to_bytes(response.into_body(), 32768).await.unwrap();
+        let value: serde_json::Value = serde_json::from_slice(&body).unwrap();
+        assert_eq!(status, StatusCode::OK, "{value}");
+        let usage = &value["data"]["items"][0]["usage"];
+        assert_eq!(usage["cachedInputTokens"], serde_json::json!(read));
+        assert_eq!(usage["cacheWriteInputTokens"], serde_json::json!(write));
+        assert_eq!(
+            usage["cachedInputTokensDisplay"],
+            if read.is_some() { "13" } else { "—" }
+        );
+        assert_eq!(
+            usage["cacheWriteInputTokensDisplay"],
+            if write.is_some() { "7" } else { "—" }
+        );
+        for alias in [
+            "createdTokens",
+            "createdTokensDisplay",
+            "readTokens",
+            "readTokensDisplay",
+        ] {
+            assert!(usage.get(alias).is_none(), "obsolete token alias: {alias}");
+        }
+    }
+}
+
 #[tokio::test]
 async fn standalone_credential_rotation_route_is_not_exposed() {
     let fixture = AdminTestFixture::new().await;

backend/crates/gateway-api/tests/admin/accounts/mod.rs

@@ -484,10 +484,10 @@ mod response {
             input_tokens_display: "-".to_owned(),
             output_tokens: None,
             output_tokens_display: "-".to_owned(),
-            cached_tokens: None,
-            cached_tokens_display: "-".to_owned(),
-            reasoning_tokens: None,
-            reasoning_tokens_display: "-".to_owned(),
+            cached_input_tokens: None,
+            cached_input_tokens_display: "-".to_owned(),
+            reasoning_output_tokens: None,
+            reasoning_output_tokens_display: "-".to_owned(),
             image_input_tokens: None,
             image_input_tokens_display: "-".to_owned(),
             image_output_tokens: None,
@@ -498,10 +498,8 @@ mod response {
             image_request_failed_count_display: "-".to_owned(),
             total_tokens: None,
             total_tokens_display: "-".to_owned(),
-            created_tokens: None,
-            created_tokens_display: "-".to_owned(),
-            read_tokens: None,
-            read_tokens_display: "-".to_owned(),
+            cache_write_input_tokens: None,
+            cache_write_input_tokens_display: "-".to_owned(),
             last_used_at: None,
             last_used_at_full_display: None,
             last_used_at_display: "-".to_owned(),
@@ -516,9 +514,9 @@ mod response {
         assert_eq!(value["windowLabelDisplay"], "周/月额度窗口");
         assert!(value["inputTokens"].is_null());
         assert!(value["totalTokens"].is_null());
-        assert!(value["reasoningTokens"].is_null());
-        assert_eq!(value["reasoningTokensDisplay"], "-");
-        assert_eq!(value["createdTokensDisplay"], "-");
+        assert!(value["reasoningOutputTokens"].is_null());
+        assert_eq!(value["reasoningOutputTokensDisplay"], "-");
+        assert_eq!(value["cacheWriteInputTokensDisplay"], "-");
     }
 
     #[test]

backend/crates/gateway-api/tests/admin/mod.rs

@@ -112,6 +112,7 @@ pub(super) struct AdminTestFixture {
     pub dashboard_summary_range: Arc<Mutex<Option<TimeRange>>>,
     pub provider_error: Arc<Mutex<Option<ProviderAdminError>>>,
     pub account: Arc<Mutex<Option<AccountPageItem>>>,
+    pub account_usage: Arc<Mutex<Vec<AccountUsage>>>,
 }
 
 impl AdminTestFixture {
@@ -154,6 +155,7 @@ impl AdminTestFixture {
         let dashboard_summary_range = Arc::new(Mutex::new(None));
         let provider_error = Arc::new(Mutex::new(None));
         let account = Arc::new(Mutex::new(None));
+        let account_usage = Arc::new(Mutex::new(Vec::new()));
         let unused = Arc::new(UnusedStore {
             observations: observations.clone(),
             usage_records: Arc::clone(&usage_records),
@@ -163,6 +165,7 @@ impl AdminTestFixture {
             dashboard_observation: Arc::clone(&dashboard_observation),
             dashboard_summary_range: Arc::clone(&dashboard_summary_range),
             account: Arc::clone(&account),
+            account_usage: Arc::clone(&account_usage),
         });
         let plugin_ports = Arc::new(plugins::TestPluginPorts::default());
         let published_snapshot = gateway_core::runtime::RuntimeSnapshotHandle::default();
@@ -232,6 +235,7 @@ impl AdminTestFixture {
             dashboard_summary_range,
             provider_error,
             account,
+            account_usage,
         }
     }
 
@@ -600,6 +604,7 @@ impl SettingsStore for MemorySettingsStore {
             rotation_strategy: command.rotation_strategy,
             updated_at: Utc::now(),
             values: gateway_admin::model::settings::RuntimeSettingsValues {
+                codex_privacy_policy: command.values.codex_privacy_policy,
                 request_location_enabled: command.values.request_location_enabled,
                 request_location: command.values.request_location,
                 refresh_margin_seconds: command.values.refresh_margin_seconds,
@@ -1099,6 +1104,7 @@ struct UnusedStore {
     dashboard_observation: Arc<Mutex<Option<DashboardObservation>>>,
     dashboard_summary_range: Arc<Mutex<Option<TimeRange>>>,
     account: Arc<Mutex<Option<AccountPageItem>>>,
+    account_usage: Arc<Mutex<Vec<AccountUsage>>>,
 }
 
 struct UnusedClientKeyVerifier;
@@ -1160,18 +1166,41 @@ impl AccountStore for UnusedStore {
     async fn load_account_usage(
         &self,
         _: TimeRange,
-        _: &[String],
+        account_ids: &[String],
     ) -> AdminStoreResult<Vec<AccountUsage>> {
         if self.account.lock().expect("account").is_some() {
-            return Ok(Vec::new());
+            return Ok(self
+                .account_usage
+                .lock()
+                .expect("account usage")
+                .iter()
+                .filter(|usage| account_ids.contains(&usage.account_id))
+                .cloned()
+                .collect());
         }
         Err(unavailable("account usage"))
     }
 
     async fn load_account_usage_by_windows(
         &self,
-        _: &[AccountUsageWindowQuery],
+        windows: &[AccountUsageWindowQuery],
     ) -> AdminStoreResult<Vec<AccountUsageWindowResult>> {
+        if self.account.lock().expect("account").is_some() {
+            let usage = self.account_usage.lock().expect("account usage");
+            return Ok(windows
+                .iter()
+                .filter_map(|window| {
+                    usage
+                        .iter()
+                        .find(|usage| usage.account_id == window.account_id)
+                        .map(|usage| AccountUsageWindowResult {
+                            account_id: window.account_id.clone(),
+                            key: window.key.clone(),
+                            usage: usage.clone(),
+                        })
+                })
+                .collect());
+        }
         Err(unavailable("account quota window usage"))
     }
 
@@ -1380,15 +1409,39 @@ impl ObservabilityStore for UnusedStore {
         data.trend.clone().ok_or_else(|| unavailable("usage trend"))
     }
 
-    fn usage_calculated_billing_facts(
+    async fn analytics_cache_generation(&self) -> AdminStoreResult<u64> {
+        Ok(self
+            .observations
+            .lock()
+            .expect("observations")
+            .summary
+            .as_ref()
+            .map_or(0, |summary| summary.analytics.generation))
+    }
+
+    async fn usage_insights_observation(
         &self,
-        _: TimeRange,
-        _: UsageFilter,
+        range: TimeRange,
+        filter: UsageFilter,
         _: Granularity,
-    ) -> gateway_admin::ports::store::UsageCalculatedBillingStream<'_> {
-        Box::pin(futures::stream::once(async {
-            Err(unavailable("usage billing facts"))
-        }))
+    ) -> AdminStoreResult<gateway_admin::model::observability::UsageInsightsObservation> {
+        let mut data = self.observations.lock().expect("observations");
+        data.summaries.push((range, filter.clone()));
+        data.trends.push((range, filter));
+        Ok(
+            gateway_admin::model::observability::UsageInsightsObservation {
+                overview: data
+                    .summary
+                    .clone()
+                    .map(|summary| UsageOverview { range, ..summary })
+                    .ok_or_else(|| unavailable("usage summary"))?,
+                trend: data
+                    .trend
+                    .clone()
+                    .ok_or_else(|| unavailable("usage trend"))?,
+                costs: Vec::new(),
+            },
+        )
     }
 
     async fn list_usage_records(&self, query: UsageQuery) -> AdminStoreResult<UsagePage> {
@@ -1667,6 +1720,7 @@ fn test_runtime_settings() -> RuntimeSettings {
         rotation_strategy: RotationStrategy::Smart,
         updated_at: Utc::now(),
         values: gateway_admin::model::settings::RuntimeSettingsValues {
+            codex_privacy_policy: Default::default(),
             request_location_enabled: false,
             request_location: Default::default(),
             refresh_margin_seconds: 3_600,

backend/crates/gateway-api/tests/admin/observability/response.rs

@@ -25,6 +25,17 @@ async fn dashboard_summary_should_include_quota_exhaustion_in_unavailable_headli
         .dashboard_observation
         .lock()
         .expect("dashboard observation") = Some(DashboardObservation {
+        analytics: gateway_admin::model::observability::AnalyticsMetadata {
+            coverage_start: Some(now - Duration::hours(1)),
+            coverage_end: Some(now),
+            generated_at: now,
+            lag_seconds: 12,
+            state: gateway_admin::model::observability::AnalyticsState::Lagging,
+            percentiles_approximate: true,
+            schema_version: 1,
+            histogram_version: 1,
+            generation: 42,
+        },
         runtime_slots: None,
         range: TimeRange::new(now - Duration::hours(1), now).expect("dashboard range"),
         totals: Default::default(),
@@ -59,6 +70,14 @@ async fn dashboard_summary_should_include_quota_exhaustion_in_unavailable_headli
         .expect("dashboard response body");
     let value: serde_json::Value = serde_json::from_slice(&body).expect("dashboard response JSON");
     assert_eq!(status, StatusCode::OK, "{value}");
+    assert_eq!(value["data"]["analytics"]["state"], "lagging");
+    assert_eq!(value["data"]["analytics"]["lagSeconds"], 12);
+    assert_eq!(value["data"]["analytics"]["percentilesApproximate"], true);
+    assert_eq!(value["data"]["analytics"]["schemaVersion"], 1);
+    assert_eq!(value["data"]["analytics"]["histogramVersion"], 1);
+    assert!(value["data"]["analytics"]["coverageStart"].is_string());
+    assert!(value["data"]["analytics"]["generatedAtDisplay"].is_string());
+    assert!(value["data"]["analytics"].get("generation").is_none());
 
     assert_eq!(
         (
@@ -108,12 +127,13 @@ async fn dashboard_summary_should_use_lifetime_totals_for_card_footers() {
         .dashboard_observation
         .lock()
         .expect("dashboard observation") = Some(DashboardObservation {
+        analytics: Default::default(),
         runtime_slots: None,
         range: TimeRange::new(now - Duration::hours(1), now).expect("dashboard range"),
         totals: DashboardTotals {
             request_count: 42,
             input_tokens: 800,
-            cached_tokens: 200,
+            cached_input_tokens: 200,
             total_tokens: 840,
             billing_usd: None,
         },
@@ -141,13 +161,21 @@ async fn dashboard_summary_should_use_lifetime_totals_for_card_footers() {
         .expect("dashboard response body");
     let value: serde_json::Value = serde_json::from_slice(&body).expect("dashboard response JSON");
     assert_eq!(status, StatusCode::OK, "{value}");
+    assert_eq!(
+        value["data"]["analytics"]["coverageStartDisplay"],
+        serde_json::Value::Null
+    );
+    assert_eq!(
+        value["data"]["analytics"]["coverageEndDisplay"],
+        serde_json::Value::Null
+    );
 
     assert_eq!(
         (
             &value["data"]["cards"]["traffic"]["totalRequests"],
             &value["data"]["cards"]["tokens"]["totalTokens"],
             &value["data"]["cards"]["cache"]["totalHitRate"],
-            &value["data"]["cards"]["cache"]["totalCachedTokens"],
+            &value["data"]["cards"]["cache"]["totalCachedInputTokens"],
         ),
         (
             &serde_json::json!("42"),
@@ -180,6 +208,7 @@ async fn dashboard_summary_should_default_to_current_deployment_day() {
         .dashboard_observation
         .lock()
         .expect("dashboard observation") = Some(DashboardObservation {
+        analytics: Default::default(),
         runtime_slots: None,
         range: TimeRange::new(now - Duration::hours(1), now).expect("dashboard range"),
         totals: Default::default(),
@@ -282,9 +311,9 @@ async fn usage_detail_should_keep_attempt_snapshot_contract() {
                 message: Some("limited".to_owned()),
                 input_tokens: None,
                 output_tokens: None,
-                cached_tokens: None,
-                cache_write_tokens: None,
-                reasoning_tokens: None,
+                cached_input_tokens: None,
+                cache_write_input_tokens: None,
+                reasoning_output_tokens: None,
                 total_tokens: None,
                 cost_source: Some("unavailable".to_owned()),
                 cost_amount: None,
@@ -401,9 +430,9 @@ async fn zero_attempt_failure_detail_keeps_missing_upstream_facts_and_preparatio
     record.error_message = Some("no upstream account is available".to_owned());
     record.input_tokens = None;
     record.output_tokens = None;
-    record.cached_tokens = None;
-    record.cache_write_tokens = None;
-    record.reasoning_tokens = None;
+    record.cached_input_tokens = None;
+    record.cache_write_input_tokens = None;
+    record.reasoning_output_tokens = None;
     record.image_input_tokens = None;
     record.image_output_tokens = None;
     record.total_tokens = None;
@@ -617,6 +646,7 @@ async fn diagnostics_should_keep_stable_key_and_display_name_contract() {
     let fixture = AdminTestFixture::new().await;
     fixture.auth.insert_session("valid-session");
     *fixture.diagnostics.lock().expect("diagnostics") = DiagnosticsObservation {
+        analytics: Default::default(),
         total_request_count: 4,
         items: vec![DiagnosticObservation {
             key: "acct_diag".to_owned(),
@@ -726,9 +756,9 @@ fn usage_record_with_account(
         retry_after_ms: None,
         input_tokens: Some(1),
         output_tokens: Some(1),
-        cached_tokens: Some(0),
-        cache_write_tokens: Some(0),
-        reasoning_tokens: Some(0),
+        cached_input_tokens: Some(0),
+        cache_write_input_tokens: Some(0),
+        reasoning_output_tokens: Some(0),
         image_input_tokens: Some(0),
         image_output_tokens: Some(0),
         total_tokens: Some(2),
@@ -847,9 +877,9 @@ async fn usage_route_should_expose_table_facts_without_detail_payload() {
             service_tier: Some("default".to_owned()),
             input_tokens: Some(1),
             output_tokens: Some(1),
-            cached_tokens: Some(0),
-            cache_write_tokens: Some(0),
-            reasoning_tokens: Some(0),
+            cached_input_tokens: Some(0),
+            cache_write_input_tokens: Some(0),
+            reasoning_output_tokens: Some(0),
             image_input_tokens: Some(31),
             image_output_tokens: Some(9),
             total_tokens: Some(2),
@@ -1101,6 +1131,12 @@ async fn calendar_queries_and_display_follow_deployment_timezone_with_one_anchor
         let fixture = AdminTestFixture::with_timezone(timezone).await;
         fixture.auth.insert_session("valid-session");
         *fixture.dashboard_observation.lock().unwrap() = Some(DashboardObservation {
+            analytics: gateway_admin::model::observability::AnalyticsMetadata {
+                coverage_start: Some(range.start),
+                coverage_end: Some(end),
+                generated_at: end,
+                ..Default::default()
+            },
             runtime_slots: None,
             range,
             totals: Default::default(),
@@ -1142,6 +1178,15 @@ async fn calendar_queries_and_display_follow_deployment_timezone_with_one_anchor
         assert_eq!(queried.end, end);
         assert_eq!(value["data"]["asOf"], anchor);
         assert_eq!(value["data"]["asOfDisplay"], display);
+        let analytics = &value["data"]["analytics"];
+        assert_eq!(analytics["coverageStart"], start);
+        assert_eq!(analytics["coverageEnd"], anchor);
+        assert_eq!(
+            analytics["coverageStartDisplay"],
+            format!("{} 00:00:00", &display[..10])
+        );
+        assert_eq!(analytics["coverageEndDisplay"], display);
+        assert_eq!(analytics["generatedAtDisplay"], display);
         let points = value["data"]["healthTimeline"]["points"]
             .as_array()
             .unwrap();
@@ -1198,3 +1243,52 @@ async fn calendar_query_rejects_an_anchor_outside_the_local_calendar() {
     assert_eq!(response.status(), StatusCode::BAD_REQUEST);
     assert!(fixture.dashboard_summary_range.lock().unwrap().is_none());
 }
+
+#[tokio::test]
+async fn request_and_ops_queries_should_forward_deleted_group_id_sets() {
+    use crate::admin::{AdminTestFixture, AdminTestState};
+    use axum::{
+        body::Body,
+        http::{Request, StatusCode, header},
+    };
+    use gateway_api::admin::observability;
+    use tower::ServiceExt as _;
+    let fixture = AdminTestFixture::new().await;
+    fixture.auth.insert_session("valid-session");
+    let router = observability::router::<AdminTestState>().with_state(fixture.state());
+    for path in ["/api/admin/usage/records", "/api/admin/operations/errors"] {
+        let response = router
+            .clone()
+            .oneshot(
+                Request::builder()
+                    .uri(format!(
+                        "{path}?routingGroupRefs=deleted-b,deleted-a,deleted-b"
+                    ))
+                    .header(header::COOKIE, "cpr_session=valid-session")
+                    .header("x-request-id", "req_group_filter")
+                    .body(Body::empty())
+                    .unwrap(),
+            )
+            .await
+            .unwrap();
+        let status = response.status();
+        let body = axum::body::to_bytes(response.into_body(), 1024 * 1024)
+            .await
+            .unwrap();
+        assert_eq!(
+            status,
+            StatusCode::OK,
+            "{path}: {}",
+            String::from_utf8_lossy(&body)
+        );
+    }
+    let observations = fixture.observations.lock().unwrap();
+    assert_eq!(
+        observations.records[0].filter.routing_group_refs,
+        ["deleted-a", "deleted-b"]
+    );
+    assert_eq!(
+        observations.errors[0].filter.routing_group_refs,
+        ["deleted-a", "deleted-b"]
+    );
+}

backend/crates/gateway-api/tests/admin/settings.rs

@@ -40,6 +40,7 @@ async fn response_json(response: axum::response::Response) -> Value {
 fn update_body() -> Value {
     json!({
         "configRevision": 7,
+        "codexPrivacyPolicy": {"enabled":false,"onError":"skip_rule","rules":[]},
         "requestLocationEnabled": false,
         "requestLocation": {"country":"US", "region":"Ohio", "city":"Piketon", "timezone":"America/New_York"},
         "modelMappings": {
@@ -78,6 +79,63 @@ fn update_body() -> Value {
     })
 }
 
+#[tokio::test]
+async fn privacy_save_requires_provider_validation_and_preview_requires_admin_auth() {
+    let fixture = AdminTestFixture::new().await;
+    fixture.auth.insert_session("valid-session");
+    let mut body = update_body();
+    let policy = json!({"enabled":true,"onError":"reject_request","rules":[{
+        "id":"auth","name":"自定义认证头","enabled":true,"scope":"request_header",
+        "selector":"authorization","action":"remove_field","pattern":null,
+        "replacement":"","value":null,"replaceAll":true,"caseInsensitive":false,"multiLine":false
+    }]});
+    body["codexPrivacyPolicy"] = policy.clone();
+    let response = app(fixture.state())
+        .oneshot(request(
+            Method::POST,
+            "/api/admin/settings/update",
+            Some(body),
+        ))
+        .await
+        .unwrap();
+    assert_eq!(response.status(), StatusCode::BAD_REQUEST);
+    let response = app(fixture.state())
+        .oneshot(request(Method::GET, "/api/admin/settings", None))
+        .await
+        .unwrap();
+    assert_eq!(
+        response_json(response).await["data"]["codexPrivacyPolicy"],
+        json!({"enabled":false,"onError":"skip_rule","rules":[]})
+    );
+    let response = app(fixture.state())
+        .oneshot(
+            Request::builder()
+                .method(Method::POST)
+                .uri("/api/admin/settings/privacy/preview")
+                .header(header::CONTENT_TYPE, "application/json")
+                .body(Body::from(
+                    json!({"policy":policy,"body":{},"headers":{},"turnMetadata":null}).to_string(),
+                ))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(response.status(), StatusCode::UNAUTHORIZED);
+}
+
+#[test]
+fn privacy_policy_is_required_and_rejects_unknown_contract_fields() {
+    let mut missing = update_body();
+    missing
+        .as_object_mut()
+        .unwrap()
+        .remove("codexPrivacyPolicy");
+    assert!(serde_json::from_value::<UpdateRuntimeSettingsRequest>(missing).is_err());
+    let mut unknown = update_body();
+    unknown["codexPrivacyPolicy"]["protectedFields"] = json!([]);
+    assert!(serde_json::from_value::<UpdateRuntimeSettingsRequest>(unknown).is_err());
+}
+
 #[tokio::test]
 async fn smart_settings_round_trip_and_invalid_updates_leave_the_saved_value_intact() {
     let fixture = AdminTestFixture::new().await;
@@ -223,6 +281,7 @@ fn settings_response_should_cover_the_full_runtime_settings_contract() {
             .single()
             .expect("timestamp"),
         values: gateway_admin::model::settings::RuntimeSettingsValues {
+            codex_privacy_policy: Default::default(),
             request_location_enabled: false,
             request_location: Default::default(),
             refresh_margin_seconds: 1800,
@@ -268,6 +327,7 @@ fn settings_response_should_cover_the_full_runtime_settings_contract() {
             "providerRequestProfiles": {},
             "openaiClientProfile": null,
             "xaiClientProfile": null,
+        "codexPrivacyPolicy": {"enabled":false,"onError":"skip_rule","rules":[]},
         "requestLocationEnabled": false,
         "requestLocation": {"country":"US", "region":"Ohio", "city":"Piketon", "timezone":"America/New_York"},
             "modelMappings": {
@@ -348,6 +408,7 @@ fn settings_request_and_response_fields_should_stay_in_lockstep() {
             .expect("fixture rotation strategy"),
         updated_at: chrono::Utc::now(),
         values: gateway_admin::model::settings::RuntimeSettingsValues {
+            codex_privacy_policy: Default::default(),
             request_location_enabled: false,
             request_location: Default::default(),
             refresh_margin_seconds: request.values.refresh_margin_seconds,

backend/crates/gateway-api/tests/health.rs

@@ -1,6 +1,6 @@
 //! 验证健康接口按基础设施与关键 Worker 状态判定可用性
 
-use std::sync::Arc;
+use std::sync::{Arc, Mutex};
 
 use axum::{
     body::Body,
@@ -13,12 +13,17 @@ use gateway_core::{
         StartProviderExecution, StartedExecution,
     },
     error::GatewayError,
-    health::{WorkerHealthKey, WorkerHealthSnapshot, WorkerHealthSource, WorkerRuntimeState},
+    health::{
+        HealthProbe, HealthState, WorkerHealthKey, WorkerHealthSnapshot, WorkerHealthSource,
+        WorkerRuntimeState,
+    },
     routing::PublicModelId,
     task::{WorkerId, WorkerKind},
 };
 use tower::ServiceExt;
 
