chore(release): v3.28.0

Co-authored-by: Codex <noreply@openai.com>
test(store): make group capacity fixtures independent of defaults
2026-11-07 08:05:32 +00:00 · 2026-10-16 17:15:10 +08:00 · 2026-10-16 17:15:05 +08:00 · 2026-10-16 17:07:59 +08:00 · 2026-10-16 16:59:33 +08:00 · 2026-10-16 16:55:42 +08:00
762 changed files with 42022 additions and 11013 deletions
@@ -6,7 +6,7 @@
 ## 清单与处理器

 - `publisher` 与机器短名 `name` 派生插件 ID，`displayName` 用于展示；复制示例后同时调整扩展项 ID 与注册结果
- `contributes` 每种能力最多一项，普通贡献项可省略派生 ID、能力版本和固定阶段；中间件必须声明版本 `3` 并显式选择阶段。自定义完整扩展项 ID 属于自己的插件命名空间，运行注册与规范化清单一致
+- `contributes` 每种能力最多一项，普通贡献项可省略派生 ID、能力版本和固定阶段；中间件必须声明版本 `4` 并显式选择阶段，上游适配器必须声明版本 `2`。自定义完整扩展项 ID 属于自己的插件命名空间，运行注册与规范化清单一致
 - 作者清单用 `Manifest::from_author_slice` 规范化，不手写 `package`、固定阶段或重复注册；CLI 生成平台、协议与资源摘要，版本范围不能使用全版本通配
 - 安装后宿主会按 `configurationSchema` 准备默认配置，配置完整即可启用；默认绑定的空范围不限制请求。需要业务参数时声明真实必填项，通过 `secretFields` 声明敏感字段，不依赖用户再走一遍自建安装向导
 - Rust 插件只依赖公开 `gateway-plugin-sdk`；需要异步会话辅助时开启 `io`，使用 `PluginSession` 管理握手、回调关联、流控、取消和关闭
@@ -42,8 +42,11 @@ else
  mkdir -p "$(dirname "$directory")"
  temporary="$(mktemp -d "${directory}.XXXXXX")"
  trap 'rm -rf "$temporary"' EXIT
-  mkdir "$temporary/context"
-  "${command[@]}" --output "type=local,dest=$temporary/snapshot" "$temporary/context"
+  mkdir "$temporary"/{context,snapshot}
+  # tar 流避开 local exporter 的逐文件同步阻塞，直接解包以免额外落盘整份归档。
+  # https://github.com/moby/buildkit/issues/2950
+  "${command[@]}" --output type=tar,dest=- "$temporary/context" \
+    | tar -xf - -C "$temporary/snapshot"
  if usable "$temporary/snapshot"; then
    rm -rf "$directory"
    mv "$temporary/snapshot" "$directory"
@@ -177,8 +177,6 @@ jobs:
          host_path = "backend/crates/gateway-plugin/runtime/plugin-host-compatibility.json"
          host = JSON.parse(File.read(host_path))
          abort "Invalid plugin host compatibility declaration: #{host_path}" unless host["schema_version"] == 2
-          # 保留旧更新器可解析的传输格式，实际支持范围仍取自当前宿主合同。
-          host = host.merge("schema_version" => 1, "permissions" => [])
          # 清单只依赖版本与兼容声明，平台归档和镜像消费同一份封口结果。
          manifest = {
            "schema_version" => 1,
@@ -145,6 +145,18 @@ dependencies = [
 "serde_json",
 ]

+[[package]]
+name = "async-compression"
+version = "0.4.50"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee19bd99b43e3691acbad4e840420a4881cea6c0b66a208125a824f8fd53f5a1"
+dependencies = [
+ "compression-codecs",
+ "compression-core",
+ "pin-project-lite",
+ "tokio",
+]
+
 [[package]]
 name = "async-lock"
 version = "3.4.2"
@@ -931,6 +943,23 @@ dependencies = [
 "tokio-util",
 ]