+use crate::support::RecordingDiagnostics;
+
 #[tokio::test]
 async fn healthz_should_return_no_content_when_all_inputs_are_healthy() {
     let response = crate::openai::api_router(Arc::new(UnusedExecution))
@@ -81,6 +86,214 @@ async fn healthz_should_reject_critical_worker_failure() {
     assert_eq!(response.status(), StatusCode::SERVICE_UNAVAILABLE);
 }
 
+#[tokio::test]
+async fn healthz_records_probe_changes_once_and_records_recurrence_after_recovery() {
+    let probe = Arc::new(MutableProbe(Mutex::new(HealthState::Unhealthy(
+        "file logging rejected records".to_owned(),
+    ))));
+    let diagnostics = Arc::new(RecordingDiagnostics::default());
+    let router = health_router(vec![probe.clone()], Vec::new(), diagnostics.clone()).await;
+
+    let responses =
+        futures::future::join_all((0..8).map(|_| health_response(router.clone()))).await;
+    for response in responses {
+        assert_eq!(response.status(), StatusCode::SERVICE_UNAVAILABLE);
+        assert!(
+            axum::body::to_bytes(response.into_body(), 1024)
+                .await
+                .unwrap()
+                .is_empty()
+        );
+    }
+    {
+        let events = diagnostics.0.lock().unwrap();
+        assert_eq!(events.len(), 1);
+        assert_eq!(events[0].component, "health");
+        assert_eq!(
+            events[0].correlation_id.as_deref(),
+            Some("probe:file_logging")
+        );
+        assert_eq!(events[0].message, "Health check failed");
+        assert!(
+            events[0]
+                .details
+                .as_ref()
+                .unwrap()
+                .as_str()
+                .contains("file logging rejected records")
+        );
+    }
+
+    *probe.0.lock().unwrap() = HealthState::Degraded("file logging maintenance failed".to_owned());
+    assert_eq!(
+        health_response(router.clone()).await.status(),
+        StatusCode::SERVICE_UNAVAILABLE
+    );
+    assert_eq!(diagnostics.0.lock().unwrap().len(), 2);
+    *probe.0.lock().unwrap() = HealthState::Healthy;
+    assert_eq!(
+        health_response(router.clone()).await.status(),
+        StatusCode::NO_CONTENT
+    );
+    *probe.0.lock().unwrap() = HealthState::Degraded("file logging maintenance failed".to_owned());
+    assert_eq!(
+        health_response(router).await.status(),
+        StatusCode::SERVICE_UNAVAILABLE
+    );
+    assert_eq!(diagnostics.0.lock().unwrap().len(), 3);
+}
+
+#[tokio::test(start_paused = true)]
+async fn healthz_retains_worker_and_completed_probe_failures_when_another_probe_times_out() {
+    let diagnostics = Arc::new(RecordingDiagnostics::default());
+    let router = health_router(
+        vec![
+            Arc::new(MutableProbe(Mutex::new(HealthState::Unhealthy(
+                "file output failed".to_owned(),
+            )))),
+            Arc::new(PendingProbe),
+        ],
+        vec![
+            worker_snapshot(
+                WorkerKind::RuntimeSnapshotReconciliation,
+                WorkerRuntimeState::BackingOff,
+            ),
+            worker_snapshot(
+                WorkerKind::QuotaCatalogHealth,
+                WorkerRuntimeState::BackingOff,
+            ),
+        ],
+        diagnostics.clone(),
+    )
+    .await;
+
+    assert_eq!(
+        health_response(router).await.status(),
+        StatusCode::SERVICE_UNAVAILABLE
+    );
+    let events = diagnostics.0.lock().unwrap();
+    assert_eq!(events.len(), 3);
+    for (component, reason) in [
+        (
+            "worker:runtime_snapshot_reconciliation:health-test",
+            "test worker failure",
+        ),
+        ("probe:file_logging", "file output failed"),
+        ("probe:pending", "timed_out"),
+    ] {
+        let event = events
+            .iter()
+            .find(|event| event.correlation_id.as_deref() == Some(component))
+            .expect(component);
+        assert!(event.details.as_ref().unwrap().as_str().contains(reason));
+    }
+}
+
+#[tokio::test]
+async fn healthz_retries_failed_diagnostic_admission_without_changing_health_result() {
+    let diagnostics = Arc::new(FailingOnceDiagnostics::default());
+    let router = health_router(
+        vec![Arc::new(MutableProbe(Mutex::new(HealthState::Unhealthy(
+            "file output failed".to_owned(),
+        ))))],
+        Vec::new(),
+        diagnostics.clone(),
+    )
+    .await;
+
+    assert_eq!(
+        health_response(router.clone()).await.status(),
+        StatusCode::SERVICE_UNAVAILABLE
+    );
+    assert!(diagnostics.recorded.0.lock().unwrap().is_empty());
+    assert_eq!(
+        health_response(router).await.status(),
+        StatusCode::SERVICE_UNAVAILABLE
+    );
+    assert_eq!(diagnostics.recorded.0.lock().unwrap().len(), 1);
+}
+
+#[derive(Default)]
+struct FailingOnceDiagnostics {
+    failed: std::sync::atomic::AtomicBool,
+    recorded: RecordingDiagnostics,
+}
+
+#[async_trait::async_trait]
+impl gateway_core::diagnostics::OperationalDiagnostics for FailingOnceDiagnostics {
+    async fn record_failure(
+        &self,
+        failure: gateway_core::diagnostics::OperationalFailure,
+    ) -> Result<(), gateway_core::error::StoreError> {
+        if !self.failed.swap(true, std::sync::atomic::Ordering::SeqCst) {
+            return Err(gateway_core::error::StoreError::new(
+                gateway_core::error::StoreErrorKind::Unavailable,
+            ));
+        }
+        self.recorded.record_failure(failure).await
+    }
+}
+
+async fn health_router(
+    probes: Vec<Arc<dyn HealthProbe>>,
+    workers: Vec<WorkerHealthSnapshot>,
+    diagnostics: Arc<dyn gateway_core::diagnostics::OperationalDiagnostics>,
+) -> axum::Router {
+    let admin = crate::admin::AdminTestFixture::new().await;
+    gateway_api::initialize(
+        gateway_api::ApiConfig {
+            asset_directory: std::env::temp_dir(),
+            cors_allowed_origins: Vec::new(),
+            request_timeout_seconds: None,
+            request_id_header: "x-request-id".to_owned(),
+        },
+        Arc::new(UnusedExecution),
+        admin.services,
+        probes,
+        Arc::new(StaticWorkerHealth(workers)),
+        Arc::new(crate::openai::TestLifecycle::default()),
+        diagnostics,
+    )
+    .unwrap()
+    .router()
+}
+
+async fn health_response(router: axum::Router) -> axum::response::Response {
+    router
+        .oneshot(
+            Request::builder()
+                .uri("/healthz")
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap()
+}
+
+struct MutableProbe(Mutex<HealthState>);
+
+impl HealthProbe for MutableProbe {
+    fn name(&self) -> &'static str {
+        "file_logging"
+    }
+
+    fn check(&self) -> BoxFuture<'_, HealthState> {
+        Box::pin(std::future::ready(self.0.lock().unwrap().clone()))
+    }
+}
+
+struct PendingProbe;
+
+impl HealthProbe for PendingProbe {
+    fn name(&self) -> &'static str {
+        "pending"
+    }
+
+    fn check(&self) -> BoxFuture<'_, HealthState> {
+        Box::pin(std::future::pending())
+    }
+}
+
 #[derive(Clone)]
 struct StaticWorkerHealth(Vec<WorkerHealthSnapshot>);
 

backend/crates/gateway-api/tests/key_usage/fixtures.rs

@@ -48,8 +48,8 @@ pub(super) async fn fixture() -> AdminTestFixture {
         failure_count: 1,
         input_tokens: 1000,
         output_tokens: 100,
-        cached_tokens: 900,
-        reasoning_tokens: 40,
+        cached_input_tokens: 900,
+        reasoning_output_tokens: 40,
         total_tokens: 1100,
         ..Default::default()
     };
@@ -65,6 +65,7 @@ pub(super) async fn fixture() -> AdminTestFixture {
     {
         let mut observations = fixture.observations.lock().unwrap();
         observations.summary = Some(UsageOverview {
+            analytics: Default::default(),
             range: TimeRange {
                 start: now - Duration::hours(1),
                 end: now,
@@ -111,9 +112,9 @@ fn usage_record() -> UsageListRecord {
         service_tier: Some("private-sentinel".to_owned()),
         input_tokens: Some(1000),
         output_tokens: Some(100),
-        cached_tokens: Some(900),
-        cache_write_tokens: Some(0),
-        reasoning_tokens: Some(40),
+        cached_input_tokens: Some(900),
+        cache_write_input_tokens: Some(0),
+        reasoning_output_tokens: Some(40),
         image_input_tokens: None,
         image_output_tokens: None,
         total_tokens: Some(1100),

backend/crates/gateway-api/tests/key_usage/mod.rs

@@ -181,6 +181,7 @@ async fn overview_scopes_every_query_and_projects_only_key_visible_fields() {
             "summary",
             "trend",
             "healthTimeline",
+            "analytics",
         ],
     );
     assert_fields(
@@ -203,8 +204,8 @@ async fn overview_scopes_every_query_and_projects_only_key_visible_fields() {
     assert_eq!(data["key"]["dailyUsedUsd"], "0.640001");
     assert_eq!(data["key"]["maxConcurrency"], 0);
     assert_eq!(data["summary"]["totalTokens"], 1100);
-    assert_eq!(data["summary"]["reasoningTokens"], 40);
-    assert_eq!(data["trend"][0]["reasoningTokens"], 40);
+    assert_eq!(data["summary"]["reasoningOutputTokens"], 40);
+    assert_eq!(data["trend"][0]["reasoningOutputTokens"], 40);
     assert_eq!(data["summary"]["costUsd"], "0.123456");
     assert_eq!(data["summary"]["costIncomplete"], true);
     assert_eq!(data["trend"][0]["bucketSeconds"], 900);
@@ -300,7 +301,7 @@ async fn records_keep_pagination_and_hide_admin_and_upstream_data() {
         assert!(!data.to_string().contains("private-sentinel"));
         if kind == "success" {
             assert_eq!(record["billing"]["totalAmountDisplay"], "$0.1235");
-            assert_eq!(record["tokenDetails"]["reasoningTokens"], 40);
+            assert_eq!(record["tokenDetails"]["reasoningOutputTokens"], 40);
             assert_eq!(record["tokenDetails"]["totalTokens"], 1100);
             assert_eq!(record["firstTokenLatencyMs"], 210);
             assert_fields(
@@ -430,6 +431,7 @@ async fn empty_usage_has_zero_cost_but_unknown_pricing_stays_unknown() {
         {
             let mut data = fixture.observations.lock().unwrap();
             let summary = data.summary.as_mut().unwrap();
+            summary.analytics.generation += 1;
             summary.requests = RequestMetrics {
                 request_count: requests,
                 ..Default::default()

backend/crates/gateway-api/tests/openai/images/mod.rs

@@ -10,6 +10,7 @@ use axum::{
     body::{Body, to_bytes},
     http::{Request, StatusCode, header::AUTHORIZATION},
 };
+use base64::{Engine as _, engine::general_purpose::STANDARD};
 use bytes::Bytes;
 use futures::future::BoxFuture;
 use gateway_core::engine::execution::{
@@ -300,6 +301,11 @@ async fn image_routes_should_not_decode_bodies_and_should_preserve_both_directio
                     .header("x-codex-image-turn-id", "turn_image_route")
                     .header("session-id", "root-image-session")
                     .header("thread-id", "child-image-thread")
+                    .header("x-future-business", "first")
+                    .header("x-future-business", "second")
+                    .header("cookie", "client-secret")
+                    .header("connection", "x-private-hop")
+                    .header("x-private-hop", "client-hop")
                     .body(Body::from(body.to_vec()))
                     .expect("image request"),
             )
@@ -338,8 +344,37 @@ async fn image_routes_should_not_decode_bodies_and_should_preserve_both_directio
         assert_eq!(captured.transport, ClientTransport::HttpJson);
         assert_eq!(captured.kind, *kind);
         assert_eq!(captured.body.as_ref(), *body);
+        let mut context = captured.context.clone();
+        let headers = context
+            .as_object_mut()
+            .unwrap()
+            .remove("opaque_request_headers")
+            .unwrap();
+        let headers: Vec<_> = headers
+            .as_array()
+            .unwrap()
+            .iter()
+            .map(|entry| {
+                (
+                    entry[0].as_str().unwrap(),
+                    STANDARD.decode(entry[1].as_str().unwrap()).unwrap(),
+                )
+            })
+            .collect();
         assert_eq!(
-            captured.context,
+            headers
+                .iter()
+                .filter(|(name, _)| *name == "x-future-business")
+                .map(|(_, value)| value.as_slice())
+                .collect::<Vec<_>>(),
+            [b"first".as_slice(), b"second".as_slice()]
+        );
+        assert!(!headers.iter().any(|(name, _)| matches!(
+            *name,
+            "authorization" | "cookie" | "connection" | "x-private-hop"
+        )));
+        assert_eq!(
+            context,
             json!({"image_turn_id": "turn_image_route", "session_id": "root-image-session", "thread_id": "child-image-thread"})
         );
     }

backend/crates/gateway-api/tests/openai/mod.rs

@@ -283,12 +283,25 @@ fn snapshot_with_client_key(
     plaintext: &str,
     provider_name: &str,
     client_key_id: &str,
+) -> RuntimeSnapshot {
+    snapshot_with_accounts(plaintext, provider_name, client_key_id, &["acct_api_test"])
+}
+
+fn snapshot_with_accounts(
+    plaintext: &str,
+    provider_name: &str,
+    client_key_id: &str,
+    accounts: &[&str],
 ) -> RuntimeSnapshot {
     let provider = ProviderKind::new(provider_name).expect("provider");
-    let account_directory = Arc::new(RuntimeAccountDirectory::new(BTreeMap::from([(
-        ProviderAccountId::new("acct_api_test").expect("account ID"),
-        RuntimeAccount::new(provider.clone(), BTreeSet::new()),
-    )])));
+    let account_directory = Arc::new(RuntimeAccountDirectory::new(BTreeMap::from_iter(
+        accounts.iter().map(|id| {
+            (
+                ProviderAccountId::new(*id).expect("account ID"),
+                RuntimeAccount::new(provider.clone(), BTreeSet::new()),
+            )
+        }),
+    )));
     let capabilities = ModelCapabilities::new(
         BTreeSet::from([gateway_core::operation::OperationKind::Generate]),
         Some(16_000),
@@ -323,7 +336,7 @@ fn snapshot_with_client_key(
 }
 
 #[derive(Default)]
-struct TestLifecycle {
+pub(crate) struct TestLifecycle {
     cancellation: gateway_core::lifecycle::CancellationToken,
 }
 

backend/crates/gateway-api/tests/openai/responses/http.rs

@@ -3022,3 +3022,67 @@ async fn compressed_http_request_above_default_limit_should_reach_execution_afte
         }
     }
 }
+
+#[tokio::test]
+async fn streaming_middleware_preserves_heartbeats_before_and_after_rewriting() {
+    for opaque in [
+        b": ping\n\n".as_slice(),
+        b"id: next\nretry: 1000\n\n".as_slice(),
+        b"event: vendor.future\ndata: future non-JSON payload\n\n".as_slice(),
+    ] {
+        let admin = crate::admin::AdminTestFixture::new().await.services;
+        let trace = Arc::new(Trace::default());
+        let heartbeat = Bytes::copy_from_slice(opaque);
+        let future = Bytes::from_static(
+            b"event: response.future\ndata: {\"type\":\"response.future\",\"extension\":true}\n\n",
+        );
+        let session = FakeSession::streaming(
+            Arc::clone(&trace),
+            vec![
+                NextStep::Event(delivery(started(), CommitRequirement::CommitBeforeDelivery)),
+                NextStep::Event(delivery_provider(
+                    ProviderEvent::wire(
+                        ProtocolWireEvent::raw_sse("openai", heartbeat.clone()).unwrap(),
+                    ),
+                    CommitRequirement::AlreadyCommitted,
+                )),
+                NextStep::Event(delivery_provider(
+                    ProviderEvent::wire(
+                        ProtocolWireEvent::raw_sse("openai", future.clone()).unwrap(),
+                    ),
+                    CommitRequirement::AlreadyCommitted,
+                )),
+                NextStep::Event(delivery_provider(
+                    ProviderEvent::wire(
+                        ProtocolWireEvent::raw_sse("openai", heartbeat.clone()).unwrap(),
+                    ),
+                    CommitRequirement::AlreadyCommitted,
+                )),
+                NextStep::Event(delivery(completed(), CommitRequirement::AlreadyCommitted)),
+                NextStep::FinalizeSuccess,
+            ],
+        );
+        let replacement = Bytes::from_static(b"event: response.future\ndata: {\"type\":\"response.future\",\"extension\":\"changed\"}\n\n");
+        let middleware = Arc::new(responses_middleware().with_response_actions(vec![
+            ResponseFrameAction::Continue,
+            ResponseFrameAction::Continue,
+            ResponseFrameAction::Replace(replacement.clone()),
+            ResponseFrameAction::Continue,
+            ResponseFrameAction::Continue,
+            ResponseFrameAction::Continue,
+        ]));
+        let response =
+            response_with_middleware(&admin, "openai", session, true, Some(middleware)).await;
+        let body = to_bytes(response.into_body(), usize::MAX).await.unwrap();
+        let text = std::str::from_utf8(&body).unwrap();
+        assert_eq!(
+            text.matches(std::str::from_utf8(opaque).unwrap()).count(),
+            2
+        );
+        assert!(text.contains(std::str::from_utf8(&replacement).unwrap()));
+        assert!(text.contains("response.completed"));
+        assert!(!text.contains("middleware_failed"));
+        assert!(text.ends_with("data: [DONE]\n\n"));
+        assert!(!trace.is_cancelled());
+    }
+}

backend/crates/gateway-api/tests/openai/responses/mod.rs

@@ -1071,3 +1071,35 @@ fn transparent_encoder_should_only_require_wire_terminal_for_buffered_conversion
         ResponseEncodeError::MissingWireTerminal
     );
 }
+
+#[test]
+fn metadata_keeps_business_extensions_and_filters_only_protected_headers() {
+    let data = json!({
+        "type":"response.metadata",
+        "headers":{"x-future-header":["first","second"],"authorization":"private","set-cookie":"private","chatgpt-account-id":"private","connection":"x-private-hop","x-private-hop":"private"},
+        "metadata":{"type":"safety_buffering","use_cases":["cyber"],"reasons":["user_risk"],"openai_verification_recommendation":{"future":true},"openai_chatgpt_moderation_metadata":{"future":true}},
+        "future_extension":{"keep":true}
+    });
+    let raw = data.to_string();
+    let event = ProviderEvent::wire(
+        ProtocolWireEvent::json("openai", Some("response.metadata".to_owned()), data.clone())
+            .unwrap()
+            .with_raw_websocket_message(raw.as_str()),
+    );
+    let mut encoder = OpenAiResponsesEncoder::new();
+    let ws = encoder.push_websocket(&event);
+    let delivered: Value = serde_json::from_str(&ws[0]).unwrap();
+    assert_eq!(delivered["metadata"], data["metadata"]);
+    assert_eq!(delivered["future_extension"], data["future_extension"]);
+    assert_eq!(
+        delivered["headers"],
+        json!({"x-future-header":["first","second"]})
+    );
+    let sse = encoder.push_sse(&event);
+    assert!(!std::str::from_utf8(&sse[0]).unwrap().contains("private"));
+    assert!(
+        std::str::from_utf8(&sse[0])
+            .unwrap()
+            .contains("safety_buffering")
+    );
+}

backend/crates/gateway-api/tests/openai/responses/websocket/forward.rs

@@ -106,10 +106,18 @@ async fn next_error(socket: &mut TestSocket) -> Value {
 }
 
 async fn assert_no_duplicate_failure(socket: &mut TestSocket) {
-    // 后续入站帧只会在本轮收敛后处理，比固定等待窗口更可靠地检查没有重复失败终态
-    socket.send(Message::Text("{".into())).await.unwrap();
+    // 无效创建帧仍走串行队列，以本地业务校验作为本轮收敛后的屏障
+    socket
+        .send(Message::Text(
+            json!({"type":"response.create","model":"model-a","stream":false})
+                .to_string()
+                .into(),
+        ))
+        .await
+        .unwrap();
     let error = next_event(socket).await;
-    assert_eq!(error["error"]["code"], "invalid_json");
+    assert_eq!(error["error"]["code"], "invalid_value");
+    assert_eq!(error["error"]["param"], "stream");
     assert_eq!(error["status"], 400);
     assert_eq!(error["headers"]["x-request-id"], error["request_id"]);
     assert_eq!(

backend/crates/gateway-api/tests/openai/responses/websocket/interrupt.rs

@@ -1,12 +1,73 @@
-//! 验证 Responses WebSocket 中断向当前执行传递并释放相关资源
+//! 验证未知控制消息、迟到中断、结算期间收发和创建请求的串行准入
 
 use super::*;
-use gateway_core::engine::response_control::{ResponseControl, ResponseInterruptError};
+use gateway_core::engine::response_control::{
+    ResponseControlTransport, ResponseControlUnavailable,
+};
+
+struct ControlTransport {
+    id: String,
+    active: std::sync::atomic::AtomicBool,
+    requests: Mutex<Vec<String>>,
+    sender: tokio::sync::mpsc::Sender<Value>,
+    receiver: tokio::sync::Mutex<tokio::sync::mpsc::Receiver<Value>>,
+}
+
+impl ControlTransport {
+    fn new(id: String) -> Self {
+        let (sender, receiver) = tokio::sync::mpsc::channel(32);
+        Self {
+            id,
+            active: std::sync::atomic::AtomicBool::new(true),
+            requests: Mutex::default(),
+            sender,
+            receiver: tokio::sync::Mutex::new(receiver),
+        }
+    }
+}
+
+#[async_trait]
+impl ResponseControlTransport for ControlTransport {
+    async fn send(&self, payload: &str) -> Result<(), ResponseControlUnavailable> {
+        self.requests.lock().unwrap().push(payload.to_owned());
+        let original: Value =
+            serde_json::from_str(payload).unwrap_or_else(|_| Value::String(payload.to_owned()));
+        let event = if original["type"] == "future.reject" {
+            upstream_control_error()
+        } else if original["type"] == "response.interrupt"
+            && original["response_id"] == self.id
+            && original["mode"] == "discard_partial_items"
+            && self.active.load(Ordering::SeqCst)
+        {
+            json!({"type":"response.incomplete", "response":{"id":self.id,"model":"model-a","status":"incomplete","output":[],"incomplete_details":{"reason":"interrupted"}}})
+        } else {
+            json!({"type":"future.control.ack", "original":original})
+        };
+        self.sender
+            .send(event)
+            .await
+            .map_err(|_| ResponseControlUnavailable)
+    }
+    async fn receive(&self) -> Result<String, ResponseControlUnavailable> {
+        self.receiver
+            .lock()
+            .await
+            .recv()
+            .await
+            .map(|event| event.to_string())
+            .ok_or(ResponseControlUnavailable)
+    }
+}
 
 #[derive(Default)]
 struct InterruptProvider {
     calls: AtomicUsize,
-    controls: Mutex<Vec<ResponseControl>>,
+    fail_first: bool,
+    retry_started: tokio::sync::Notify,
+    retry_release: tokio::sync::Notify,
+    transport: Mutex<Option<Arc<ControlTransport>>>,
+    complete: tokio::sync::Notify,
+    initial_messages: Mutex<std::collections::VecDeque<ProtocolWireEvent>>,
 }
 
 #[async_trait]
@@ -29,56 +90,97 @@ impl Provider for InterruptProvider {
         context: AttemptContext,
     ) -> Result<ProviderStream, ProviderError> {
         let number = self.calls.fetch_add(1, Ordering::SeqCst);
+        if number == 1 && self.fail_first {
+            self.retry_started.notify_one();
+            self.retry_release.notified().await;
+            assert!(
+                context
+                    .excluded_accounts()
+                    .contains(&ProviderAccountId::new("acct_api_test").unwrap())
+            );
+        }
         let id = format!("resp_interrupt_{number}");
-        let control = context
-            .response_control()
-            .expect("root control propagated through Core")
-            .clone();
-        let active = control.activate(id.clone()).unwrap();
-        self.controls.lock().unwrap().push(control);
+        let transport = Arc::new(ControlTransport::new(id));
+        let owner: Arc<dyn ResponseControlTransport> = transport.clone();
+        context.response_control().unwrap().bind(&owner);
+        *self.transport.lock().unwrap() = Some(transport.clone());
         let candidate = request.candidate();
         let metadata = ProviderCallMetadata::new(
             candidate.provider().clone(),
             candidate.upstream_model().unwrap().clone(),
-            ProviderAccountId::new("acct_api_test").unwrap(),
+            ProviderAccountId::new(if self.fail_first && number > 0 {
+                "acct_api_retry"
+            } else {
+                "acct_api_test"
+            })
+            .unwrap(),
             UpstreamTransport::new("websocket").unwrap(),
         );
         let body = futures::stream::unfold(
-            (0, Some(active), id),
-            |(phase, mut active, id)| async move {
-                let (event_type, status, event) = match phase {
+            (0, transport, self),
+            |(phase, transport, provider)| async move {
+                let pending = if phase == 1 {
+                    provider.initial_messages.lock().unwrap().pop_front()
+                } else {
+                    None
+                };
+                if let Some(wire) = pending {
+                    return Some((Ok(ProviderEvent::wire(wire)), (phase, transport, provider)));
+                }
+                if phase == 1 && provider.fail_first && transport.id == "resp_interrupt_0" {
+                    provider.complete.notified().await;
+                    transport.active.store(false, Ordering::SeqCst);
+                    return Some((
+                        Err(ProviderError::new(
+                            gateway_core::error::ProviderErrorKind::QuotaExhausted,
+                            UpstreamSendState::Sent,
+                        )
+                        .with_replay_safe()),
+                        (2, transport, provider),
+                    ));
+                }
+                let (wire, events, next_phase) = match phase {
                     0 => (
-                        "response.created",
-                        "in_progress",
-                        GatewayEvent::Started(ResponseMeta::new(&id, "model-a")),
+                        json!({"type":"response.created","response":{"id":transport.id,"model":"model-a","status":"in_progress","output":[]}}),
+                        vec![GatewayEvent::Started(ResponseMeta::new(
+                            &transport.id,
+                            "model-a",
+                        ))],
+                        1,
                     ),
                     1 => {
-                        active.as_ref().unwrap().requested().await;
-                        drop(active.take());
-                        (
-                            "response.incomplete",
-                            "incomplete",
-                            GatewayEvent::Completed(ResponseMeta::new(&id, "model-a")),
-                        )
+                        let wire = tokio::select! {
+                            reply = transport.receive() => serde_json::from_str::<Value>(&reply.unwrap()).unwrap(),
+                            () = provider.complete.notified() => json!({"type":"response.completed","response":{"id":transport.id,"model":"model-a","status":"completed","output":[]}}),
+                        };
+                        if matches!(
+                            wire["type"].as_str(),
+                            Some("response.completed" | "response.incomplete")
+                        ) {
+                            transport.active.store(false, Ordering::SeqCst);
+                            (
+                                wire,
+                                vec![GatewayEvent::Completed(ResponseMeta::new(
+                                    &transport.id,
+                                    "model-a",
+                                ))],
+                                2,
+                            )
+                        } else {
+                            (wire, Vec::new(), 1)
+                        }
                     }
                     _ => return None,
                 };
-                let mut response = json!({"id":id,"model":"model-a","status":status,"output":[]});
-                if phase == 1 {
-                    response["incomplete_details"] = json!({"reason":"interrupted"});
-                }
-                let event = ProviderEvent::canonical_with_wire(
-                    vec![event],
-                    ProtocolWireEvent::json(
-                        "openai",
-                        Some(event_type.to_owned()),
-                        json!({
-                            "type":event_type, "response":response
-                        }),
-                    )
-                    .unwrap(),
+                let event_type = wire["type"].as_str().unwrap().to_owned();
+                let mut event = ProviderEvent::canonical_with_wire(
+                    events,
+                    ProtocolWireEvent::json("openai", Some(event_type), wire).unwrap(),
                 );
-                Some((Ok(event), (phase + 1, active, id)))
+                if phase == 0 && provider.fail_first {
+                    event = event.with_replayable_prelude();
+                }
+                Some((Ok(event), (next_phase, transport, provider)))
             },
         );
         Ok(ProviderStream::new(metadata, body, ()))
@@ -88,6 +190,8 @@ impl Provider for InterruptProvider {
 #[derive(Default)]
 struct InterruptAdmissions {
     active: AtomicUsize,
+    release_started: tokio::sync::Notify,
+    release_gate: Mutex<Option<tokio::sync::oneshot::Receiver<()>>>,
 }
 
 impl ClientAdmissionPort for InterruptAdmissions {
@@ -109,6 +213,11 @@ impl ClientAdmissionPort for InterruptAdmissions {
         _: &'a ModelRequestId,
     ) -> BoxFuture<'a, Result<bool, ClientAdmissionError>> {
         Box::pin(async {
+            let gate = self.release_gate.lock().unwrap().take();
+            self.release_started.notify_one();
+            if let Some(gate) = gate {
+                gate.await.unwrap();
+            }
             self.active.fetch_sub(1, Ordering::SeqCst);
             Ok(true)
         })
@@ -151,15 +260,24 @@ async fn next(socket: &mut TestSocket) -> Value {
     }
 }
 
-#[tokio::test]
-async fn interrupt_is_live_scoped_and_keeps_queued_creates_serial() {
-    let provider = Arc::new(InterruptProvider::default());
-    let admissions = Arc::new(InterruptAdmissions::default());
+async fn connect(
+    provider: Arc<InterruptProvider>,
+    admissions: Arc<InterruptAdmissions>,
+) -> (TestSocket, Server) {
     let execution = Arc::new(DefaultExecutionService::new(
-        RuntimeSnapshotHandle::new(snapshot("sk_ws_interrupt", "openai")),
+        RuntimeSnapshotHandle::new(if provider.fail_first {
+            crate::openai::snapshot_with_accounts(
+                "sk_ws_interrupt",
+                "openai",
+                "key_api_test",
+                &["acct_api_test", "acct_api_retry"],
+            )
+        } else {
+            snapshot("sk_ws_interrupt", "openai")
+        }),
         Arc::new(SettlementPorts::default()),
-        ProviderRegistry::new([provider.clone() as Arc<dyn Provider>]).unwrap(),
-        admissions.clone(),
+        ProviderRegistry::new([provider as Arc<dyn Provider>]).unwrap(),
+        admissions,
         Arc::new(UnusedContinuation),
         Arc::new(IgnoredClientApiKeyUsage),
         Arc::new(crate::support::RecordingDiagnostics::default()),
@@ -167,7 +285,7 @@ async fn interrupt_is_live_scoped_and_keeps_queued_creates_serial() {
     let app = api_router(execution).await;
     let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
     let address = listener.local_addr().unwrap();
-    let _server = Server(tokio::spawn(async move {
+    let server = Server(tokio::spawn(async move {
         axum::serve(listener, app).await.unwrap()
     }));
     let mut request = format!("ws://{address}/v1/responses")
@@ -177,29 +295,136 @@ async fn interrupt_is_live_scoped_and_keeps_queued_creates_serial() {
         AUTHORIZATION,
         HeaderValue::from_static("Bearer sk_ws_interrupt"),
     );
-    let (mut socket, _) = connect_async(request).await.unwrap();
+    let (socket, _) = connect_async(request).await.unwrap();
+    (socket, server)
+}
+
+fn upstream_control_error() -> Value {
+    json!({"type":"error", "status":400, "error":{"type":"invalid_request_error","code":"future_rejected","message":"Synthetic upstream rejection","param":"type"},"vendor_extension":true})
+}
+
+fn interrupt(id: &str, mode: &str) -> Value {
+    json!({"type":"response.interrupt","response_id":id,"mode":mode,"future_extension":true})
+}
+
+#[tokio::test]
+async fn late_interrupt_after_terminal_is_sent_upstream_and_keeps_the_connection_reusable() {
+    let provider = Arc::new(InterruptProvider::default());
+    let admissions = Arc::new(InterruptAdmissions::default());
+    let (mut socket, _server) = connect(provider.clone(), admissions.clone()).await;
+    let create = json!({"type":"response.create","model":"model-a","input":"hello"});
+    for (number, terminal) in [(0, "response.completed"), (1, "response.incomplete")] {
+        let id = format!("resp_interrupt_{number}");
+        send(&mut socket, create.clone()).await;
+        assert_eq!(next(&mut socket).await["type"], "response.created");
+        if number == 0 {
+            provider.complete.notify_one();
+        } else {
+            send(&mut socket, interrupt(&id, "discard_partial_items")).await;
+        }
+        assert_eq!(next(&mut socket).await["type"], terminal);
+        tokio::time::timeout(Duration::from_secs(5), async {
+            while admissions.active.load(Ordering::SeqCst) != 0 {
+                tokio::task::yield_now().await;
+            }
+        })
+        .await
+        .unwrap();
+        for control in [
+            interrupt(&id, "discard_partial_items"),
+            interrupt(&id, "future_mode"),
+            json!({"type":"future.control","extra":[1,2]}),
+        ] {
+            send(&mut socket, control.clone()).await;
+            assert_eq!(
+                next(&mut socket).await,
+                json!({"type":"future.control.ack","original":control})
+            );
+        }
+        send(&mut socket, json!({"type":"future.reject"})).await;
+        assert_eq!(next(&mut socket).await, upstream_control_error());
+        assert_eq!(provider.calls.load(Ordering::SeqCst), number + 1);
+        assert_eq!(admissions.active.load(Ordering::SeqCst), 0);
+    }
+    socket.close(None).await.unwrap();
+}
+
+#[tokio::test]
+async fn late_interrupt_during_terminal_settlement_does_not_abort_or_reorder_requests() {
+    let provider = Arc::new(InterruptProvider::default());
+    let (release, wait_for_release) = tokio::sync::oneshot::channel();
+    let admissions = Arc::new(InterruptAdmissions {
+        release_gate: Mutex::new(Some(wait_for_release)),
+        ..Default::default()
+    });
+    let (mut socket, _server) = connect(provider.clone(), admissions.clone()).await;
     let create = json!({"type":"response.create","model":"model-a","input":"hello"});
-    let interrupt =
-        |id: &str, mode: &str| json!({"type":"response.interrupt","response_id":id,"mode":mode});
-    send(
-        &mut socket,
-        interrupt("resp_interrupt_0", "discard_partial_items"),
-    )
-    .await;
-    assert_eq!(next(&mut socket).await["type"], "error");
-    assert_eq!(provider.calls.load(Ordering::SeqCst), 0);
     send(&mut socket, create.clone()).await;
     assert_eq!(next(&mut socket).await["type"], "response.created");
+    provider.complete.notify_one();
+    assert_eq!(next(&mut socket).await["type"], "response.completed");
+    tokio::time::timeout(
+        Duration::from_secs(5),
+        admissions.release_started.notified(),
+    )
+    .await
+    .unwrap();
     send(&mut socket, create).await;
-    for invalid in [
-        interrupt("resp_other", "discard_partial_items"),
-        interrupt("resp_interrupt_0", "unknown"),
-        interrupt("", "discard_partial_items"),
+    let late = interrupt("resp_interrupt_0", "discard_partial_items");
+    send(&mut socket, late.clone()).await;
+    assert_eq!(
+        next(&mut socket).await,
+        json!({"type":"future.control.ack", "original":late})
+    );
+    assert_eq!(provider.calls.load(Ordering::SeqCst), 1);
+    assert_eq!(admissions.active.load(Ordering::SeqCst), 1);
+    release.send(()).unwrap();
+    assert_eq!(
+        next(&mut socket).await["response"]["id"],
+        "resp_interrupt_1"
+    );
+    socket.close(None).await.unwrap();
+}
+
+#[tokio::test]
+async fn unknown_controls_preserve_bytes_and_do_not_admit_queued_creates() {
+    let provider = Arc::new(InterruptProvider::default());
+    let admissions = Arc::new(InterruptAdmissions::default());
+    let (mut socket, _server) = connect(provider.clone(), admissions.clone()).await;
+    let create = json!({"type":"response.create","model":"model-a","input":"hello"});
+    send(&mut socket, json!({"type":"future.control"})).await;
+    let error = next(&mut socket).await;
+    assert_eq!(error["type"], "error");
+    assert_ne!(error["error"]["param"], "type");
+    assert_eq!(provider.calls.load(Ordering::SeqCst), 0);
+    send(&mut socket, create).await;
+    assert_eq!(next(&mut socket).await["type"], "response.created");
+    // 重复 type 仍是创建请求，不能借投影解码失败绕过串行准入
+    socket.send(ClientMessage::Text(r#"{"type":"response.create","type":"response.create","model":"model-a","input":"next"}"#.into())).await.unwrap();
+    for raw in [
+        r#"{ "type": "future.control", "mode": "unknown", "extension": [1, 2] }"#,
+        r#"{"extension":"no local type contract"}"#,
+        r#"{"type":42,"extension":true}"#,
+        "not-json",
     ] {
-        send(&mut socket, invalid).await;
-        let error = next(&mut socket).await;
-        assert_eq!(error["type"], "error");
-        assert_eq!(error["status"], 400);
+        socket.send(ClientMessage::Text(raw.into())).await.unwrap();
+        let expected =
+            serde_json::from_str::<Value>(raw).unwrap_or_else(|_| Value::String(raw.to_owned()));
+        assert_eq!(next(&mut socket).await["original"], expected);
+        assert_eq!(
+            provider
+                .transport
+                .lock()
+                .unwrap()
+                .as_ref()
+                .unwrap()
+                .requests
+                .lock()
+                .unwrap()
+                .last()
+                .unwrap(),
+            raw
+        );
         assert_eq!(provider.calls.load(Ordering::SeqCst), 1);
     }
     send(
@@ -207,27 +432,12 @@ async fn interrupt_is_live_scoped_and_keeps_queued_creates_serial() {
         interrupt("resp_interrupt_0", "discard_partial_items"),
     )
     .await;
-    let terminal = next(&mut socket).await;
-    assert_eq!(terminal["type"], "response.incomplete");
-    assert_eq!(
-        terminal["response"]["incomplete_details"]["reason"],
-        "interrupted"
-    );
+    assert_eq!(next(&mut socket).await["type"], "response.incomplete");
     assert_eq!(
         next(&mut socket).await["response"]["id"],
         "resp_interrupt_1"
     );
     assert_eq!(provider.calls.load(Ordering::SeqCst), 2);
-    send(
-        &mut socket,
-        interrupt("resp_interrupt_0", "discard_partial_items"),
-    )
-    .await;
-    assert_eq!(next(&mut socket).await["type"], "error");
-    assert_eq!(
-        provider.controls.lock().unwrap()[0].interrupt("resp_interrupt_0"),
-        Err(ResponseInterruptError::Unavailable)
-    );
     socket.close(None).await.unwrap();
     tokio::time::timeout(Duration::from_secs(5), async {
         while admissions.active.load(Ordering::SeqCst) != 0 {
@@ -236,8 +446,145 @@ async fn interrupt_is_live_scoped_and_keeps_queued_creates_serial() {
     })
     .await
     .expect("disconnect releases active execution");
-    assert_eq!(
-        provider.controls.lock().unwrap()[1].interrupt("resp_interrupt_1"),
-        Err(ResponseInterruptError::Unavailable)
-    );
+}
+
+#[tokio::test]
+async fn active_websocket_delivery_preserves_unparsed_messages_and_business_metadata() {
+    let messages = vec![
+        "{ \"type\": \"future.event\", \"number\": 1e3, \"escaped\": \"\\u0061\" }\r\n".to_owned(),
+        r#"{"type":"response.metadata","metadata":{"type":"safety_buffering","use_cases":["cyber"],"reasons":["user_risk"],"future":{"keep":true}}}"#.to_owned(),
+        format!("{{\"type\":\"future.deep\",\"extension\":{}0{}}}", "[".repeat(140), "]".repeat(140)),
+        "future non-JSON text".to_owned(), "[DONE]".to_owned(),
+    ];
+    let provider = Arc::new(InterruptProvider::default());
+    *provider.initial_messages.lock().unwrap() = messages
+        .iter()
+        .map(|raw| match serde_json::from_str::<Value>(raw) {
+            Ok(value) => ProtocolWireEvent::json(
+                "openai",
+                value.get("type").and_then(Value::as_str).map(str::to_owned),
+                value,
+            )
+            .unwrap()
+            .with_raw_websocket_message(raw.as_str()),
+            Err(_) => ProtocolWireEvent::raw_websocket("openai", raw.as_str()).unwrap(),
+        })
+        .collect();
+    let (mut socket, _server) =
+        connect(provider.clone(), Arc::new(InterruptAdmissions::default())).await;
+    send(
+        &mut socket,
+        json!({"type":"response.create","model":"model-a","input":"synthetic"}),
+    )
+    .await;
+    assert_eq!(next(&mut socket).await["type"], "response.created");
+    for expected in &messages {
+        let actual = tokio::time::timeout(Duration::from_secs(5), socket.next())
+            .await
+            .unwrap()
+            .unwrap()
+            .unwrap();
+        assert_eq!(actual.to_text().unwrap(), expected);
+    }
+    provider.complete.notify_one();
+    assert_eq!(next(&mut socket).await["type"], "response.completed");
+}
+
+#[tokio::test]
+async fn prelude_retry_retains_interrupt_during_account_switch() {
+    for interrupt_before_new_created in [true, false] {
+        let provider = Arc::new(InterruptProvider {
+            fail_first: true,
+            ..Default::default()
+        });
+        let admissions = Arc::new(InterruptAdmissions::default());
+        let (mut socket, _server) = connect(provider.clone(), admissions.clone()).await;
+        send(
+            &mut socket,
+            json!({"type":"response.create","model":"model-a","input":"hello"}),
+        )
+        .await;
+        assert_eq!(
+            next(&mut socket).await["response"]["id"],
+            "resp_interrupt_0"
+        );
+        let old = provider.transport.lock().unwrap().clone().unwrap();
+        provider.complete.notify_one();
+        tokio::time::timeout(Duration::from_secs(5), provider.retry_started.notified())
+            .await
+            .unwrap();
+        if interrupt_before_new_created {
+            send(
+                &mut socket,
+                interrupt("resp_interrupt_0", "discard_partial_items"),
+            )
+            .await;
+            // 等待服务端处理控制帧，随后才允许新 attempt 建立连接
+            tokio::time::timeout(Duration::from_secs(5), async {
+                while old.requests.lock().unwrap().is_empty() {
+                    tokio::task::yield_now().await;
+                }
+            })
+            .await
+            .unwrap();
+        }
+        provider.retry_release.notify_one();
+        assert_eq!(
+            next(&mut socket).await["response"]["id"],
+            "resp_interrupt_1"
+        );
+        if !interrupt_before_new_created {
+            // 迟到的旧 ID 也应作用于当前逻辑响应
+            send(
+                &mut socket,
+                interrupt("resp_interrupt_0", "discard_partial_items"),
+            )
+            .await;
+        }
+        let terminal = next(&mut socket).await;
+        assert_eq!(terminal["type"], "response.incomplete");
+        assert_eq!(terminal["response"]["id"], "resp_interrupt_1");
+        let current = provider.transport.lock().unwrap().clone().unwrap();
+        let requests = current.requests.lock().unwrap().clone();
+        assert_eq!(requests.len(), 1);
+        assert_eq!(
+            serde_json::from_str::<Value>(&requests[0]).unwrap(),
+            interrupt("resp_interrupt_1", "discard_partial_items")
+        );
+        assert_eq!(provider.calls.load(Ordering::SeqCst), 2);
+        socket.close(None).await.unwrap();
+    }
+}
+
+#[tokio::test]
+async fn non_replayable_delivery_blocks_retry_even_after_a_replayable_prelude() {
+    for event in [
+        json!({"type":"response.output_text.delta","delta":"visible","output_index":0,"content_index":0}),
+        json!({"type":"response.future_progress","marker":"preserved"}),
+    ] {
+        let provider = Arc::new(InterruptProvider {
+            fail_first: true,
+            ..Default::default()
+        });
+        provider.initial_messages.lock().unwrap().push_back(
+            ProtocolWireEvent::json(
+                "openai",
+                Some(event["type"].as_str().unwrap().to_owned()),
+                event.clone(),
+            )
+            .unwrap(),
+        );
+        let (mut socket, _server) = connect(provider.clone(), Arc::default()).await;
+        send(
+            &mut socket,
+            json!({"type":"response.create","model":"model-a","input":"hello"}),
+        )
+        .await;
+        assert_eq!(next(&mut socket).await["type"], "response.created");
+        assert_eq!(next(&mut socket).await, event);
+        provider.complete.notify_one();
+        assert_eq!(next(&mut socket).await["type"], "error");
+        assert_eq!(provider.calls.load(Ordering::SeqCst), 1);
+        socket.close(None).await.unwrap();
+    }
 }