+[[package]]
+name = "compression-codecs"
+version = "0.4.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "98fc98460ba0ad5317075d3632b8dfc45d0be8c4a49347c2a38272019717614a"
+dependencies = [
+ "compression-core",
+ "flate2",
+ "memchr",
+]
+
+[[package]]
+name = "compression-core"
+version = "0.4.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e8ccc4ea9f6acc32d102c0f6d471d11d913ad15f20c04de743374861fa1d414"
+
 [[package]]
 name = "config"
 version = "0.15.27"
@@ -1681,6 +1710,7 @@ dependencies = [
 "gateway-core",
 "heck",
 "hex",
+ "hkdf",
 "prettyplease",
 "quote",
 "rand_core 0.6.4",
@@ -1716,6 +1746,7 @@ dependencies = [
 "http",
 "http-body",
 "http-body-util",
+ "regex",
 "secrecy",
 "serde",
 "serde_json",
@@ -1980,9 +2011,9 @@ dependencies = [

 [[package]]
 name = "h2"
-version = "0.4.19"
+version = "0.4.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef8e5e5a340588f4452631496976cf8636d4a7ecf600239fdc27615d2530bc16"
+checksum = "7d29020232d6aa3fb1daca64c1127cf662cf97f254ae16c18c05b8ab635fc118"
 dependencies = [
 "atomic-waker",
 "bytes",
@@ -2446,9 +2477,9 @@ dependencies = [

 [[package]]
 name = "jsonschema"
-version = "0.58.4"
+version = "0.58.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5761b0ca0a31464030d7c2a98087fde3124ebb5e09b5a112cdb815f03b8ee150"
+checksum = "f622c574a29fb3034a0a90645afee194dfedc75fc124228801b6e77041075bd1"
 dependencies = [
 "ahash",
 "bytecount",
@@ -2474,18 +2505,18 @@ dependencies = [

 [[package]]
 name = "jsonschema-regex"
-version = "0.58.5"
+version = "0.58.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "854e9e22c420535035e95eed240cbfb4a5f4b7da74d122d63144e0c31926dbfd"
+checksum = "a968fffd387b2ab005bf00c1851f5d26e90df05b6f7ad609ed0d620033cca5e7"
 dependencies = [
 "regex-syntax",
 ]

 [[package]]
 name = "jsonschema-value"
-version = "0.58.5"
+version = "0.58.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4e3bfac11ac357ec620880025757d38c67da8fd5b9ef5024d19f0f360002b4ca"
+checksum = "39b7670345e5ce87371339d13705dbb9276b7e3e934bbe1efa2c6734a1f65a96"
 dependencies = [
 "ahash",
 "bytecount",
@@ -3289,6 +3320,7 @@ dependencies = [
 "native-tls",
 "openssl",
 "openssl-sys",
+ "regex",
 "reqwest",
 "roxmltree",
 "rustls",
@@ -3400,9 +3432,9 @@ dependencies = [

 [[package]]
 name = "quinn-proto"
-version = "0.11.16"
+version = "0.11.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f4bfc015262b9df63c8845072ce59068853ff5872180c2ce2f13038b970e560"
+checksum = "a9746dbde176634f4f2f1faf2404e30a31b2bc1e9cafb5329c95d8177a18c9fc"
 dependencies = [
 "bytes",
 "getrandom 0.4.3",
@@ -3586,9 +3618,9 @@ dependencies = [

 [[package]]
 name = "referencing"
-version = "0.58.5"
+version = "0.58.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "590efadb0a669f1712c1e3ab810a55d4c3d20d0127c455f7236dd0710aba0346"
+checksum = "558f3855529c0a7e78a48e409fa653456e55f1b167eab4109c16a255b7727e3f"
 dependencies = [
 "ahash",
 "fluent-uri",
@@ -3603,9 +3635,9 @@ dependencies = [

 [[package]]
 name = "regex"
-version = "1.13.0"
+version = "1.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a0e75113e14dc5acb068cd0786884f214f1312650a3d36d269f5c4f3cdee8a2"
+checksum = "f020237b6c8eed93db2e2cb53c00c60a8e1bc73da7d073199a1180401450218d"
 dependencies = [
 "aho-corasick",
 "memchr",
@@ -3748,9 +3780,9 @@ dependencies = [

 [[package]]
 name = "rustls"
-version = "0.23.45"
+version = "0.23.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634"
+checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf"
 dependencies = [
 "aws-lc-rs",
 "log",
@@ -4503,7 +4535,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
 "fastrand",
- "getrandom 0.3.4",
+ "getrandom 0.4.3",
 "once_cell",
 "rustix",
 "windows-sys 0.61.2",
@@ -4741,6 +4773,7 @@ version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "08a05a66a4fdd61cbbe0a1d755ffe0ca6aba159dd4820936a0ff8a8278245b9c"
 dependencies = [
+ "async-compression",
 "bitflags",
 "bytes",
 "futures-core",
@@ -5005,9 +5038,9 @@ checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"

 [[package]]
 name = "uuid"
-version = "1.26.1"
+version = "1.27.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ef6dac1e96601b4fb3acccccff2139741fcb757cb9a36089bf5be91cfb285ce"
+checksum = "97277d36b9c3ace13e58fa6e753f8b0bbbf302a18dd193240d70f9e29681059a"
 dependencies = [
 "getrandom 0.4.3",
 "js-sys",
@@ -5545,9 +5578,9 @@ dependencies = [

 [[package]]
 name = "zeroize"
-version = "1.9.0"
+version = "1.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
+checksum = "e13084392c5e4bc371903e2935a5eaeed24905a7511356b883835e18a78f6879"
 dependencies = [
 "zeroize_derive",
 ]
@@ -107,7 +107,7 @@ async fn execute(
    let settings = gateway_admin::initialize_settings(
        store.admin_ports().settings(),
        core.snapshot_control(),
-        providers.admin,
+        providers.admin.clone(),
        std::sync::Arc::new(gateway_host::pricing::ModelsDevPricing),
    );
    let mut services = gateway_admin::public_service::Registry::new(service_middleware(
@@ -115,6 +115,12 @@ async fn execute(
        &plugin_runtime,
    ));
    or_shutdown!(plugin_runtime, services.register_settings(&settings));
+    let usage_data = gateway_admin::initialize_usage_data(
+        store.admin_ports().usage_data(),
+        store.admin_ports().settings(),
+        providers.admin,
+    );
+    or_shutdown!(plugin_runtime, services.register_usage_data(&usage_data));
    let services = std::sync::Arc::new(services);
    or_shutdown!(plugin_runtime, plugin_runtime.bind_services(&services));
    let commands = or_shutdown!(plugin_runtime, plugin_runtime.prepare_command_line().await);
@@ -56,6 +56,12 @@ pub async fn run() -> Result<(), BootstrapError> {
        plugin_runtime,
        gateway_host::plugin_distribution::HttpPluginDistribution::new(plugin_http)
    ));
+    let analytics_worker = or_shutdown!(
+        plugin_runtime,
+        store.request_analytics_worker(std::sync::Arc::new(
+            gateway_admin::ProviderUsageBillingProjector::new(providers.admin.clone()),
+        ))
+    );
    let mut admin = or_shutdown!(
        plugin_runtime,
        gateway_admin::initialize_with_plugin_accounts(
@@ -142,6 +148,7 @@ pub async fn run() -> Result<(), BootstrapError> {
    );

    let mut plan = store.take_worker_contributions();
+    plan.push(analytics_worker);
    plan.push(or_shutdown!(
        plugin_runtime,
        gateway_host::retention::worker(store.retention())
@@ -4,6 +4,7 @@ use std::{
    collections::{BTreeMap, BTreeSet},
    fs,
    path::{Path, PathBuf},
+    sync::OnceLock,
 };

 use syn::{Item, visit::Visit};
@@ -26,22 +27,24 @@ pub(super) const WORKSPACE_MEMBERS: &[&str] = &[