backend/crates/gateway-api/tests/openai/search/mod.rs

@@ -7,6 +7,7 @@ use axum::{
     body::{Body, to_bytes},
     http::{Request, StatusCode, header::AUTHORIZATION},
 };
+use base64::{Engine as _, engine::general_purpose::STANDARD};
 use bytes::Bytes;
 use futures::future::BoxFuture;
 use gateway_core::engine::ModelRequestId;
@@ -181,6 +182,11 @@ async fn search_route_should_preserve_request_and_success_response_bytes() {
                 .header("x-codex-turn-metadata", turn_metadata)
                 .header("session-id", "root-session")
                 .header("thread-id", "child-thread")
+                .header("x-future-business", "first")
+                .header("x-future-business", "second")
+                .header("cookie", "client-secret")
+                .header("connection", "x-private-hop")
+                .header("x-private-hop", "client-hop")
                 .body(Body::from(request_body.to_vec()))
                 .expect("search request"),
         )
@@ -213,8 +219,37 @@ async fn search_route_should_preserve_request_and_success_response_bytes() {
     assert_eq!(captured[0].endpoint, "/v1/alpha/search");
     assert_eq!(captured[0].transport, ClientTransport::HttpJson);
     assert_eq!(captured[0].body.as_ref(), request_body);
+    let mut context = captured[0].context.clone();
+    let headers = context
+        .as_object_mut()
+        .unwrap()
+        .remove("opaque_request_headers")
+        .unwrap();
+    let headers: Vec<_> = headers
+        .as_array()
+        .unwrap()
+        .iter()
+        .map(|entry| {
+            (
+                entry[0].as_str().unwrap(),
+                STANDARD.decode(entry[1].as_str().unwrap()).unwrap(),
+            )
+        })
+        .collect();
     assert_eq!(
-        captured[0].context,
+        headers
+            .iter()
+            .filter(|(name, _)| *name == "x-future-business")
+            .map(|(_, value)| value.as_slice())
+            .collect::<Vec<_>>(),
+        [b"first".as_slice(), b"second".as_slice()]
+    );
+    assert!(!headers.iter().any(|(name, _)| matches!(
+        *name,
+        "authorization" | "cookie" | "connection" | "x-private-hop"
+    )));
+    assert_eq!(
+        context,
         json!({"turn_metadata": turn_metadata, "session_id": "root-session", "thread_id": "child-thread"})
     );
     assert_eq!(

backend/crates/gateway-core/src/account/model.rs

@@ -750,12 +750,40 @@ const fn status_projection(status: AccountStatus) -> AccountStatusProjection {
     }
 }
 
+/// 选中账号时冻结的历史展示事实，不包含凭据与运行状态
+#[derive(Debug, Clone, PartialEq, Eq, serde::Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct AccountHistorySnapshot {
+    pub name: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub email: Option<String>,
+    pub authentication_kind: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub plan_type_snapshot: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub notes_snapshot: Option<String>,
+}
+
+impl AccountHistorySnapshot {
+    #[must_use]
+    pub fn from_account(account: &crate::account::ProviderAccount) -> Self {
+        Self {
+            name: account.name().to_owned(),
+            email: account.email().map(str::to_owned),
+            authentication_kind: account.authentication_kind().to_owned(),
+            plan_type_snapshot: account.plan_type().map(str::to_owned),
+            notes_snapshot: account.notes().map(str::to_owned),
+        }
+    }
+}
+
 /// 账号持久事实；代理认证信息只通过显式 secret accessor 读取
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct ProviderAccount {
     id: ProviderAccountId,
     provider: ProviderKind,
     name: String,
+    notes: Option<String>,
     email: Option<String>,
     upstream_user_id: Option<String>,
     upstream_account_id: Option<String>,
@@ -793,6 +821,7 @@ impl ProviderAccount {
             id,
             provider,
             name,
+            notes: None,
             email: None,
             upstream_user_id,
             upstream_account_id: None,
@@ -815,6 +844,17 @@ impl ProviderAccount {
         }
     }
 
+    #[must_use]
+    pub fn with_notes(mut self, notes: Option<String>) -> Self {
+        self.notes = notes;
+        self
+    }
+
+    #[must_use]
+    pub fn notes(&self) -> Option<&str> {
+        self.notes.as_deref()
+    }
+
     #[must_use]
     pub fn with_profile(
         mut self,

backend/crates/gateway-core/src/diagnostics/failure.rs

@@ -18,6 +18,7 @@ pub struct OperationalFailure {
     pub correlation_id: Option<String>,
     pub provider_kind: Option<ProviderKind>,
     pub account_id: Option<ProviderAccountId>,
+    pub account_snapshot: Option<crate::account::AccountHistorySnapshot>,
     pub upstream_status: Option<u16>,
     pub upstream_code: Option<OpaqueUpstreamValue>,
     pub details: Option<ErrorDetails>,
@@ -40,6 +41,7 @@ impl OperationalFailure {
             correlation_id: None,
             provider_kind: None,
             account_id: None,
+            account_snapshot: None,
             upstream_status: None,
             upstream_code: None,
             details: None,

backend/crates/gateway-core/src/engine/coordinator.rs

@@ -346,6 +346,7 @@ where
             current: None,
             send_state_watermark: UpstreamSendState::NotSent,
             downstream_committed_at: None,
+            replay_barrier_reached: false,
             client_status_code: None,
             delivery_pending: false,
             upstream_complete: false,
@@ -483,6 +484,8 @@ pub struct ResponseExecutionSession<S: ?Sized> {
     /// 请求级发送状态水位；跨 attempt 单调不降，终态写回不得低于此档
     send_state_watermark: UpstreamSendState,
     downstream_committed_at: Option<SystemTime>,
+    /// 已交付的实际输出禁止重放，可替换前导事件不跨越此屏障
+    replay_barrier_reached: bool,
     client_status_code: Option<u16>,
     delivery_pending: bool,
     upstream_complete: bool,
@@ -548,6 +551,10 @@ where
         loop {
             match self.pull().await? {
                 PullOutcome::Events(events) => {
+                    self.replay_barrier_reached |= self.middleware.is_some()
+                        || self.client_transport != super::execution::ClientTransport::WebSocket
+                        || self.response_control.is_none()
+                        || events.iter().any(|event| !event.is_replayable_prelude());
                     let requirement = if self.downstream_committed_at.is_some() {
                         CommitRequirement::AlreadyCommitted
                     } else {
@@ -568,6 +575,7 @@ where
                         self.delivery_pending = true;
                         CommitRequirement::CommitBeforeDelivery
                     };
+                    self.replay_barrier_reached = true;
                     self.pending_terminal_failure =
                         Some(PendingTerminalFailure { error, send_state });
                     return CoordinatedEvent::try_batch(events, requirement).map(Some);
@@ -668,6 +676,7 @@ where
             return Err(EngineError::InvalidDeliveryState);
         }
         self.delivery_pending = false;
+        self.replay_barrier_reached = false;
         Ok(())
     }
 
@@ -1045,6 +1054,7 @@ where
                 .with_fast_mode(self.plan.fast_mode())
                 .with_pricing(self.plan.pricing())
                 .with_request_location(self.plan.request_location().cloned())
+                .with_privacy(self.plan.privacy())
                 .with_concurrency_wait_budget(self.concurrency_wait_budget.clone())
                 .with_connection_budget(self.connection_budget.clone())
                 .with_timing_started_at(self.observation.timing_started_at)
@@ -1315,11 +1325,11 @@ where
             ));
         }
         let attempt_record = AttemptRecord {
+            account_snapshot: metadata.account_snapshot().cloned(),
             request_id: self.request_id.clone(),
             attempt_count: next_attempt,
             trigger,
             provider_kind: metadata.provider().clone(),
-            provider_account_id: Some(metadata.provider_account_id().clone()),
             provider_account_ref: Some(metadata.provider_account_id().clone()),
             upstream_model_id: metadata.upstream_model().cloned(),
             upstream_transport: metadata.transport().as_str().to_owned(),
@@ -1496,7 +1506,7 @@ where
         let account_rotation_retry = !execution_effect_observed
             && self.account_selection.required_account().is_none()
             && self.continuation_attempt == ContinuationAttempt::None
-            && self.downstream_committed_at.is_none()
+            && !self.replay_barrier_reached
             && !self.delivery_pending
             && attempt_send_state != UpstreamSendState::Ambiguous
             && matches!(
@@ -1510,11 +1520,13 @@ where
                 error.pre_delivery_retry(),
                 Some(crate::error::PreDeliveryRetry::SameAccountConnectionRetry { .. })
             );
+        // Provider 的有界同账号传输恢复是尽力重试策略，不要求把 Sent/Ambiguous
+        // 改写成安全证明；外部副作用、取消、预算与下游提交仍由 Core 拦截
         let transport_recovery = match error.pre_delivery_retry() {
             Some(crate::error::PreDeliveryRetry::SameAccountConnectionRetry { transport })
                 if !execution_effect_observed
                     && !self.connection_budget.exhausted()
-                    && self.downstream_committed_at.is_none()
+                    && !self.replay_barrier_reached
                     && !self.delivery_pending
                     && attempt_send_state == UpstreamSendState::NotSent
                     && self.current_send_state() == UpstreamSendState::NotSent
@@ -1532,18 +1544,16 @@ where
                 delay,
             }) if !execution_effect_observed
                 && !self.connection_budget.exhausted()
-                && self.downstream_committed_at.is_none()
-                && !self.delivery_pending
-                && attempt_send_state != UpstreamSendState::Ambiguous =>
+                && !self.replay_barrier_reached
+                && !self.delivery_pending =>
             {
                 Some((AttemptTransport::Retry(retry_index), delay))
             }
             Some(crate::error::PreDeliveryRetry::SameAccountTransportFallback)
                 if !execution_effect_observed
                     && !self.connection_budget.exhausted()
-                    && self.downstream_committed_at.is_none()
-                    && !self.delivery_pending
-                    && attempt_send_state != UpstreamSendState::Ambiguous =>
+                    && !self.replay_barrier_reached
+                    && !self.delivery_pending =>
             {
                 Some((
                     AttemptTransport::Fallback,
@@ -1557,7 +1567,7 @@ where
             && !execution_effect_observed
             && self.account_selection.required_account().is_none()
             && self.continuation_attempt == ContinuationAttempt::None
-            && self.downstream_committed_at.is_none()
+            && !self.replay_barrier_reached
             && !self.delivery_pending
             && attempt_send_state != UpstreamSendState::Ambiguous
             && provider_proved_replay_safe
@@ -1589,7 +1599,7 @@ where
         let same_account_retry = !execution_effect_observed
             && error.retries_same_account()
             && provider_proved_replay_safe
-            && self.downstream_committed_at.is_none()
+            && !self.replay_barrier_reached
             && !self.delivery_pending
             && attempt_send_state != UpstreamSendState::Ambiguous
             && self.routing_attempts < self.plan.max_attempts().get()
@@ -1655,6 +1665,7 @@ where
             "executionEffectObserved": execution_effect_observed,
             "delayMs": transient_retry.or(transport_recovery.map(|(_, delay)| delay)).map(duration_ms),
             "downstreamCommitted": self.downstream_committed_at.is_some(),
+            "replayBarrierReached": self.replay_barrier_reached,
             "sendState": format!("{attempt_send_state:?}"),
         }));
         if retryable {
@@ -1700,6 +1711,7 @@ where
                     self.engine
                         .store()
                         .record_intermediate_failure(IntermediateFailure {
+                            account_snapshot: current.metadata.account_snapshot().cloned(),
                             request_id: self.request_id.clone(),
                             attempt_index: current.index,
                             trigger: current.trigger,
@@ -1812,7 +1824,7 @@ where
     ) -> bool {
         if self.account_selection.required_account().is_some()
             || self.continuation_attempt == ContinuationAttempt::None
-            || self.downstream_committed_at.is_some()
+            || self.replay_barrier_reached
             || self.delivery_pending
             || send_state == UpstreamSendState::Ambiguous
             || !provider_proved_replay_safe

backend/crates/gateway-core/src/engine/execution/service.rs

@@ -807,7 +807,7 @@ impl DefaultExecutionService {
         }
         let new_request = NewModelRequest {
             id: request_id.clone(),
-            client_api_key_id: Some(client.policy.key_id().clone()),
+            client_api_key_name_snapshot: client.policy.name_snapshot().map(str::to_owned),
             client_api_key_ref: client.policy.key_id().clone(),
             config_revision: plan.config_revision(),
             routing: authorization.account_scope.routing_snapshot(),
@@ -1347,7 +1347,7 @@ impl DefaultExecutionService {
             .map_err(|_| GatewayError::new(GatewayErrorKind::Internal, "invalid admin actor"))?;
         let new_request = NewModelRequest {
             id: request_id,
-            client_api_key_id: None,
+            client_api_key_name_snapshot: None,
             client_api_key_ref: actor,
             config_revision: plan.config_revision(),
             routing: crate::routing::AccountRoutingSnapshot::all(),

backend/crates/gateway-core/src/engine/mod.rs

@@ -287,6 +287,7 @@ pub struct RequestAttemptContext {
     request_profile: Option<crate::account::OpaqueProviderData>,
     fast_mode: FastMode,
     request_location: Option<crate::account::RequestLocation>,
+    privacy: Option<Arc<dyn crate::settings::privacy::CompiledPrivacyPolicy>>,
     request_id: ModelRequestId,
     client_api_key_ref: ClientApiKeyId,
     timing_started_at: Instant,
@@ -350,6 +351,15 @@ impl RequestAttemptContext {
         self
     }
 
+    #[must_use]
+    pub fn with_privacy(
+        mut self,
+        privacy: Option<Arc<dyn crate::settings::privacy::CompiledPrivacyPolicy>>,
+    ) -> Self {
+        self.privacy = privacy;
+        self
+    }
+
     #[must_use]
     pub fn with_request_location(
         mut self,
@@ -369,6 +379,7 @@ impl RequestAttemptContext {
             pricing: Arc::default(),
             fast_mode: FastMode::Default,
             request_location: None,
+            privacy: None,
             timing_started_at: Instant::now(),
             trace: crate::diagnostics::TraceContext::default(),
             concurrency_wait_budget: crate::concurrency::ConcurrencyWaitBudget::default(),
@@ -548,6 +559,14 @@ impl AttemptContext {
         self.request.client_transport
     }
 
+    /// 原生双向通道可提前交付可替换前导事件；中间件可能改变其输出语义
+    #[must_use]
+    pub fn allows_replayable_prelude(&self) -> bool {
+        self.client_transport() == execution::ClientTransport::WebSocket
+            && self.request.middleware.is_none()
+            && self.response_control().is_some()
+    }
+
     #[must_use]
     pub fn response_control(&self) -> Option<&response_control::ResponseControl> {
         self.request.response_control.as_ref()
@@ -569,6 +588,11 @@ impl AttemptContext {
         self.request.fast_mode
     }
 
+    #[must_use]
+    pub fn privacy(&self) -> Option<Arc<dyn crate::settings::privacy::CompiledPrivacyPolicy>> {
+        self.request.privacy.clone()
+    }
+
     #[must_use]
     pub const fn request_location(&self) -> Option<&crate::account::RequestLocation> {
         self.request.request_location.as_ref()
@@ -799,8 +823,8 @@ impl AttemptContext {
 /// 创建唯一 `model_requests` 行所需的入口事实
 #[derive(Debug, Clone)]
 pub struct NewModelRequest {
+    pub client_api_key_name_snapshot: Option<String>,
     pub id: ModelRequestId,
-    pub client_api_key_id: Option<ClientApiKeyId>,
     pub client_api_key_ref: ClientApiKeyId,
     pub config_revision: ConfigRevision,
     pub routing: crate::routing::AccountRoutingSnapshot,
@@ -828,11 +852,11 @@ pub struct NewModelRequest {
 /// 每次真实上游发送前对同一 `model_requests` 行的更新
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct AttemptRecord {
+    pub account_snapshot: Option<crate::account::AccountHistorySnapshot>,
     pub request_id: ModelRequestId,
     pub attempt_count: NonZeroU32,
     pub trigger: AttemptTrigger,
     pub provider_kind: ProviderKind,
-    pub provider_account_id: Option<ProviderAccountId>,
     pub provider_account_ref: Option<ProviderAccountId>,
     pub upstream_model_id: Option<UpstreamModelId>,
     pub upstream_transport: String,
@@ -847,6 +871,7 @@ pub struct AttemptRecord {
 /// 需要解释换号的中间失败
 #[derive(Debug)]
 pub struct IntermediateFailure {
+    pub account_snapshot: Option<crate::account::AccountHistorySnapshot>,
     pub request_id: ModelRequestId,
     pub attempt_index: NonZeroU32,
     pub trigger: AttemptTrigger,

backend/crates/gateway-core/src/engine/provider.rs

@@ -13,7 +13,8 @@ use futures::{Stream, StreamExt, future::BoxFuture};
 use thiserror::Error;
 
 use crate::account::{
-    AccountAttemptFeedback, AccountCapacitySnapshot, AccountFeedbackStats, ProviderAccountId,
+    AccountAttemptFeedback, AccountCapacitySnapshot, AccountFeedbackStats, AccountHistorySnapshot,
+    ProviderAccountId,
 };
 use crate::engine::AttemptContext;
 use crate::engine::execution::ClientTransport;
@@ -39,7 +40,7 @@ use crate::upstream::{UpstreamSendState, UpstreamTransport};
 pub type EventStream =
     Pin<Box<dyn Stream<Item = Result<ProviderEvent, ProviderError>> + Send + 'static>>;
 
-/// Provider 选定单个 credential 后返回的事实
+/// Provider 选定单个 credential 后返回的调用事实
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct ProviderCallMetadata {
     provider: ProviderKind,
@@ -48,6 +49,7 @@ pub struct ProviderCallMetadata {
     upstream_request_id: Option<OpaqueUpstreamValue>,
     transport: UpstreamTransport,
     selection_observation: Option<ProviderSelectionObservation>,
+    account_snapshot: Option<AccountHistorySnapshot>,
 }
 
 /// Provider 账号选择阶段输出的中立运行压力事实
@@ -96,6 +98,7 @@ impl ProviderCallMetadata {
             upstream_request_id: None,
             transport,
             selection_observation: None,
+            account_snapshot: None,
         }
     }
 
@@ -113,9 +116,21 @@ impl ProviderCallMetadata {
             upstream_request_id: None,
             transport,
             selection_observation: None,
+            account_snapshot: None,
         }
     }
 
+    #[must_use]
+    pub fn with_account_snapshot(mut self, snapshot: Option<AccountHistorySnapshot>) -> Self {
+        self.account_snapshot = snapshot;
+        self
+    }
+
+    #[must_use]
+    pub const fn account_snapshot(&self) -> Option<&AccountHistorySnapshot> {
+        self.account_snapshot.as_ref()
+    }
+
     /// 设置 adapter 已分类为非 bearer 的 request ID
     #[must_use]
     pub fn with_upstream_request_id(mut self, request_id: OpaqueUpstreamValue) -> Self {
@@ -605,10 +620,15 @@ fn provider_event_to_middleware_frame(
         ClientTransport::WebSocket
         | ClientTransport::InternalProbe
         | ClientTransport::InternalPlugin => (
-            serde_json::to_vec(wire.data())
-                .map(Bytes::from)
+            wire.raw_websocket_message()
+                .map(|raw| Bytes::copy_from_slice(raw.as_bytes()))
+                .map_or_else(|| serde_json::to_vec(wire.data()).map(Bytes::from), Ok)
                 .map_err(|_| middleware_protocol_error(UpstreamSendState::Sent))?,
-            MiddlewareFraming::JsonDocument,
+            if wire.raw_websocket_message().is_some() && !wire.has_json_data() {
+                MiddlewareFraming::RawBytes
+            } else {
+                MiddlewareFraming::JsonDocument
+            },
         ),
     };
     Ok(MiddlewareFrame::from_provider_event(
@@ -631,10 +651,19 @@ fn encode_sse_wire_event(wire: &ProtocolWireEvent) -> Result<Bytes, ProviderErro
         encoded.extend_from_slice(event_type.as_bytes());
         encoded.push(b'\n');
     }
-    encoded.extend_from_slice(b"data: ");
-    serde_json::to_writer(&mut encoded, wire.data())
-        .map_err(|_| middleware_protocol_error(UpstreamSendState::Sent))?;
-    encoded.extend_from_slice(b"\n\n");
+    if let Some(raw) = wire.raw_websocket_message() {
+        for line in raw.split('\n') {
+            encoded.extend_from_slice(b"data: ");
+            encoded.extend_from_slice(line.as_bytes());
+            encoded.push(b'\n');
+        }
+        encoded.push(b'\n');
+    } else {
+        encoded.extend_from_slice(b"data: ");
+        serde_json::to_writer(&mut encoded, wire.data())
+            .map_err(|_| middleware_protocol_error(UpstreamSendState::Sent))?;
+        encoded.extend_from_slice(b"\n\n");
+    }
     Ok(Bytes::from(encoded))
 }
 
@@ -701,12 +730,19 @@ fn middleware_frame_to_provider_event(
                 .raw_json_body()
                 .or_else(|| wire.raw_http_body_bytes())
                 .cloned()
+                .or_else(|| {
+                    wire.raw_websocket_message()
+                        .map(|raw| Bytes::copy_from_slice(raw.as_bytes()))
+                })
                 .or_else(|| serde_json::to_vec(wire.data()).ok().map(Bytes::from)),
             MiddlewareFraming::SseEvent => wire
                 .raw_sse_frame()
                 .cloned()
                 .or_else(|| encode_sse_wire_event(wire).ok()),
-            MiddlewareFraming::RawBytes => wire.raw_http_body_bytes().cloned(),
+            MiddlewareFraming::RawBytes => wire.raw_http_body_bytes().cloned().or_else(|| {
+                wire.raw_websocket_message()
+                    .map(|raw| Bytes::copy_from_slice(raw.as_bytes()))
+            }),
         };
         if original.as_ref() == Some(&bytes)
             && let Some(mut event) = envelope.take()
@@ -944,6 +980,20 @@ impl fmt::Debug for ProviderRequest {
 /// 新的 attempt 再次调用
 #[async_trait]
 pub trait Provider: Send + Sync {
+    /// Provider 解释自己的隐私规则，Core 仅冻结编译结果
+    fn compile_privacy_policy(
+        &self,
+        _policy: &crate::settings::privacy::CodexPrivacyPolicy,
+    ) -> Result<
+        Arc<dyn crate::settings::privacy::CompiledPrivacyPolicy>,
+        crate::settings::privacy::PrivacyError,
+    > {
+        Err(crate::settings::privacy::PrivacyError {
+            rule_index: 0,
+            reason: "Provider 不支持隐私策略",
+        })
+    }
+
     /// 从已冻结的配置解析请求身份；只读取本地发布资料，不执行网络请求
     fn resolve_request_profile(
         &self,
@@ -1176,3 +1226,31 @@ impl ProviderCatalogPort for ProviderRegistry {
         })
     }
 }
+
+impl std::fmt::Debug for ProviderRegistry {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("ProviderRegistry")
+            .field("providers", &self.providers.keys())
+            .finish()
+    }
+}
+
+impl crate::settings::privacy::PrivacyPolicyCompiler for ProviderRegistry {
+    fn compile(
+        &self,
+        policy: &crate::settings::privacy::CodexPrivacyPolicy,
+    ) -> Result<
+        Arc<dyn crate::settings::privacy::CompiledPrivacyPolicy>,
+        crate::settings::privacy::PrivacyError,
+    > {
+        self.providers
+            .iter()
+            .find(|(kind, _)| kind.as_str() == "openai")
+            .ok_or(crate::settings::privacy::PrivacyError {
+                rule_index: 0,
+                reason: "OpenAI Provider 不可用",
+            })?
+            .1
+            .compile_privacy_policy(policy)
+    }
+}

backend/crates/gateway-core/src/engine/response_control.rs

@@ -1,14 +1,46 @@
-//! 当前执行的响应中断信号；只由持有活动响应的 Provider 注册，不查找其他执行或连接
+//! 原上游连接的控制消息端口；不解释协议类型、不创建执行或延长连接生命周期
 
 use std::fmt;
 use std::sync::{Arc, Mutex, Weak};
 
-use crate::lifecycle::CancellationToken;
+use async_trait::async_trait;
 
-/// 单次根执行的控制入口；重试不继承已结束响应的控制目标
+/// Provider 实现的连接控制通道，消息内容由上游协议解释
+#[async_trait]
+pub trait ResponseControlTransport: Send + Sync {
+    async fn send(&self, payload: &str) -> Result<(), ResponseControlUnavailable>;
+
+    /// 仅在响应正文已结束后读取，调用方必须先取消此读取再开始下一轮执行
+    async fn receive(&self) -> Result<String, ResponseControlUnavailable>;
+}
+
+/// 控制消息没有可用的原上游连接，不能通过重新选号或重试恢复
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct ResponseControlUnavailable;
+
+/// 单次根执行绑定的原连接；终态后仍可使用，连接销毁或重新绑定时失效
 #[derive(Clone, Default)]
 pub struct ResponseControl {
-    active: Arc<Mutex<Weak<InterruptTarget>>>,
+    target: Arc<Mutex<Option<Weak<dyn ResponseControlTransport>>>>,
+}
+
+/// 某次已交付响应所属的弱连接快照，重绑后不能把旧消息发送到新连接
+#[derive(Clone)]
+pub struct ResponseControlBinding(Weak<dyn ResponseControlTransport>);
+
+impl ResponseControlBinding {
+    #[must_use]
+    pub fn same_binding(&self, other: &Self) -> bool {
+        self.0.ptr_eq(&other.0)
+    }
+
+    pub async fn send(&self, payload: &str) -> Result<(), ResponseControlUnavailable> {
+        self.0
+            .upgrade()
+            .ok_or(ResponseControlUnavailable)?
+            .send(payload)
+            .await
+    }
 }
 
 impl fmt::Debug for ResponseControl {
@@ -17,64 +49,53 @@ impl fmt::Debug for ResponseControl {
     }
 }
 
-struct InterruptTarget {
-    response_id: String,
-    requested: CancellationToken,
-}
-
-/// Provider 持有的活动响应控制权；释放后客户端无法再向该响应发出中断
-pub struct ActiveResponseInterrupt(Arc<InterruptTarget>);
-
-/// 控制帧不能作用于当前执行时的稳定原因，不携带其他响应身份
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum ResponseInterruptError {
-    Unavailable,
-    ResponseMismatch,
-}
-
 impl ResponseControl {
-    /// 在上游确认响应 ID 后注册；同一执行只允许一个存活的响应 owner
-    pub fn activate(&self, response_id: String) -> Option<ActiveResponseInterrupt> {
-        let mut active = self
-            .active
+    /// 仅保存弱引用，不延长旧 attempt 的连接生命周期
+    #[must_use]
+    pub fn binding(&self) -> Option<ResponseControlBinding> {
+        self.target
             .lock()
-            .unwrap_or_else(std::sync::PoisonError::into_inner);
-        if active.upgrade().is_some() || response_id.is_empty() {
-            return None;
-        }
-        let target = Arc::new(InterruptTarget {
-            response_id,
-            requested: CancellationToken::new(),
-        });
-        *active = Arc::downgrade(&target);
-        Some(ActiveResponseInterrupt(target))
+            .unwrap_or_else(std::sync::PoisonError::into_inner)
+            .as_ref()
+            .cloned()
+            .map(ResponseControlBinding)
     }
 
-    /// 重复中断合并为一次信号；ID 必须匹配本执行当前的上游响应
-    pub fn interrupt(&self, response_id: &str) -> Result<(), ResponseInterruptError> {
-        let active = self
-            .active
+    /// Provider 在请求成功写入上游后绑定；连接 owner 持有强引用并负责撤销
+    pub fn bind(&self, transport: &Arc<dyn ResponseControlTransport>) {
+        *self
+            .target
             .lock()
-            .unwrap_or_else(std::sync::PoisonError::into_inner);
-        let target = active
-            .upgrade()
-            .ok_or(ResponseInterruptError::Unavailable)?;
-        if target.response_id != response_id {
-            return Err(ResponseInterruptError::ResponseMismatch);
+            .unwrap_or_else(std::sync::PoisonError::into_inner) = Some(Arc::downgrade(transport));
+    }
+
+    pub fn clear(&self) {
+        *self
+            .target
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner) = None;
+    }
+
+    fn transport(&self) -> Option<Arc<dyn ResponseControlTransport>> {
+        self.target
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner)
+            .as_ref()
+            .and_then(Weak::upgrade)
+    }
+
+    pub async fn send(&self, payload: &str) -> Result<(), ResponseControlUnavailable> {
+        self.transport()
+            .ok_or(ResponseControlUnavailable)?
+            .send(payload)
+            .await
+    }
+
+    /// 未绑定时保持等待，供连接空闲循环与客户端输入共同 select
+    pub async fn receive(&self) -> Result<String, ResponseControlUnavailable> {
+        match self.transport() {
+            Some(transport) => transport.receive().await,
+            None => std::future::pending().await,
         }
-        target.requested.cancel();
-        Ok(())
-    }
-}
-
-impl ActiveResponseInterrupt {
-    pub fn response_id(&self) -> &str {
-        &self.0.response_id
-    }
-
-    pub fn requested(&self) -> impl Future<Output = ()> + Send + 'static {
-        // 等待者只持有信号，不能延长活动响应 owner 的生命周期
-        let requested = self.0.requested.clone();
-        async move { requested.cancelled().await }
     }
 }

backend/crates/gateway-core/src/error/mod.rs

@@ -135,6 +135,7 @@ pub enum PreDeliveryRetry {
         max_delay: Duration,
     },
     /// 固定本次账号，并按 Provider 给出的序号重试当前传输
+    /// 可用于发送结果不明确时的有界尽力恢复，不等于上游未执行的证明
     SameAccountTransportRetry {
         /// Provider-owned 传输重试序号，从 1 开始
         retry_index: NonZeroU32,
@@ -630,8 +631,8 @@ impl ProviderError {
 
     /// 允许 Core 在首个客户端事件前固定原账号并改用 Provider 备用传输
     ///
-    /// 与普通换号恢复相同，Core 仍会拒绝 continuation、指定账号、预算耗尽或
-    /// 下游已提交后的隐藏重放
+    /// Provider 必须确认备用传输满足当前 continuation scope 并限制恢复次数
+    /// Core 保持原账号，拒绝预算耗尽、外部副作用或下游已提交后的隐藏重放
     #[must_use]
     pub fn with_pre_delivery_transport_fallback(mut self) -> Self {
         self.set_pre_delivery_transport_fallback();
@@ -647,6 +648,7 @@ impl ProviderError {
     ///
     /// 重试预算和退避策略由 Provider 所属协议定义；Core 只负责同账号钉选、
     /// deadline/取消边界以及下游 commit barrier
+    /// 该意图允许发送结果不明确时尽力恢复，但不修改发送事实或安全重放证明
     #[must_use]
     pub fn with_pre_delivery_transport_retry(
         mut self,

backend/crates/gateway-core/src/event.rs

@@ -203,6 +203,7 @@ pub struct ProtocolWireEvent {
     data: Value,
     has_json_data: bool,
     raw_sse_frame: Option<Bytes>,
+    raw_websocket_message: Option<Arc<str>>,
     raw_json_body: Option<Bytes>,
     raw_http_body: Option<Bytes>,
     sse_id: Option<String>,
@@ -245,6 +246,7 @@ impl ProtocolWireEvent {
             data,
             has_json_data: true,
             raw_sse_frame: None,
+            raw_websocket_message: None,
             raw_json_body: None,
             raw_http_body: None,
             sse_id,
@@ -293,6 +295,7 @@ impl ProtocolWireEvent {
             data: Value::Null,
             has_json_data: false,
             raw_sse_frame: Some(raw_sse_frame),
+            raw_websocket_message: None,
             raw_json_body: None,
             raw_http_body: None,
             sse_id: None,
@@ -300,6 +303,33 @@ impl ProtocolWireEvent {
         })
     }
 
+    /// 创建原始 WebSocket 文本；JSON 解析失败不影响交付
+    ///
+    /// # Errors
+    ///
+    /// 协议名不满足 wire 安全约束时返回错误
+    pub fn raw_websocket(
+        protocol: impl Into<String>,
+        message: impl Into<Arc<str>>,
+    ) -> Result<Self, IdentifierError> {
+        let mut wire = Self::json(protocol, None, Value::Null)?;
+        wire.has_json_data = false;
+        Ok(wire.with_raw_websocket_message(message))
+    }
+
+    /// 绑定同一事件未经改写的 WebSocket 文本，解析视图只用于旁路事实
+    #[must_use]
+    pub fn with_raw_websocket_message(mut self, message: impl Into<Arc<str>>) -> Self {
+        self.raw_websocket_message = Some(message.into());
+        self
+    }
+
+    /// 返回未经改写的 WebSocket 文本
+    #[must_use]
+    pub fn raw_websocket_message(&self) -> Option<&str> {
+        self.raw_websocket_message.as_deref()
+    }
+
     /// 创建未经改写的完整 JSON 响应正文
     ///
     /// 该载荷用于非流式协议端点；Core 不解析或重编码其中的值
@@ -319,6 +349,7 @@ impl ProtocolWireEvent {
             data: Value::Null,
             has_json_data: false,
             raw_sse_frame: None,
+            raw_websocket_message: None,
             raw_json_body: Some(raw_json_body),
             raw_http_body: None,
             sse_id: None,
@@ -343,6 +374,7 @@ impl ProtocolWireEvent {
             data: Value::Null,
             has_json_data: false,
             raw_sse_frame: None,
+            raw_websocket_message: None,
             raw_json_body: None,
             raw_http_body: Some(raw_http_body),
             sse_id: None,
@@ -431,6 +463,10 @@ impl fmt::Debug for ProtocolWireEvent {
             .field("event_type", &self.event_type)
             .field("has_json_data", &self.has_json_data)
             .field("has_raw_sse_frame", &self.raw_sse_frame.is_some())
+            .field(
+                "has_raw_websocket_message",
+                &self.raw_websocket_message.is_some(),
+            )
             .field("has_raw_json_body", &self.raw_json_body.is_some())
             .field("has_raw_http_body", &self.raw_http_body.is_some())
             .field("has_sse_id", &self.sse_id.is_some())
@@ -500,7 +536,7 @@ pub struct ProviderResponseTimings {
     pub upstream_response_ms: Option<u64>,
     /// 上游排除引擎与客户端工具时间后的 API 耗时
     pub upstream_api_overhead_ms: Option<f64>,
-    /// 上游引擎服务总耗时；以下专项指标保留毫秒小数及各自内部计量层级
+    /// 上游响应级引擎耗时；以下专项指标保留毫秒小数及各自内部计量层级
     pub upstream_engine_ms: Option<f64>,
     pub upstream_engine_iapi_ttft_ms: Option<f64>,
     pub upstream_engine_service_ttft_ms: Option<f64>,
@@ -798,6 +834,7 @@ pub struct ProviderEvent {
     observation: Option<Box<ProviderResponseObservation>>,
     session_update: Option<Box<ProviderSessionState>>,
     middleware_transformed: bool,
+    replayable_prelude: bool,
     middleware_origin_wire: Option<Arc<ProtocolWireEvent>>,
 }
 
@@ -811,6 +848,7 @@ impl ProviderEvent {
             observation: None,
             session_update: None,
             middleware_transformed: false,
+            replayable_prelude: false,
             middleware_origin_wire: None,
         }
     }
@@ -831,6 +869,7 @@ impl ProviderEvent {
             observation: None,
             session_update: None,
             middleware_transformed: false,
+            replayable_prelude: false,
             middleware_origin_wire: None,
         }
     }
@@ -844,6 +883,7 @@ impl ProviderEvent {
             observation: None,
             session_update: None,
             middleware_transformed: false,
+            replayable_prelude: false,
             middleware_origin_wire: None,
         }
     }
@@ -857,10 +897,24 @@ impl ProviderEvent {
             observation: Some(Box::new(observation)),
             session_update: None,
             middleware_transformed: false,
+            replayable_prelude: false,
             middleware_origin_wire: None,
         }
     }
 
+    /// Provider 确认该事件仅为可替换的前导信息，客户端支持后续 attempt 的新前导事件
+    /// 此证明不代替错误分类、发送状态、预算或续接恢复检查
+    #[must_use]
+    pub fn with_replayable_prelude(mut self) -> Self {
+        self.replayable_prelude = true;
+        self
+    }
+
+    #[must_use]
+    pub const fn is_replayable_prelude(&self) -> bool {
+        self.replayable_prelude && !self.middleware_transformed
+    }
+
     /// 返回协议表达是否由中间件替换、展开或丢弃映射产生
     ///
     /// 宿主最终协议边界据此启用严格复核，插件可读取其快照
@@ -934,6 +988,7 @@ impl ProviderEvent {
     /// 仅替换客户端协议表达；canonical facts、响应观察和会话状态保持原始事实
     pub fn replace_wire(&mut self, wire: Option<ProtocolWireEvent>) {
         self.wire = wire.map(Box::new);
+        self.replayable_prelude = false;
     }
 
     /// 取出仅供 Core 持久化的响应观察

backend/crates/gateway-core/src/lib.rs

@@ -472,7 +472,8 @@ pub fn prepare_control_plane(
     providers: ProviderRegistry,
     extensions: Option<Arc<dyn routing::extensions::ExtensionPreparationPort>>,
 ) -> CoreControlPlaneStartup {
-    let mut compiler = RuntimeSnapshotCompiler::new(ports.snapshots, Arc::new(providers));
+    let mut compiler = RuntimeSnapshotCompiler::new(ports.snapshots, Arc::new(providers.clone()))
+        .with_privacy_compiler(Arc::new(providers));
     if let Some(extensions) = extensions {
         compiler = compiler.with_extensions(extensions);
     }

backend/crates/gateway-core/src/lifecycle.rs

@@ -126,7 +126,7 @@ pub trait ConnectionGuard: Send + 'static {}
 pub trait ConnectionLifecycle: Send + Sync {
     /// 原子地检查 drain 状态并注册一个活跃连接
     ///
-    /// 当本方法成功时，drain 必须等待返回的 guard 被释放；
+    /// 成功注册不延长关闭流程，活跃连接可随进程退出被中断；
     /// 当 drain 已经线性化生效时，本方法必须返回 [`ConnectionDraining`]
     fn try_register(&self) -> Result<Box<dyn ConnectionGuard>, ConnectionDraining>;
 

backend/crates/gateway-core/src/metering/mod.rs

@@ -194,9 +194,9 @@ impl Money {
 pub struct Usage {
     pub input_tokens: Option<u64>,
     pub output_tokens: Option<u64>,
-    pub cached_tokens: Option<u64>,
-    pub cache_write_tokens: Option<u64>,
-    pub reasoning_tokens: Option<u64>,
+    pub cached_input_tokens: Option<u64>,
+    pub cache_write_input_tokens: Option<u64>,
+    pub reasoning_output_tokens: Option<u64>,
     pub image_input_tokens: Option<u64>,
     pub image_output_tokens: Option<u64>,
     /// Provider/协议报告的独立事实，不从其他列相加推导
@@ -209,9 +209,9 @@ impl Usage {
         Self {
             input_tokens: None,
             output_tokens: None,
-            cached_tokens: None,
-            cache_write_tokens: None,
-            reasoning_tokens: None,
+            cached_input_tokens: None,
+            cache_write_input_tokens: None,
+            reasoning_output_tokens: None,
             image_input_tokens: None,
             image_output_tokens: None,
             total_tokens: None,
@@ -226,14 +226,14 @@ impl Usage {
         if newer.output_tokens.is_some() {
             self.output_tokens = newer.output_tokens;
         }
-        if newer.cached_tokens.is_some() {
-            self.cached_tokens = newer.cached_tokens;
+        if newer.cached_input_tokens.is_some() {
+            self.cached_input_tokens = newer.cached_input_tokens;
         }
-        if newer.cache_write_tokens.is_some() {
-            self.cache_write_tokens = newer.cache_write_tokens;
+        if newer.cache_write_input_tokens.is_some() {
+            self.cache_write_input_tokens = newer.cache_write_input_tokens;
         }
-        if newer.reasoning_tokens.is_some() {
-            self.reasoning_tokens = newer.reasoning_tokens;
+        if newer.reasoning_output_tokens.is_some() {
+            self.reasoning_output_tokens = newer.reasoning_output_tokens;
         }
         if newer.image_input_tokens.is_some() {
             self.image_input_tokens = newer.image_input_tokens;
@@ -332,7 +332,7 @@ pub struct CalculatedCostBreakdown {
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct ImageCostBreakdown {
     pub input_tokens: u64,
-    pub cached_tokens: u64,
+    pub cached_input_tokens: u64,
     pub input_amount: Money,
     pub cache_read_amount: Money,
     pub input_price_per_million: Money,

backend/crates/gateway-core/src/policy/mod.rs

@@ -119,6 +119,7 @@ pub struct ClientSettings {
 /// 从 `client_api_keys` 冻结的公开准入事实
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct ClientPolicy {
+    name_snapshot: Option<String>,
     defaults: Arc<ClientSettings>,
     key_id: ClientApiKeyId,
     plaintext_key: PlaintextClientApiKey,
@@ -163,6 +164,7 @@ impl ClientPolicy {
         limits: RateLimits,
     ) -> Self {
         Self {
+            name_snapshot: None,
             defaults: Arc::new(ClientSettings {
                 request_profiles: account_scope.request_profiles().clone(),
                 fast_mode: account_scope.fast_mode(),
@@ -176,6 +178,17 @@ impl ClientPolicy {
         }
     }
 
+    #[must_use]
+    pub fn with_name_snapshot(mut self, name: Option<String>) -> Self {
+        self.name_snapshot = name;
+        self
+    }
+
+    #[must_use]
+    pub fn name_snapshot(&self) -> Option<&str> {
+        self.name_snapshot.as_deref()
+    }
+
     #[must_use]
     pub const fn key_id(&self) -> &ClientApiKeyId {
         &self.key_id

backend/crates/gateway-core/src/routing/mod.rs

@@ -563,6 +563,7 @@ impl ProviderCandidate {
 pub struct RoutingPlan {
     pricing: Arc<crate::metering::PricingOverrides>,
     request_location: Option<crate::account::RequestLocation>,
+    privacy: Option<Arc<dyn crate::settings::privacy::CompiledPrivacyPolicy>>,
     config_revision: ConfigRevision,
     account_selection_policy: AccountSelectionPolicy,
     operation: OperationKind,
@@ -582,6 +583,12 @@ impl RoutingPlan {
         self.account_scope.fast_mode()
     }
 