 #[test]
 fn workspace_member_list_matches_the_frozen_dag_scope() {
-    let manifest =
-        fs::read_to_string(backend_root().join("Cargo.toml")).expect("read workspace manifest");
-    for member in WORKSPACE_MEMBERS {
-        assert!(
-            manifest.contains(&format!("\"{member}\"")),
-            "workspace must include {member}"
-        );
-    }
-    let member_count = manifest
-        .lines()
-        .map(str::trim)
-        .filter(|line| line.starts_with("\"apps/") || line.starts_with("\"crates/"))
-        .count();
+    let metadata = cargo_metadata_json();
+    let root = backend_root();
+    let actual: BTreeSet<_> = metadata["packages"]
+        .as_array()
+        .expect("Cargo packages")
+        .iter()
+        .map(|package| {
+            Path::new(package["manifest_path"].as_str().expect("package manifest"))
+                .parent()
+                .expect("package directory")
+                .strip_prefix(&root)
+                .expect("workspace member path")
+                .to_path_buf()
+        })
+        .collect();
    assert_eq!(
-        member_count,
-        WORKSPACE_MEMBERS.len(),
+        actual,
+        WORKSPACE_MEMBERS.iter().map(PathBuf::from).collect(),
        "new workspace members must extend the dependency DAG rules"
    );
 }
@@ -378,7 +381,7 @@ const ALLOWED_INTERNAL_EDGES: &[(&str, &str)] = &[
 #[test]
 fn workspace_internal_dependency_edges_match_frozen_dag() {
    let metadata = cargo_metadata_json();
-    let actual = workspace_runtime_dependency_edges(&metadata);
+    let actual = workspace_runtime_dependency_edges(metadata);
    let mut expected: Vec<(String, String)> = ALLOWED_INTERNAL_EDGES
        .iter()
        .map(|(from, to)| ((*from).to_owned(), (*to).to_owned()))
@@ -474,24 +477,6 @@ fn adapter_public_module_surfaces_match_allowlist() {
    }
 }

-#[test]
-fn production_sources_do_not_host_tests() {
-    for member in WORKSPACE_MEMBERS {
-        let src = backend_root().join(member).join("src");
-        let sources = super::rust_files(&src);
-        assert!(!sources.is_empty(), "{member} has no production sources");
-        for relative in sources {
-            let path = src.join(relative);
-            let source = fs::read_to_string(&path).expect("read production source");
-            assert!(
-                !source.contains("#[cfg(test)]"),
-                "{} hosts tests in production src",
-                path.display()
-            );
-        }
-    }
-}
-
 #[test]
 fn workspace_modules_follow_conventional_file_layout() {
    let targets = test_source_roots();
@@ -748,40 +733,46 @@ pub(super) fn backend_root() -> PathBuf {
        .expect("backend workspace root")
 }

-fn cargo_metadata_json() -> serde_json::Value {
-    let output = std::process::Command::new("cargo")
-        .args(["metadata", "--format-version", "1", "--no-deps"])
-        .current_dir(backend_root())
-        .output()
-        .expect("run cargo metadata");
-    assert!(
-        output.status.success(),
-        "cargo metadata failed: {}",
-        String::from_utf8_lossy(&output.stderr)
-    );
-    serde_json::from_slice(&output.stdout).expect("parse cargo metadata")
+fn cargo_metadata_json() -> &'static serde_json::Value {
+    static METADATA: OnceLock<serde_json::Value> = OnceLock::new();
+    METADATA.get_or_init(|| {
+        let output = std::process::Command::new("cargo")
+            .args(["metadata", "--format-version", "1", "--no-deps", "--locked"])
+            .current_dir(backend_root())
+            .output()
+            .expect("run cargo metadata");
+        assert!(
+            output.status.success(),
+            "cargo metadata failed: {}",
+            String::from_utf8_lossy(&output.stderr)
+        );
+        serde_json::from_slice(&output.stdout).expect("parse cargo metadata")
+    })
 }