+    /// 本次请求冻结的已编译规则，重试不读取新的全局策略
+    #[must_use]
+    pub fn privacy(&self) -> Option<Arc<dyn crate::settings::privacy::CompiledPrivacyPolicy>> {
+        self.privacy.clone()
+    }
+
     /// 本次请求冻结的全局位置，重试时沿用同一份配置
     #[must_use]
     pub const fn request_location(&self) -> Option<&crate::account::RequestLocation> {

backend/crates/gateway-core/src/routing/snapshot.rs

@@ -29,6 +29,7 @@ type ModelCatalogAccounts = BTreeMap<ProviderKind, BTreeMap<String, BTreeSet<Pro
 /// Store 读取到的一个启用 Client API Key 策略事实
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct SnapshotClientPolicyFacts {
+    name_snapshot: Option<String>,
     request_profiles: BTreeMap<ProviderKind, crate::account::OpaqueProviderData>,
     key_id: ClientApiKeyId,
     plaintext_key: PlaintextClientApiKey,
@@ -37,6 +38,12 @@ pub struct SnapshotClientPolicyFacts {
 }
 
 impl SnapshotClientPolicyFacts {
+    #[must_use]
+    pub fn with_name_snapshot(mut self, name: Option<String>) -> Self {
+        self.name_snapshot = name;
+        self
+    }
+
     #[must_use]
     pub fn with_request_profiles(
         mut self,
@@ -55,6 +62,7 @@ impl SnapshotClientPolicyFacts {
     ) -> Self {
         Self {
             key_id,
+            name_snapshot: None,
             request_profiles: BTreeMap::new(),
             plaintext_key,
             group_ids,
@@ -219,6 +227,7 @@ pub enum RuntimeSnapshotCompileError {
 #[derive(Clone)]
 pub struct RuntimeSnapshotCompiler {
     store: Arc<dyn SnapshotStorePort>,
+    privacy_compiler: Option<Arc<dyn crate::settings::privacy::PrivacyPolicyCompiler>>,
     catalogs: Arc<dyn ProviderCatalogPort>,
     extensions: Option<Arc<dyn crate::routing::extensions::ExtensionPreparationPort>>,
 }
@@ -231,6 +240,7 @@ impl RuntimeSnapshotCompiler {
     ) -> Self {
         Self {
             store,
+            privacy_compiler: None,
             catalogs,
             extensions: None,
         }
@@ -245,6 +255,15 @@ impl RuntimeSnapshotCompiler {
         self
     }
 
+    #[must_use]
+    pub fn with_privacy_compiler(
+        mut self,
+        compiler: Arc<dyn crate::settings::privacy::PrivacyPolicyCompiler>,
+    ) -> Self {
+        self.privacy_compiler = Some(compiler);
+        self
+    }
+
     pub(crate) fn store(&self) -> Arc<dyn SnapshotStorePort> {
         Arc::clone(&self.store)
     }
@@ -314,8 +333,14 @@ impl RuntimeSnapshotCompiler {
             let cached = previous.filter(|previous| {
                 previous.extensions().map(|set| set.id()) == extensions.as_ref().map(|set| set.id())
             });
-            let snapshot =
-                compile_runtime_snapshot(facts, catalogs.as_ref(), provider_kinds, cached).await?;
+            let snapshot = compile_runtime_snapshot(
+                facts,
+                catalogs.as_ref(),
+                provider_kinds,
+                cached,
+                self.privacy_compiler.clone(),
+            )
+            .await?;
             let observed_generations = catalogs.catalog_generations();
             if catalog_generations == observed_generations {
                 if extensions.is_some()
@@ -348,6 +373,7 @@ async fn compile_runtime_snapshot(
     catalogs: &dyn ProviderCatalogPort,
     provider_kinds: Vec<ProviderKind>,
     previous: Option<&RuntimeSnapshot>,
+    privacy_compiler: Option<Arc<dyn crate::settings::privacy::PrivacyPolicyCompiler>>,
 ) -> Result<RuntimeSnapshot, RuntimeSnapshotCompileError> {
     // 只有成功取得的完整目录能证明模型缺项；发现型目录和查询失败均交由上游验证
     let mut provider_models = Vec::new();
@@ -491,25 +517,29 @@ async fn compile_runtime_snapshot(
                     .map_err(|_| RuntimeSnapshotCompileError::InvalidData)?,
             )
         };
-        client_policies.push(ClientPolicy::new(
-            policy.key_id,
-            policy.plaintext_key,
-            Arc::new(
-                account_scope
-                    .with_fast_mode(fast_mode)
-                    .with_request_profiles(policy.request_profiles),
-            ),
-            true,
-            policy.limits,
-        ));
+        client_policies.push(
+            ClientPolicy::new(
+                policy.key_id,
+                policy.plaintext_key,
+                Arc::new(
+                    account_scope
+                        .with_fast_mode(fast_mode)
+                        .with_request_profiles(policy.request_profiles),
+                ),
+                true,
+                policy.limits,
+            )
+            .with_name_snapshot(policy.name_snapshot),
+        );
     }
 
-    RuntimeSnapshot::new(
+    RuntimeSnapshot::new_with_privacy_compiler(
         facts.config_revision,
         facts.settings,
         provider_kinds,
         provider_models,
         client_policies,
+        privacy_compiler,
     )
     .map_err(|_| RuntimeSnapshotCompileError::InvalidData)
     .map(|snapshot| {
@@ -524,6 +554,7 @@ async fn compile_runtime_snapshot(
 #[derive(Debug, Clone)]
 pub struct RuntimeSnapshot {
     settings: Arc<CompiledSettings>,
+    privacy_compiler: Option<Arc<dyn crate::settings::privacy::PrivacyPolicyCompiler>>,
     extensions: Option<crate::routing::extensions::ExtensionSetReference>,
     revision: ConfigRevision,
     providers: Arc<BTreeSet<ProviderKind>>,
@@ -559,8 +590,12 @@ impl RuntimeSnapshot {
         &self,
         values: &SettingsValues,
     ) -> Result<Self, RuntimeSnapshotCompileError> {
-        let settings = CompiledSettings::new(values.clone())
-            .map_err(|_| RuntimeSnapshotCompileError::InvalidData)?;
+        let settings = CompiledSettings::new(
+            values.clone(),
+            self.privacy_compiler.as_deref(),
+            Some(&self.settings),
+        )
+        .map_err(|_| RuntimeSnapshotCompileError::InvalidData)?;
         Ok(Self {
             settings: Arc::new(settings),
             ..self.clone()
@@ -649,6 +684,24 @@ impl RuntimeSnapshot {
         providers: Vec<ProviderKind>,
         provider_models: Vec<ProviderModel>,
         client_policies: Vec<ClientPolicy>,
+    ) -> Result<Self, RoutingError> {
+        Self::new_with_privacy_compiler(
+            revision,
+            values,
+            providers,
+            provider_models,
+            client_policies,
+            None,
+        )
+    }
+
+    pub fn new_with_privacy_compiler(
+        revision: ConfigRevision,
+        values: SettingsValues,
+        providers: Vec<ProviderKind>,
+        provider_models: Vec<ProviderModel>,
+        client_policies: Vec<ClientPolicy>,
+        privacy_compiler: Option<Arc<dyn crate::settings::privacy::PrivacyPolicyCompiler>>,
     ) -> Result<Self, RoutingError> {
         let mut provider_set = BTreeSet::new();
         for provider in providers {
@@ -709,9 +762,11 @@ impl RuntimeSnapshot {
         }
         client_policy_map.retain(|_, policy| policy.enabled());
 
-        let settings = CompiledSettings::new(values).map_err(|_| RoutingError::InvalidSettings)?;
+        let settings = CompiledSettings::new(values, privacy_compiler.as_deref(), None)
+            .map_err(|_| RoutingError::InvalidSettings)?;
         Ok(Self {
             settings: Arc::new(settings),
+            privacy_compiler,
             extensions: None,
             revision,
             providers: Arc::new(provider_set),
@@ -1046,6 +1101,7 @@ impl RuntimeSnapshot {
     ) -> Result<RoutingPlan, RoutingError> {
         let requirements = operation.capability_requirements();
         let mut candidates = Vec::new();
+        let mut unlisted_candidates = Vec::new();
 
         if context.required_provider.is_none() && account_scope.provider_kinds().is_empty() {
             return Err(RoutingError::EmptyAccountScope);
@@ -1093,11 +1149,11 @@ impl RuntimeSnapshot {
             {
                 continue;
             }
-            let emulated_features = match self
+            let capabilities = self
                 .provider_models
                 .get(provider)
-                .and_then(|models| models.get(&upstream_model))
-            {
+                .and_then(|models| models.get(&upstream_model));
+            let emulated_features = match capabilities {
                 Some(capabilities) => {
                     let Some(emulated) = capabilities.match_requirements(&requirements) else {
                         continue;
@@ -1107,7 +1163,7 @@ impl RuntimeSnapshot {
                 None if self.exhaustive_provider_catalogs.contains(provider) => continue,
                 None => BTreeSet::new(),
             };
-            candidates.push(ProviderCandidate {
+            let candidate = ProviderCandidate {
                 provider: provider.clone(),
                 model_presentation: self
                     .provider_model_presentations
@@ -1117,8 +1173,15 @@ impl RuntimeSnapshot {
                 upstream_model: Some(upstream_model),
                 emulated_features,
                 account_scope: Arc::clone(&account_scope),
-            });
+            };
+            if capabilities.is_some() {
+                candidates.push(candidate);
+            } else {
+                unlisted_candidates.push(candidate);
+            }
         }
+        // 已知模型优先；发现型目录的未知模型仍可透传，但不能抢在明确匹配的 Provider 前面
+        candidates.extend(unlisted_candidates);
 
         if candidates.is_empty() {
             // 模型存在性必须包含被请求路由限制排除的 Provider；目录未知时不能断言模型不存在
@@ -1143,6 +1206,7 @@ impl RuntimeSnapshot {
             config_revision: self.revision,
             pricing: Arc::clone(&self.settings.values.pricing),
             request_location: self.settings.request_location.clone(),
+            privacy: self.settings.privacy.clone(),
             account_selection_policy: self.settings.account_selection_policy,
             operation: operation.kind(),
             max_attempts: NonZeroU32::new(super::MAX_REQUEST_ATTEMPTS)
@@ -1223,6 +1287,7 @@ impl RuntimeSnapshot {
             config_revision: self.revision,
             pricing: Arc::clone(&self.settings.values.pricing),
             request_location: self.settings.request_location.clone(),
+            privacy: self.settings.privacy.clone(),
             account_selection_policy: self.settings.account_selection_policy,
             operation: operation.kind(),
             max_attempts: NonZeroU32::new(super::MAX_REQUEST_ATTEMPTS)

backend/crates/gateway-core/src/settings/compiled.rs

@@ -13,6 +13,7 @@ use crate::{
 #[derive(Debug, Clone)]
 pub(crate) struct CompiledSettings {
     pub(crate) values: SettingsValues,
+    pub(crate) privacy: Option<std::sync::Arc<dyn super::privacy::CompiledPrivacyPolicy>>,
     pub(crate) account_selection_policy: AccountSelectionPolicy,
     pub(crate) client_queue_policy: ConcurrencyQueuePolicy,
     pub(crate) responses_max_decompressed_body_bytes: std::num::NonZeroUsize,
@@ -21,7 +22,34 @@ pub(crate) struct CompiledSettings {
 }
 
 impl CompiledSettings {
-    pub(crate) fn new(settings: SettingsValues) -> Result<Self, InvalidSettings> {
+    pub(crate) fn new(
+        settings: SettingsValues,
+        compiler: Option<&dyn super::privacy::PrivacyPolicyCompiler>,
+        previous: Option<&Self>,
+    ) -> Result<Self, InvalidSettings> {
+        let privacy = if let Some(previous) = previous.filter(|previous| {
+            previous.values.codex_privacy_policy == settings.codex_privacy_policy
+        }) {
+            previous.privacy.clone()
+        } else if settings.codex_privacy_policy == super::privacy::CodexPrivacyPolicy::default() {
+            None
+        } else {
+            Some(
+                compiler
+                    .ok_or(InvalidSettings)?
+                    .compile(&settings.codex_privacy_policy)
+                    .map_err(|_| InvalidSettings)?,
+            )
+        };
+        // 关闭或没有启用规则时不进入出站管线，保留原始 JSON 字节和重复键语义
+        let privacy = privacy.filter(|_| {
+            settings.codex_privacy_policy.enabled
+                && settings
+                    .codex_privacy_policy
+                    .rules
+                    .iter()
+                    .any(|rule| rule.enabled)
+        });
         super::validate_request_limits(
             settings.max_waiting_per_key,
             settings.max_waiting_per_account,
@@ -79,6 +107,7 @@ impl CompiledSettings {
             min_codex_client_versions,
             request_location,
             values: settings,
+            privacy,
         })
     }
 }

backend/crates/gateway-core/src/settings/mod.rs

@@ -1,6 +1,7 @@
 //! 运行设置的纯值、校验与编译结果
 
 pub(crate) mod compiled;
+pub mod privacy;
 mod values;
 pub use values::{
     SettingsValues, client_min_versions, response_body_limit, validate_request_limits,

backend/crates/gateway-core/src/settings/privacy.rs

@@ -0,0 +1,134 @@
+//! 隐私策略配置、编译端口与无敏感值的执行结果，协议解析由 Provider 拥有
+
+use std::{fmt, sync::Arc};
+
+use serde::{Deserialize, Serialize};
+use serde_json::Value;
+
+#[derive(Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct CodexPrivacyPolicy {
+    pub enabled: bool,
+    pub on_error: PrivacyFailureMode,
+    pub rules: Vec<PrivacyRule>,
+}
+
+impl fmt::Debug for CodexPrivacyPolicy {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("CodexPrivacyPolicy")
+            .field("enabled", &self.enabled)
+            .field("on_error", &self.on_error)
+            .field("rule_count", &self.rules.len())
+            .finish()
+    }
+}
+
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum PrivacyFailureMode {
+    #[default]
+    SkipRule,
+    RejectRequest,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum PrivacyScope {
+    TurnMetadata,
+    DesktopGitContext,
+    EnvironmentText,
+    RequestBody,
+    RequestHeader,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum PrivacyAction {
+    RegexReplace,
+    SetValue,
+    RenameKey,
+    RemoveField,
+}
+
+#[derive(Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct PrivacyRule {
+    pub id: String,
+    pub name: String,
+    pub enabled: bool,
+    pub scope: PrivacyScope,
+    pub selector: String,
+    pub action: PrivacyAction,
+    /// 删除动作的 null 表示无条件删除，字符串模式只匹配目标字符串值
+    pub pattern: Option<String>,
+    pub replacement: String,
+    pub value: Value,
+    pub replace_all: bool,
+    pub case_insensitive: bool,
+    pub multi_line: bool,
+}
+
+impl fmt::Debug for PrivacyRule {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("PrivacyRule")
+            .field("scope", &self.scope)
+            .field("action", &self.action)
+            .field("enabled", &self.enabled)
+            .finish_non_exhaustive()
+    }
+}
+
+/// 编译和执行失败仅携带规则序号与静态原因，不回显表达式或请求内容
+#[derive(Debug, Clone, PartialEq, Eq, thiserror::Error, Serialize)]
+#[serde(rename_all = "camelCase")]
+#[error("privacy rule {rule_index}: {reason}")]
+pub struct PrivacyError {
+    pub rule_index: usize,
+    pub reason: &'static str,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct PrivacyRuleOutcome {
+    pub rule_id: String,
+    pub matches: usize,
+    pub status: String,
+    pub reason: Option<String>,
+}
+
+/// 已编译策略随快照冻结，调用方提供独立的本次出站副本
+pub trait CompiledPrivacyPolicy: fmt::Debug + Send + Sync {
+    fn apply(
+        &self,
+        body: &mut Value,
+        headers: &mut http::HeaderMap,
+        turn_metadata: &mut Option<String>,
+        cancelled: &dyn Fn() -> bool,
+    ) -> Result<Vec<PrivacyRuleOutcome>, PrivacyError>;
+}
+
+pub trait PrivacyPolicyCompiler: fmt::Debug + Send + Sync {
+    fn compile(
+        &self,
+        policy: &CodexPrivacyPolicy,
+    ) -> Result<Arc<dyn CompiledPrivacyPolicy>, PrivacyError>;
+}
+
+/// 预览只接受管理员主动提供的受限样本，不读取实际请求记录
+#[derive(Clone, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct PrivacyPreviewRequest {
+    pub policy: CodexPrivacyPolicy,
+    pub body: Value,
+    pub headers: std::collections::BTreeMap<String, Vec<String>>,
+    pub turn_metadata: Option<String>,
+}
+
+#[derive(Clone, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct PrivacyPreviewResult {
+    pub body: Value,
+    pub headers: std::collections::BTreeMap<String, Vec<String>>,
+    pub turn_metadata: Option<String>,
+    pub outcomes: Vec<PrivacyRuleOutcome>,
+}

backend/crates/gateway-core/src/settings/values.rs

@@ -10,6 +10,7 @@ use crate::identity::ProviderKind;
 pub struct SettingsValues {
     pub(crate) pricing: Arc<crate::metering::PricingOverrides>,
     pub(crate) request_profiles: Arc<BTreeMap<ProviderKind, crate::account::OpaqueProviderData>>,
+    pub(crate) codex_privacy_policy: super::privacy::CodexPrivacyPolicy,
     pub(crate) request_location_enabled: bool,
     pub(crate) request_location: crate::account::RequestLocation,
     pub(crate) max_concurrent_per_account: u32,
@@ -30,6 +31,12 @@ pub struct SettingsValues {
 }
 
 impl SettingsValues {
+    #[must_use]
+    pub fn with_codex_privacy_policy(mut self, policy: super::privacy::CodexPrivacyPolicy) -> Self {
+        self.codex_privacy_policy = policy;
+        self
+    }
+
     #[must_use]
     pub const fn with_openai_session_affinity_ttl_hours(mut self, hours: u32) -> Self {
         self.openai_session_affinity_ttl_hours = hours;
@@ -131,6 +138,7 @@ impl SettingsValues {
         Self {
             request_profiles: Arc::default(),
             pricing: Arc::default(),
+            codex_privacy_policy: Default::default(),
             request_location_enabled: false,
             request_location: crate::account::RequestLocation::default(),
             max_concurrent_per_account,

backend/crates/gateway-core/src/task.rs

@@ -20,6 +20,7 @@ pub enum WorkerKind {
     RuntimeSnapshotReconciliation,
     RuntimeChangeSubscription,
     StaleModelRequestRecovery,
+    RequestAnalytics,
     Retention,
     OpsFlush,
     Backup,
@@ -28,12 +29,13 @@ pub enum WorkerKind {
 }
 
 impl WorkerKind {
-    pub const ALL: [Self; 10] = [
+    pub const ALL: [Self; 11] = [
         Self::OAuthRefresh,
         Self::QuotaCatalogHealth,
         Self::RuntimeSnapshotReconciliation,
         Self::RuntimeChangeSubscription,
         Self::StaleModelRequestRecovery,
+        Self::RequestAnalytics,
         Self::Retention,
         Self::OpsFlush,
         Self::Backup,
@@ -48,6 +50,7 @@ impl WorkerKind {
             Self::QuotaCatalogHealth => "quota_catalog_health",
             Self::RuntimeSnapshotReconciliation => "runtime_snapshot_reconciliation",
             Self::RuntimeChangeSubscription => "runtime_change_subscription",
+            Self::RequestAnalytics => "request_analytics",
             Self::StaleModelRequestRecovery => "stale_model_request_recovery",
             Self::Retention => "retention",
             Self::OpsFlush => "ops_flush",

backend/crates/gateway-core/tests/engine/coordinator.rs

@@ -860,7 +860,7 @@ fn model_request(operation: &Operation, deadline: SystemTime) -> NewModelRequest
     NewModelRequest {
         admission_decision_ms: None,
         id: ModelRequestId::new("req_core_1").expect("request id"),
-        client_api_key_id: Some(client_key.clone()),
+        client_api_key_name_snapshot: None,
         client_api_key_ref: client_key,
         config_revision: ConfigRevision::new(1).expect("config revision"),
         routing: AccountRoutingSnapshot::all(),
@@ -3493,7 +3493,7 @@ fn ambiguous_pre_delivery_retry_marker_does_not_rotate_account() {
 }
 
 #[test]
-fn ambiguous_transport_retry_is_rejected_even_with_provider_session_state() {
+fn ambiguous_transport_retry_keeps_the_account_without_claiming_replay_safety() {
     let operation = generate_operation();
     let route_plan = plan(&operation);
     let checkpoint = ProviderSessionState::new(
@@ -3513,7 +3513,6 @@ fn ambiguous_transport_retry_is_rejected_even_with_provider_session_state() {
                 Ok(checkpoint_event),
                 Err(
                     ProviderError::new(ProviderErrorKind::Transport, UpstreamSendState::Ambiguous)
-                        .with_replay_safe()
                         .with_pre_delivery_transport_retry(retry_index, Duration::ZERO),
                 ),
             ],
@@ -3533,14 +3532,25 @@ fn ambiguous_transport_retry_is_rejected_even_with_provider_session_state() {
         CancellationToken::new(),
     ))
     .expect("start execution");
-    let error =
-        block_on(session.collect_uncommitted()).expect_err("ambiguous send cannot be replayed");
-    assert!(matches!(error, EngineError::Provider(_)));
-    assert_eq!(provider.contexts.lock().expect("contexts lock").len(), 1);
+    block_on(session.collect_uncommitted()).expect("bounded transport recovery succeeds");
+    block_on(session.commit_downstream(Some(200))).expect("commit winning response");
+    let contexts = provider.contexts.lock().expect("contexts lock");
+    assert_eq!(contexts.len(), 2);
+    assert_eq!(
+        contexts[1].transport(),
+        AttemptTransport::Retry(retry_index)
+    );
+    assert_eq!(
+        contexts[1].required_account(),
+        Some(&ProviderAccountId::new("acct_first").unwrap())
+    );
+    assert!(contexts[1].excluded_accounts().is_empty());
     let state = store.state.lock().expect("store lock");
-    assert_eq!(state.intermediate_failures, 0);
-    assert_eq!(state.finalizations[0].attempt_count, 1);
-    assert_eq!(state.finalizations[0].outcome, ExecutionOutcome::Failed);
+    assert_eq!(state.intermediate_failures, 1);
+    assert_eq!(state.finalizations[0].attempt_count, 2);
+    assert_eq!(state.finalizations[0].outcome, ExecutionOutcome::Succeeded);
+    assert!(state.send_states.contains(&UpstreamSendState::Ambiguous));
+    assert_eq!(state.finalizations[0].send_state, UpstreamSendState::Sent);
 }
 
 #[test]

backend/crates/gateway-core/tests/engine/execution/mod.rs

@@ -579,10 +579,7 @@ fn assert_early_failure_recorded(
     let request = &requests[0];
     assert_eq!(request.id, *request_id);
     assert_eq!(request.client_api_key_ref.as_str(), "key_start_test");
-    assert_eq!(
-        request.client_api_key_id.as_ref(),
-        Some(&request.client_api_key_ref)
-    );
+    assert_eq!(request.client_api_key_name_snapshot, None);
     assert_eq!(request.protocol, "openai");
     assert_eq!(request.endpoint, "/v1/responses");
     assert_eq!(request.client_transport, transport.as_str());

backend/crates/gateway-core/tests/engine/response_control.rs

@@ -1,45 +1,93 @@
-//! 验证响应中断的当前 owner 校验及独立执行间的控制隔离
+//! 验证原连接控制端口的透明传递、owner 生命周期与执行隔离
 
-use futures::FutureExt;
-use gateway_core::engine::response_control::{ResponseControl, ResponseInterruptError};
+use std::sync::{Arc, Mutex};
 
-#[test]
-fn interrupt_requires_the_current_response_owner_and_does_not_extend_its_lifetime() {
-    let control = ResponseControl::default();
-    assert_eq!(
-        control.interrupt("resp_a"),
-        Err(ResponseInterruptError::Unavailable)
-    );
-    assert!(control.activate(String::new()).is_none());
-    let active = control.activate("resp_a".to_owned()).unwrap();
-    let requested = active.requested();
-    assert!(control.activate("resp_b".to_owned()).is_none());
-    assert_eq!(
-        control.interrupt("resp_b"),
-        Err(ResponseInterruptError::ResponseMismatch)
-    );
-    assert!(active.requested().now_or_never().is_none());
-    control.interrupt("resp_a").unwrap();
-    control.interrupt("resp_a").unwrap();
-    assert_eq!(requested.now_or_never(), Some(()));
-    let retained_waiter = active.requested();
-    drop(active);
-    assert_eq!(
-        control.interrupt("resp_a"),
-        Err(ResponseInterruptError::Unavailable)
-    );
-    let next = control.activate("resp_b".to_owned()).unwrap();
-    assert!(next.requested().now_or_never().is_none());
-    drop(retained_waiter);
+use async_trait::async_trait;
+use futures::{FutureExt, executor::block_on};
+use gateway_core::engine::response_control::{
+    ResponseControl, ResponseControlTransport, ResponseControlUnavailable,
+};
+
+#[derive(Default)]
+struct Transport(Mutex<Vec<String>>);
+
+#[async_trait]
+impl ResponseControlTransport for Transport {
+    async fn send(&self, payload: &str) -> Result<(), ResponseControlUnavailable> {
+        self.0.lock().unwrap().push(payload.to_owned());
+        Ok(())
+    }
+    async fn receive(&self) -> Result<String, ResponseControlUnavailable> {
+        Ok("upstream reply".to_owned())
+    }
 }
 
 #[test]
-fn matching_response_ids_do_not_share_control_between_root_executions() {
-    let first = ResponseControl::default();
-    let second = ResponseControl::default();
-    let active_first = first.activate("resp_same".to_owned()).unwrap();
-    let active_second = second.activate("resp_same".to_owned()).unwrap();
-    first.interrupt("resp_same").unwrap();
-    assert_eq!(active_first.requested().now_or_never(), Some(()));
-    assert!(active_second.requested().now_or_never().is_none());
+fn control_requires_a_live_connection_owner_and_preserves_unknown_payloads() {
+    block_on(async {
+        let control = ResponseControl::default();
+        assert_eq!(
+            control.send("unknown").await,
+            Err(ResponseControlUnavailable)
+        );
+        assert!(control.receive().now_or_never().is_none());
+        let transport = Arc::new(Transport::default());
+        let owner: Arc<dyn ResponseControlTransport> = transport.clone();
+        control.bind(&owner);
+        let payload = "{ \"type\": \"future.control\", \"extension\": [1, 2] }";
+        control.send(payload).await.unwrap();
+        control.send(payload).await.unwrap();
+        assert_eq!(*transport.0.lock().unwrap(), [payload, payload]);
+        assert_eq!(control.receive().await.unwrap(), "upstream reply");
+        drop(owner);
+        drop(transport);
+        assert_eq!(control.send(payload).await, Err(ResponseControlUnavailable));
+    });
+}
+
+#[test]
+fn replacing_or_clearing_a_binding_does_not_share_control_between_executions() {
+    block_on(async {
+        let first = ResponseControl::default();
+        let second = ResponseControl::default();
+        let old: Arc<dyn ResponseControlTransport> = Arc::new(Transport::default());
+        let current = Arc::new(Transport::default());
+        let owner: Arc<dyn ResponseControlTransport> = current.clone();
+        first.bind(&old);
+        second.bind(&owner);
+        drop(old);
+        assert_eq!(first.send("old").await, Err(ResponseControlUnavailable));
+        second.send("current").await.unwrap();
+        assert_eq!(*current.0.lock().unwrap(), ["current"]);
+        second.clear();
+        assert_eq!(
+            second.send("cleared").await,
+            Err(ResponseControlUnavailable)
+        );
+    });
+}
+
+#[test]
+fn captured_binding_never_redirects_old_control_to_a_replacement() {
+    block_on(async {
+        let control = ResponseControl::default();
+        let old = Arc::new(Transport::default());
+        let old_owner: Arc<dyn ResponseControlTransport> = old.clone();
+        control.bind(&old_owner);
+        let binding = control.binding().unwrap();
+        let new = Arc::new(Transport::default());
+        let new_owner: Arc<dyn ResponseControlTransport> = new.clone();
+        control.bind(&new_owner);
+        assert!(!binding.same_binding(&control.binding().unwrap()));
+        binding.send("old ID").await.unwrap();
+        assert_eq!(*old.0.lock().unwrap(), ["old ID"]);
+        assert!(new.0.lock().unwrap().is_empty());
+        drop(old_owner);
+        drop(old);
+        assert_eq!(
+            binding.send("expired ID").await,
+            Err(ResponseControlUnavailable)
+        );
+        assert!(new.0.lock().unwrap().is_empty());
+    });
 }

backend/crates/gateway-core/tests/routing/mod.rs

@@ -18,6 +18,7 @@ use gateway_core::routing::{
     UpstreamModelId,
 };
 
+mod privacy;
 mod request_settings;
 mod snapshot;
 

backend/crates/gateway-core/tests/routing/privacy.rs

@@ -0,0 +1,125 @@
+//! 隐私策略在快照与请求计划中的冻结、复用及关闭行为
+
+use super::*;
+use gateway_core::settings::privacy::*;
+use std::sync::atomic::{AtomicUsize, Ordering};
+
+#[derive(Debug, Default)]
+struct Compiler(AtomicUsize);
+
+#[derive(Debug)]
+struct Compiled(serde_json::Value);
+
+impl PrivacyPolicyCompiler for Compiler {
+    fn compile(
+        &self,
+        policy: &CodexPrivacyPolicy,
+    ) -> Result<Arc<dyn CompiledPrivacyPolicy>, PrivacyError> {
+        self.0.fetch_add(1, Ordering::SeqCst);
+        Ok(Arc::new(Compiled(policy.rules[0].value.clone())))
+    }
+}
+
+impl CompiledPrivacyPolicy for Compiled {
+    fn apply(
+        &self,
+        body: &mut serde_json::Value,
+        _: &mut http::HeaderMap,
+        _: &mut Option<String>,
+        _: &dyn Fn() -> bool,
+    ) -> Result<Vec<PrivacyRuleOutcome>, PrivacyError> {
+        *body = self.0.clone();
+        Ok(Vec::new())
+    }
+}
+
+fn policy(value: &str) -> CodexPrivacyPolicy {
+    CodexPrivacyPolicy {
+        enabled: true,
+        on_error: PrivacyFailureMode::RejectRequest,
+        rules: vec![PrivacyRule {
+            id: "rule".into(),
+            name: "规则".into(),
+            enabled: true,
+            scope: PrivacyScope::RequestBody,
+            selector: "$.metadata".into(),
+            action: PrivacyAction::SetValue,
+            pattern: None,
+            replacement: String::new(),
+            value: serde_json::json!(value),
+            replace_all: false,
+            case_insensitive: false,
+            multi_line: false,
+        }],
+    }
+}
+
+fn compiled(snapshot: &RuntimeSnapshot) -> Option<Arc<dyn CompiledPrivacyPolicy>> {
+    snapshot
+        .plan_provider_endpoint(
+            &ProviderKind::new("openai").unwrap(),
+            None,
+            &image_operation(),
+            snapshot.all_account_scope(),
+            &RoutingContext::default(),
+        )
+        .unwrap()
+        .privacy()
+}
+
+#[test]
+fn privacy_is_frozen_and_unrelated_request_settings_reuse_compiled_rules() {
+    let compiler = Arc::new(Compiler::default());
+    let snapshot = RuntimeSnapshot::new_with_privacy_compiler(
+        ConfigRevision::new(1).unwrap(),
+        settings().with_codex_privacy_policy(policy("first")),
+        vec![ProviderKind::new("openai").unwrap()],
+        vec![],
+        vec![],
+        Some(compiler.clone()),
+    )
+    .unwrap()
+    .with_account_directory(account_directory());
+    let original = compiled(&snapshot).unwrap();
+    let limits = snapshot
+        .with_settings(&snapshot.settings().clone().with_max_account_rotations(5))
+        .unwrap();
+    assert!(Arc::ptr_eq(&original, &compiled(&limits).unwrap()));
+    assert_eq!(compiler.0.load(Ordering::SeqCst), 1);
+    let changed = snapshot
+        .with_settings(
+            &snapshot
+                .settings()
+                .clone()
+                .with_codex_privacy_policy(policy("second")),
+        )
+        .unwrap();
+    let mut body = serde_json::Value::Null;
+    original
+        .apply(&mut body, &mut http::HeaderMap::new(), &mut None, &|| false)
+        .unwrap();
+    assert_eq!(body, "first");
+    compiled(&changed)
+        .unwrap()
+        .apply(&mut body, &mut http::HeaderMap::new(), &mut None, &|| false)
+        .unwrap();
+    assert_eq!(body, "second");
+    assert_eq!(compiler.0.load(Ordering::SeqCst), 2);
+    for disable_rule in [false, true] {
+        let mut policy = policy("unused");
+        if disable_rule {
+            policy.rules[0].enabled = false;
+        } else {
+            policy.enabled = false;
+        }
+        let disabled = snapshot
+            .with_settings(
+                &snapshot
+                    .settings()
+                    .clone()
+                    .with_codex_privacy_policy(policy),
+            )
+            .unwrap();
+        assert!(compiled(&disabled).is_none());
+    }
+}

backend/crates/gateway-core/tests/routing/snapshot.rs

@@ -282,6 +282,77 @@ impl ProviderCatalogPort for TestCatalog {
     }
 }
 
+struct MixedCatalog;
+
+impl ProviderCatalogPort for MixedCatalog {
+    fn catalog_generations(&self) -> BTreeMap<ProviderKind, ProviderCatalogGeneration> {
+        ["openai", "xai"]
+            .into_iter()
+            .map(|provider| {
+                (
+                    ProviderKind::new(provider).unwrap(),
+                    ProviderCatalogGeneration::new(1),
+                )
+            })
+            .collect()
+    }
+
+    fn model_catalog_is_exhaustive(&self, provider: &ProviderKind) -> bool {
+        provider.as_str() != "openai"
+    }
+
+    fn query_model_capabilities(
+        &self,
+        provider: &ProviderKind,
+    ) -> BoxFuture<'_, Result<Vec<ProviderModelCapabilities>, ProviderCatalogUnavailable>> {
+        let model = match provider.as_str() {
+            "openai" => "gpt-5.5",
+            "xai" => "grok-4.7",
+            _ => return Box::pin(async { Err(ProviderCatalogUnavailable) }),
+        };
+        Box::pin(async move {
+            Ok([model, "shared-model"]
+                .into_iter()
+                .map(|model| {
+                    ProviderModelCapabilities::new(
+                        UpstreamModelId::new(model).unwrap(),
+                        super::capabilities(),
+                    )
+                })
+                .collect())
+        })
+    }
+}
+
+fn mixed_catalog_snapshot() -> gateway_core::routing::RuntimeSnapshot {
+    let facts = SnapshotFacts::new(
+        revision(1),
+        revision(1),
+        super::settings(),
+        vec![],
+        vec![],
+        ["openai", "xai"]
+            .into_iter()
+            .map(|provider| {
+                SnapshotProviderAccountFacts::new(
+                    gateway_core::account::ProviderAccountId::new(format!("acct_{provider}"))
+                        .unwrap(),
+                    provider,
+                )
+            })
+            .collect(),
+        vec![],
+    );
+    block_on(
+        RuntimeSnapshotCompiler::new(
+            Arc::new(TestSnapshotStore::new(Ok(facts))),
+            Arc::new(MixedCatalog),
+        )
+        .compile(),
+    )
+    .unwrap()
+}
+
 fn catalog_generations(generation: u64) -> BTreeMap<ProviderKind, ProviderCatalogGeneration> {
     BTreeMap::from([(
         ProviderKind::new("alpha").expect("provider"),
@@ -606,6 +677,139 @@ fn discovery_catalog_should_not_reject_an_unlisted_model() {
         .expect("upstream decides model availability");
 }
 
+#[test]
+fn mixed_catalog_should_prefer_known_model_over_discovery_fallback() {
+    let snapshot = mixed_catalog_snapshot();
+    let model = PublicModelId::new("grok-4.7").unwrap();
+    assert!(
+        snapshot
+            .public_models_for_scope(&snapshot.all_account_scope())
+            .contains(&model)
+    );
+
+    let plan = snapshot
+        .plan(
+            &model,
+            &super::operation(),
+            snapshot.all_account_scope(),
+            &Default::default(),
+        )
+        .unwrap();
+
+    assert_eq!(
+        plan.candidates()
+            .iter()
+            .map(|candidate| candidate.provider().as_str())
+            .collect::<Vec<_>>(),
+        ["xai", "openai"]
+    );
+}
+
+#[test]
+fn mixed_catalog_should_prioritize_the_mapped_upstream_model() {
+    let snapshot = mixed_catalog_snapshot();
+    let settings = snapshot
+        .settings()
+        .clone()
+        .with_model_mappings(BTreeMap::from([(
+            "public-model".to_owned(),
+            "grok-4.7".to_owned(),
+        )]));
+    let snapshot = snapshot.with_settings(&settings).unwrap();
+
+    let plan = snapshot
+        .plan(
+            &PublicModelId::new("public-model").unwrap(),
+            &super::operation(),
+            snapshot.all_account_scope(),
+            &Default::default(),
+        )
+        .unwrap();
+
+    assert_eq!(plan.candidates()[0].provider().as_str(), "xai");
+    assert_eq!(
+        plan.candidates()[0].upstream_model().unwrap().as_str(),
+        "grok-4.7"
+    );
+}
+
+#[test]
+fn mixed_catalog_should_keep_discovery_routes_for_unlisted_models() {
+    let snapshot = mixed_catalog_snapshot();
+    let plan = snapshot
+        .plan(
+            &PublicModelId::new("unlisted-model").unwrap(),
+            &super::operation(),
+            snapshot.all_account_scope(),
+            &Default::default(),
+        )
+        .unwrap();
+
+    assert_eq!(plan.candidates().len(), 1);
+    assert_eq!(plan.candidates()[0].provider().as_str(), "openai");
+}
+
+#[test]
+fn mixed_catalog_should_preserve_provider_order_for_shared_models() {
+    let snapshot = mixed_catalog_snapshot();
+    let plan = snapshot
+        .plan(
+            &PublicModelId::new("shared-model").unwrap(),
+            &super::operation(),
+            snapshot.all_account_scope(),
+            &Default::default(),
+        )
+        .unwrap();
+
+    assert_eq!(
+        plan.candidates()
+            .iter()
+            .map(|candidate| candidate.provider().as_str())
+            .collect::<Vec<_>>(),
+        ["openai", "xai"]
+    );
+}
+
+#[test]
+fn mixed_catalog_should_respect_required_provider_before_model_priority() {
+    let snapshot = mixed_catalog_snapshot();
+    let plan = snapshot
+        .plan(
+            &PublicModelId::new("grok-4.7").unwrap(),
+            &super::operation(),
+            snapshot.all_account_scope(),
+            &gateway_core::routing::RoutingContext {
+                required_provider: Some(ProviderKind::new("openai").unwrap()),
+                ..Default::default()
+            },
+        )
+        .unwrap();
+
+    assert_eq!(plan.candidates().len(), 1);
+    assert_eq!(plan.candidates()[0].provider().as_str(), "openai");
+}
+
+#[test]
+fn mixed_catalog_should_respect_blocked_provider_before_model_priority() {
+    let snapshot = mixed_catalog_snapshot();
+    let plan = snapshot
+        .plan(
+            &PublicModelId::new("grok-4.7").unwrap(),
+            &super::operation(),
+            snapshot.all_account_scope(),
+            &gateway_core::routing::RoutingContext {
+                blocked_providers: std::collections::BTreeSet::from([
+                    ProviderKind::new("xai").unwrap()
+                ]),
+                ..Default::default()
+            },
+        )
+        .unwrap();
+
+    assert_eq!(plan.candidates().len(), 1);
+    assert_eq!(plan.candidates()[0].provider().as_str(), "openai");
+}
+
 #[test]
 fn known_empty_catalog_should_report_model_not_found() {
     let compiler = RuntimeSnapshotCompiler::new(

backend/crates/gateway-host/src/config.rs

@@ -81,8 +81,6 @@ pub struct HostConfig {
     pub logging: LoggingConfig,
     #[serde(default)]
     pub system_update: SystemUpdateConfig,
-    #[serde(default = "default_drain_timeout_seconds")]
-    pub drain_timeout_seconds: u64,
     #[serde(default = "default_worker_shutdown_timeout_seconds")]
     pub worker_shutdown_timeout_seconds: u64,
 }
@@ -110,9 +108,6 @@ impl HostConfig {
         if self.listen.port == 0 {
             return Err(ConfigError::InvalidField("host.listen.port"));
         }
-        if self.drain_timeout_seconds == 0 {
-            return Err(ConfigError::InvalidField("host.drain_timeout_seconds"));
-        }
         if self.worker_shutdown_timeout_seconds == 0 {
             return Err(ConfigError::InvalidField(
                 "host.worker_shutdown_timeout_seconds",
@@ -136,11 +131,6 @@ impl HostConfig {
         &self.runtime_data_dir
     }
 
-    #[must_use]
-    pub const fn drain_timeout(&self) -> Duration {
-        Duration::from_secs(self.drain_timeout_seconds)
-    }
-
     #[must_use]
     pub const fn worker_shutdown_timeout(&self) -> Duration {
         Duration::from_secs(self.worker_shutdown_timeout_seconds)
@@ -264,10 +254,6 @@ fn resolve_relative_path(base: &Path, path: &mut PathBuf) {
     }
 }
 
-const fn default_drain_timeout_seconds() -> u64 {
-    30
-}
-
 const fn default_worker_shutdown_timeout_seconds() -> u64 {
     30
 }

backend/crates/gateway-host/src/lib.rs

@@ -164,7 +164,7 @@ impl HostBundle {
         Ok(())
     }
 
-    /// 进程唯一阻塞点；返回前完成 HTTP drain 与 worker join
+    /// 进程唯一阻塞点；停止 HTTP 监听后完成 worker join
     pub async fn serve(self, router: Router) -> Result<(), HostError> {
         let result = serve_router(
             router,
@@ -172,7 +172,6 @@ impl HostBundle {
             self.config.listen.port,
             self.cancellation.clone(),
             Arc::clone(&self.connections),
-            self.config.drain_timeout(),
         )
         .await;
         self.cancellation.cancel();
@@ -181,7 +180,7 @@ impl HostBundle {
             .await;
         match &result {
             Ok(()) => {
-                tracing::info!(target: "gateway_shutdown", pid = std::process::id(), "HTTP 服务与后台任务已停止")
+                tracing::info!(target: "gateway_shutdown", pid = std::process::id(), "HTTP 监听已关闭，后台任务已结束")
             }
             Err(error) => {
                 tracing::error!(target: "gateway_shutdown", pid = std::process::id(), %error, "HTTP 服务异常停止，后台任务已清理")

backend/crates/gateway-host/src/serve.rs

@@ -1,13 +1,12 @@
-//! HTTP 监听、OS signal、原子连接注册与优雅 drain
+//! HTTP 监听、关闭信号与停止时的原子连接注册
 
+use std::sync::Arc;
 use std::sync::atomic::{AtomicUsize, Ordering};
-use std::sync::{Arc, OnceLock};
 use std::time::Duration;
 
 use axum::Router;
 use gateway_core::lifecycle::CancellationToken;
 use gateway_core::lifecycle::{ConnectionDraining, ConnectionGuard, ConnectionLifecycle};
-use tokio::sync::Notify;
 
 const DRAINING_BIT: usize = 1usize << (usize::BITS - 1);
 const ACTIVE_MASK: usize = !DRAINING_BIT;
@@ -24,7 +23,6 @@ pub struct ConnectionTracker {
 
 struct ConnectionState {
     value: AtomicUsize,
-    idle: Notify,
 }
 
 impl ConnectionTracker {
@@ -33,36 +31,14 @@ impl ConnectionTracker {
         Self {
             state: Arc::new(ConnectionState {
                 value: AtomicUsize::new(0),
-                idle: Notify::new(),
             }),
             cancellation,
         }
     }
 
     pub(crate) fn begin_draining(&self) {
-        let previous = self.state.value.fetch_or(DRAINING_BIT, Ordering::AcqRel);
+        self.state.value.fetch_or(DRAINING_BIT, Ordering::AcqRel);
         self.cancellation.cancel();
-        if previous & ACTIVE_MASK == 0 {
-            self.state.idle.notify_waiters();
-        }
-    }
-
-    pub async fn wait_until_idle(&self, timeout: Duration) {
-        let wait = async {
-            loop {
-                let notified = self.state.idle.notified();
-                tokio::pin!(notified);
-                // notify_waiters 不保存许可：必须先 enable 注册等待者，再读
-                // 活跃计数；否则最后一个 guard 在读数与首次 poll 之间 drop
-                // 时唤醒丢失，只能等满整个超时
-                notified.as_mut().enable();
-                if self.state.value.load(Ordering::Acquire) & ACTIVE_MASK == 0 {
-                    return;
-                }
-                notified.await;
-            }
-        };
-        let _ = tokio::time::timeout(timeout, wait).await;
     }
 }
 
@@ -106,10 +82,7 @@ impl ConnectionGuard for ActiveConnection {}
 
 impl Drop for ActiveConnection {
     fn drop(&mut self) {
-        let previous = self.state.value.fetch_sub(1, Ordering::AcqRel);
-        if previous & ACTIVE_MASK == 1 {
-            self.state.idle.notify_waiters();
-        }
+        self.state.value.fetch_sub(1, Ordering::AcqRel);
     }
 }
 
@@ -140,59 +113,26 @@ pub(crate) async fn serve_router(
     port: u16,
     cancellation: CancellationToken,
     connections: Arc<ConnectionTracker>,
-    drain_timeout: Duration,
 ) -> Result<(), ServeError> {
     let listener = bind_listener(&format!("{host}:{port}"))
         .await
         .map_err(ServeError::Bind)?;
     tracing::info!(target: "gateway_startup", pid = std::process::id(), host, port, "网关开始监听");
 
-    let shutdown_cancellation = cancellation.clone();
-    let shutdown_connections = Arc::clone(&connections);
-    let shutdown = async move {
-        wait_for_shutdown(&shutdown_cancellation).await;
-        shutdown_connections.begin_draining();
-    };
-    // axum 的优雅关闭会无限等待存量连接结束，而 SSE 等长响应体不观察
-    // 取消信号：慢客户端可以把关闭拖住直到被 SIGKILL
-    // 整个 drain（axum
-    // 优雅关闭 + 游离 guard 等待）共享同一个从取消信号起算的绝对截止点，
-    // 逾期即放弃等待，存量连接随进程退出终止
-    let drain_deadline_at = Arc::new(OnceLock::new());
-    let drain_deadline = {
-        let cancellation = cancellation.clone();
-        let deadline_at = Arc::clone(&drain_deadline_at);
-        async move {
-            cancellation.cancelled().await;
-            let deadline = tokio::time::Instant::now() + drain_timeout;
-            let _ = deadline_at.set(deadline);
-            tokio::time::sleep_until(deadline).await;
-        }
-    };
+    // 所有关闭入口都停止等待长请求；丢弃 serve 关闭监听，存量连接随进程退出终止
+    // 后台落盘由 Host 的 Worker 关闭阶段独立收尾
     let serve = axum::serve(
         listener,
         router.into_make_service_with_connect_info::<std::net::SocketAddr>(),
-    )
-    .with_graceful_shutdown(shutdown);
-    tokio::select! {
+    );
+    let result = tokio::select! {
         biased;
-        result = serve => {
-            result.map_err(ServeError::Serve)?;
-            connections.begin_draining();
-            let remaining = drain_deadline_at.get().map_or(drain_timeout, |deadline| {
-                deadline.saturating_duration_since(tokio::time::Instant::now())
-            });
-            connections.wait_until_idle(remaining).await;
-        }
-        () = drain_deadline => {
-            tracing::warn!(
-                target: "gateway_shutdown",
-                timeout_secs = drain_timeout.as_secs(),
-                "优雅 drain 超时，放弃等待存量连接"
-            );
-        }
-    }
-    Ok(())
+        () = wait_for_shutdown(&cancellation) => Ok(()),
+        result = serve => result.map_err(ServeError::Serve),
+    };
+    connections.begin_draining();
+    tracing::info!(target: "gateway_shutdown", "停止等待存量连接，后台落盘完成后退出进程");
+    result
 }
 
 pub(crate) async fn wait_for_shutdown(cancellation: &CancellationToken) {

backend/crates/gateway-host/src/system_update/operations.rs

@@ -538,6 +538,7 @@ impl SystemOperations for ProcessSystemOperations {
         let cancellation = self.cancellation.clone();
         drop(tokio::spawn(async move {
             tokio::time::sleep(Duration::from_millis(500)).await;
+            // 留出受理响应返回时间，再走统一关闭流程
             cancellation.cancel();
         }));
         Ok(SystemOperationAccepted::Restart {

backend/crates/gateway-host/tests/config.rs

@@ -127,9 +127,9 @@ fn host_config_derives_update_paths_from_runtime_data_dir() {
 }
 
 #[test]
-fn host_config_rejects_zero_drain_window() {
+fn host_config_rejects_zero_worker_shutdown_window() {
     let mut config = valid_config();
-    config.drain_timeout_seconds = 0;
+    config.worker_shutdown_timeout_seconds = 0;
 
     assert!(
         config
@@ -223,7 +223,6 @@ fn valid_config() -> HostConfig {
             request_dump_retention_days: 1,
         },
         system_update,
-        drain_timeout_seconds: 30,
         worker_shutdown_timeout_seconds: 30,
     }
 }

backend/crates/gateway-host/tests/logging/mod.rs

@@ -51,7 +51,6 @@ fn logging_requires_at_least_one_sink() {
             request_dump_retention_days: 1,
         },
         system_update: SystemUpdateConfig::default(),
-        drain_timeout_seconds: 30,
         worker_shutdown_timeout_seconds: 30,
     };
 
@@ -329,7 +328,6 @@ fn logging_config(directory: PathBuf, request_dump: bool) -> HostConfig {
             request_dump_retention_days: 1,
         },
         system_update: SystemUpdateConfig::default(),
-        drain_timeout_seconds: 30,
         worker_shutdown_timeout_seconds: 30,
     }
 }

backend/crates/gateway-host/tests/serve.rs

@@ -1,4 +1,4 @@
-//! 验证宿主服务关闭时的连接排空、超时与并发唤醒
+//! 验证统一关闭入口跳过会话等待、保留后台落盘及清理超时
 
 use std::sync::Arc;
 use std::sync::Mutex;
@@ -6,17 +6,19 @@ use std::time::Duration;
 
 use axum::{Router, routing::get};
 use futures::future::BoxFuture;
+use gateway_admin::ports::system::{
+    SystemOperationError, SystemRestartPreflight, SystemUpdateCandidate,
+};
 use gateway_core::diagnostics::{OperationalDiagnostics, OperationalFailure};
 use gateway_core::lifecycle::CancellationToken;
-use gateway_core::lifecycle::ConnectionLifecycle as _;
 use gateway_core::task::{
     DaemonRestartPolicy, DaemonTask, WorkerContribution, WorkerId, WorkerKind,
     WorkerLeaderLeasePort, WorkerLeaseAcquisition, WorkerLeaseError, WorkerLeaseRequest,
     WorkerRegistration, WorkerRunnable, WorkerTaskError,
 };
 use gateway_host::HostBundle;
-use gateway_host::serve::{ConnectionTracker, bind_listener};
-use tokio::io::{AsyncReadExt as _, AsyncWriteExt as _};
+use gateway_host::serve::bind_listener;
+use tokio::io::AsyncWriteExt as _;
 use tokio::sync::{Semaphore, mpsc};
 
 use crate::support::host::{configuration, run_in_child};
@@ -28,65 +30,6 @@ fn host_bundle_serve_is_a_consuming_process_entrypoint() {
     assert_eq!(std::mem::size_of_val(&_serve), 0);
 }
 
-#[tokio::test(start_paused = true)]
-async fn wait_until_idle_should_return_immediately_without_active_connections() {
-    let tracker = ConnectionTracker::new(CancellationToken::new());
-    let started = tokio::time::Instant::now();
-
-    tracker.wait_until_idle(Duration::from_secs(30)).await;
-
-    assert_eq!(started.elapsed(), Duration::ZERO);
-}
-
-#[tokio::test(start_paused = true)]
-async fn wait_until_idle_should_give_up_at_timeout_while_connections_remain() {
-    let tracker = ConnectionTracker::new(CancellationToken::new());
-    let _guard = tracker.try_register().expect("register connection");
-    let started = tokio::time::Instant::now();
-
-    tracker.wait_until_idle(Duration::from_secs(30)).await;
-
-    assert_eq!(started.elapsed(), Duration::from_secs(30));
-}
-
-#[tokio::test]
-async fn wait_until_idle_should_wake_when_last_guard_drops_after_first_poll() {
-    let tracker = ConnectionTracker::new(CancellationToken::new());
-    let guard = tracker.try_register().expect("register connection");
-    let mut wait = Box::pin(tracker.wait_until_idle(Duration::from_secs(30)));
-    assert!(futures::poll!(wait.as_mut()).is_pending());
-
-    drop(guard);
-
-    tokio::time::timeout(Duration::from_secs(2), wait)
-        .await
-        .expect("woken by last guard drop instead of waiting out the timeout");
-}
-
-#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
-async fn wait_until_idle_should_observe_guard_drop_racing_the_idle_check() {
-    // 回归约束：notified 必须在读取活跃计数前完成注册（enable），否则最后
-    // 一个 guard 在计数检查与首次 poll 之间 drop 时唤醒丢失，只能等满整个
-    // 超时
-    // 多线程反复交错，任何一次丢唤醒都会撞上 2s 超时并触发断言
-    for _ in 0..256 {
-        let tracker = Arc::new(ConnectionTracker::new(CancellationToken::new()));
-        let guard = tracker.try_register().expect("register connection");
-        let waiter = tokio::spawn({
-            let tracker = Arc::clone(&tracker);
-            async move { tracker.wait_until_idle(Duration::from_secs(2)).await }
-        });
-        let dropper = std::thread::spawn(move || drop(guard));
-        let started = std::time::Instant::now();
-        waiter.await.expect("waiter completes");
-        dropper.join().expect("dropper completes");
-        assert!(
-            started.elapsed() < Duration::from_millis(1_900),
-            "idle wakeup was lost and the waiter slept until the drain timeout"
-        );
-    }
-}
-
 #[tokio::test]
 async fn bind_listener_should_retry_until_previous_listener_releases_port() {
     let holder = tokio::net::TcpListener::bind("127.0.0.1:0")
@@ -110,76 +53,148 @@ async fn bind_listener_should_retry_until_previous_listener_releases_port() {
 }
 
 #[test]
-fn http_drain_keeps_writer_running_until_the_request_finishes() {
+fn cancellation_skips_connections_but_flushes_and_joins_workers() {
     run_in_child(
-        "serve::http_drain_keeps_writer_running_until_the_request_finishes",
-        async {
-            let directory = tempfile::tempdir().unwrap();
-            let (host, address) = listening_host(directory.path()).await;
-            let cancellation = host.cancellation();
-            let connections = host.connection_lifecycle();
-            let probe = start_workers(&host, false);
-            probe.started.cancelled().await;
-            let (router, entered, finish_request) = request_router(&host, &probe);
-            let server = tokio::spawn(host.serve(router));
-            let mut client = connect_request(address).await;
-            entered.cancelled().await;
-
-            cancellation.cancel();
-            wait_for_draining(connections.as_ref()).await;
-            assert!(connections.try_register().is_err());
-            assert!(
-                tokio::time::timeout(Duration::from_millis(50), probe.cancelled.cancelled())
-                    .await
-                    .is_err(),
-                "writer cancelled before the in-flight request finished"
-            );
-            finish_request.add_permits(1);
-            let mut response = String::new();
-            client.read_to_string(&mut response).await.unwrap();
-            server.await.unwrap().unwrap();
-
-            assert!(response.starts_with("HTTP/1.1 200 OK"));
-            assert_eq!(*probe.writes.lock().unwrap(), [1]);
-            assert!(probe.finished.is_cancelled());
-        },
+        "serve::cancellation_skips_connections_but_flushes_and_joins_workers",
+        shutdown_with_pending_request(ShutdownTrigger::Cancellation),
     );
 }
 
 #[test]
-fn drain_timeout_starts_a_separate_worker_shutdown_phase() {
+fn self_restart_skips_connections_but_flushes_and_joins_workers() {
     run_in_child(
-        "serve::drain_timeout_starts_a_separate_worker_shutdown_phase",
+        "serve::self_restart_skips_connections_but_flushes_and_joins_workers",
+        shutdown_with_pending_request(ShutdownTrigger::SelfRestart),
+    );
+}
+
+#[cfg(unix)]
+#[test]
+fn sigterm_skips_connections_but_flushes_and_joins_workers() {
+    run_in_child(
+        "serve::sigterm_skips_connections_but_flushes_and_joins_workers",
+        shutdown_with_pending_request(ShutdownTrigger::Signal("-TERM")),
+    );
+}
+
+#[cfg(unix)]
+#[test]
+fn sigint_skips_connections_but_flushes_and_joins_workers() {
+    run_in_child(
+        "serve::sigint_skips_connections_but_flushes_and_joins_workers",
+        shutdown_with_pending_request(ShutdownTrigger::Signal("-INT")),
+    );
+}
+
+enum ShutdownTrigger {
+    Cancellation,
+    SelfRestart,
+    #[cfg(unix)]
+    Signal(&'static str),
+}
+
+async fn shutdown_with_pending_request(trigger: ShutdownTrigger) {
+    let directory = tempfile::tempdir().unwrap();
+    let reservation = std::net::TcpListener::bind("127.0.0.1:0").unwrap();
+    let address = reservation.local_addr().unwrap();
+    let mut config = configuration(directory.path());
+    config.listen.port = address.port();
+    config.system_update.deployment_mode = "docker".to_owned();
+    config.system_update.build_type = "source".to_owned();
+    config.system_update.self_restart_enabled = true;
+    config.system_update.update_lock_file = directory.path().join("update.lock");
+    let host = gateway_host::initialize(config).await.unwrap();
+    drop(reservation);
+    let system = host.system_operations();
+    let cancellation = host.cancellation();
+    let connections = host.connection_lifecycle();
+    let guard = connections.try_register().unwrap();
+    let probe = start_workers(&host, true);
+    probe.started.cancelled().await;
+    let (router, entered, _finish_request) = request_router(&host, &probe);
+    let server = tokio::spawn(host.serve(router));
+    let client = connect_request(address).await;
+    entered.cancelled().await;
+    probe.sender.send(7).unwrap();
+
+    match trigger {
+        ShutdownTrigger::Cancellation => cancellation.cancel(),
+        ShutdownTrigger::SelfRestart => {
+            system.restart(Arc::new(AllowRestart)).await.unwrap();
+        }
+        #[cfg(unix)]
+        ShutdownTrigger::Signal(signal) => {
+            // 真实请求进入后信号监听已被 poll，只向隔离的当前测试子进程发送信号
+            assert!(
+                std::process::Command::new("kill")
+                    .args([signal, &std::process::id().to_string()])
+                    .status()
+                    .unwrap()
+                    .success()
+            );
+        }
+    }
+    tokio::time::timeout(Duration::from_secs(2), probe.cancelled.cancelled())
+        .await
+        .expect("shutdown must not wait for the blocked HTTP request or live guard");
+    assert!(connections.is_draining());
+    assert!(connections.try_register().is_err());
+    drop(guard);
+    assert!(connections.try_register().is_err());
+    assert!(
+        tokio::net::TcpStream::connect(address).await.is_err(),
+        "listener must close before worker cleanup finishes"
+    );
+    assert!(
+        !server.is_finished(),
+        "worker cleanup still needs to finish"
+    );
+    probe.finish_shutdown.add_permits(1);
+    server.await.unwrap().unwrap();
+    assert_eq!(*probe.writes.lock().unwrap(), [7]);
+    assert!(probe.finished.is_cancelled());
+    // 请求仍未结束，独立进程退出时终止连接和挂起 handler
+    drop(client);
+}
+
+#[test]
+fn shutdown_aborts_workers_that_exceed_the_cleanup_budget() {
+    run_in_child(
+        "serve::shutdown_aborts_workers_that_exceed_the_cleanup_budget",
         async {
             let directory = tempfile::tempdir().unwrap();
             let (host, address) = listening_host(directory.path()).await;
             let cancellation = host.cancellation();
-            let connections = host.connection_lifecycle();
             let probe = start_workers(&host, true);
             probe.started.cancelled().await;
-            let (router, entered, finish_request) = request_router(&host, &probe);
+            let (router, entered, _finish_request) = request_router(&host, &probe);
             let server = tokio::spawn(host.serve(router));
             let client = connect_request(address).await;
             entered.cancelled().await;
-
-            let started = tokio::time::Instant::now();
             cancellation.cancel();
-            wait_for_draining(connections.as_ref()).await;
-            probe.cancelled.cancelled().await;
-            assert!(started.elapsed() >= Duration::from_secs(1));
-            assert!(!server.is_finished(), "worker cleanup was not joined");
-            assert!(!probe.finished.is_cancelled());
-            probe.finish_shutdown.add_permits(1);
-            server.await.unwrap().unwrap();
-            assert!(probe.finished.is_cancelled());
 
-            // 超时后真实连接可以仍在 axum 任务中；释放测试端，避免遗留挂起 handler
+            tokio::time::timeout(Duration::from_secs(3), server)
+                .await
+                .expect("worker cleanup budget must bound process shutdown")
+                .unwrap()
+                .unwrap();
+            probe.dropped.cancelled().await;
+            assert!(probe.cancelled.is_cancelled());
+            assert!(!probe.finished.is_cancelled());
             drop(client);
-            finish_request.add_permits(1);
         },
     );
 }
 
+struct AllowRestart;
+
+#[async_trait::async_trait]
+impl SystemRestartPreflight for AllowRestart {
+    async fn prepare(&self, _: Option<SystemUpdateCandidate>) -> Result<(), SystemOperationError> {
+        Ok(())
+    }
+}
+
 #[test]
 fn bind_failure_cancels_and_joins_workers_before_returning() {
     run_in_child(
@@ -291,12 +306,6 @@ async fn connect_request(address: std::net::SocketAddr) -> tokio::net::TcpStream
     client
 }
 
-async fn wait_for_draining(connections: &dyn gateway_core::lifecycle::ConnectionLifecycle) {
-    while !connections.is_draining() {
-        tokio::task::yield_now().await;
-    }
-}
-
 fn request_router(
     host: &HostBundle,
     probe: &WriterProbe,
@@ -319,7 +328,7 @@ fn request_router(
                     let _connection = connections.try_register().unwrap();
                     entered.cancel();
                     finish.acquire().await.unwrap().forget();
-                    // 对应请求结束后写入终态的时机；drain 超时后的写入允许被拒绝
+                    // 对应请求结束后写入终态的时机；关闭开始后的写入允许被拒绝
                     if sender.send(1).is_ok() {
                         "recorded"
                     } else {

backend/crates/gateway-host/tests/support/host.rs

@@ -59,7 +59,6 @@ pub fn configuration(directory: &Path) -> HostConfig {
             request_dump_retention_days: 1,
         },
         system_update: Default::default(),
-        drain_timeout_seconds: 1,
         worker_shutdown_timeout_seconds: 1,
     }
 }

backend/crates/gateway-host/tests/workers.rs

@@ -19,12 +19,13 @@ use gateway_core::task::{
 use gateway_host::workers::{WorkerStartError, WorkerSupervisor};
 use tokio::sync::Notify;
 
-const ACTIVE_KINDS: [WorkerKind; 9] = [
+const ACTIVE_KINDS: [WorkerKind; 10] = [
     WorkerKind::OAuthRefresh,
     WorkerKind::QuotaCatalogHealth,
     WorkerKind::RuntimeSnapshotReconciliation,
     WorkerKind::RuntimeChangeSubscription,
     WorkerKind::StaleModelRequestRecovery,
+    WorkerKind::RequestAnalytics,
     WorkerKind::Retention,
     WorkerKind::Backup,
     WorkerKind::AccountImport,

backend/crates/gateway-plugin/runtime/plugin-api-deprecations.json

@@ -1,20 +1 @@
-[
-  {
-    "capability": "middleware",
-    "version": 3,
-    "replacement_version": 4,
-    "introduced_in": "3.20.0",
-    "last_counted_in": "3.22.0",
-    "remaining_releases": 2,
-    "migration": "将执行设置和来源中的 disable_fast 改为 fast_mode，使用 default、enabled、disabled 三态，并将 middleware 声明升级到 v4"
-  },
-  {
-    "capability": "upstream_adapter",
-    "version": 1,
-    "replacement_version": 2,
-    "introduced_in": "3.20.0",
-    "last_counted_in": "3.22.0",
-    "remaining_releases": 2,
-    "migration": "使用新版 SDK 读取 fast_mode 三态，并将 upstream_adapter 声明升级到 v2"
-  }
-]
+[]

backend/crates/gateway-plugin/runtime/plugin-host-compatibility.json

@@ -8,8 +8,8 @@
     { "capability": "model_router", "versions": [1] },
     { "capability": "model_catalog", "versions": [1] },
     { "capability": "retry_policy", "versions": [1] },
-    { "capability": "middleware", "versions": [3, 4] },
-    { "capability": "upstream_adapter", "versions": [1, 2] },
+    { "capability": "middleware", "versions": [4] },
+    { "capability": "upstream_adapter", "versions": [2] },
     { "capability": "observer", "versions": [1] },
     { "capability": "command_line", "versions": [1] },
     { "capability": "management", "versions": [1] },

backend/crates/gateway-plugin/runtime/src/adapter/middleware/http.rs

@@ -33,12 +33,7 @@ pub(super) async fn invoke(
         .extensions()
         .get::<core::Settings>()
         .and_then(|settings| settings.runtime.as_ref())
-        .map(|settings| {
-            crate::compatibility::FastSettings::middleware(&ports.session).sources(settings)
-        })
-        .transpose()
-        .map_err(|_| MiddlewareError::InvalidState)?
-        .unwrap_or(serde_json::Value::Null);
+        .map_or(serde_json::Value::Null, |settings| settings.inspect());
     let (invocation, request) = Invocation::new(request, next, entry.instance_id.clone())?;
     let mut call = ports.session.context(Stage::Http, timeout);
     call.request_id = Some(context.request_id.clone());