-/// 提取成员 `[dependencies]` 段内声明的依赖名;段落以下一个 `[` 表头结束
+/// 复用 Cargo 解析后的实际包名，覆盖重命名依赖与平台条件，排除测试和构建依赖
 fn dependency_names(member: &str) -> Vec<String> {
-    let manifest = fs::read_to_string(backend_root().join(member).join("Cargo.toml"))
-        .expect("read member manifest");
-    let mut in_dependencies = false;
-    let mut names = Vec::new();
-    for line in manifest.lines() {
-        let line = line.trim();
-        if line.starts_with('[') {
-            in_dependencies = line == "[dependencies]";
-            continue;
-        }
-        if !in_dependencies || line.is_empty() || line.starts_with('#') {
-            continue;
-        }
-        if let Some((name, _)) = line.split_once('=') {
-            names.push(name.trim().to_owned());
-        }
-    }
-    names
+    let manifest = backend_root().join(member).join("Cargo.toml");
+    let package = cargo_metadata_json()["packages"]
+        .as_array()
+        .expect("Cargo packages")
+        .iter()
+        .find(|package| {
+            Path::new(package["manifest_path"].as_str().expect("package manifest")) == manifest
+        })
+        .expect("workspace member");
+    package["dependencies"]
+        .as_array()
+        .expect("package dependencies")
+        .iter()
+        .filter(|dependency| dependency["kind"].is_null())
+        .map(|dependency| {
+            dependency["name"]
+                .as_str()
+                .expect("dependency name")
+                .to_owned()
+        })
+        .collect()
 }

 fn assert_no_dependency(member: &str, forbidden: &[&str]) {
@@ -59,9 +59,16 @@ fn cargo_library_root_is_conventional_lib() {
 fn workspace_production_files_have_no_hidden_modules_or_test_hooks() {
    for member in architecture::WORKSPACE_MEMBERS {
        let root = architecture::backend_root().join(member).join("src");
-        for relative in rust_files(&root) {
+        let sources = rust_files(&root);
+        assert!(!sources.is_empty(), "{member} has no production sources");
+        for relative in sources {
            let path = root.join(relative);
            let source = fs::read_to_string(&path).expect("read production source");
+            assert!(
+                !source.contains("#[cfg(test)]"),
+                "{} hosts tests in production src",
+                path.display()
+            );
            assert!(
                !source.contains("include!("),
                "{} uses include!",
@@ -21,6 +21,7 @@ futures = "0.3.32"
 gateway-core = { path = "../gateway-core" }
 heck = "0.5.0"
 hex = "0.4.3"
+hkdf = "0.13.0"
 rand_core = { version = "0.6.4", features = ["getrandom"] }
 serde = { version = "1.0.228", features = ["derive"] }
 serde_json = { version = "1.0.150", features = ["arbitrary_precision", "preserve_order"] }
@@ -491,11 +491,13 @@ impl BackupTask {
            )
            .await
        {
-            let _ = store.delete_object(&config, &record.object_key).await;
-            self.fail_task(
+            self.fail_uploaded_task(
                record,
-                error.code(),
-                format!("上传到对象存储失败：{}", error.message()),
+                &config,
+                BackupError::new(
+                    error.code(),
+                    format!("上传到对象存储失败：{}", error.message()),
+                ),
            )
            .await?;
            return Ok(());
@@ -533,16 +535,19 @@ impl BackupTask {
                    sha256_matches,
                    "备份远端对象校验不一致"
                );
-                let _ = store.delete_object(&config, &record.object_key).await;
-                self.fail_task(
+                self.fail_uploaded_task(
                    record,
-                    code::REMOTE_VERIFICATION_FAILED,
-                    match (size_matches, sha256_matches) {
-                        (false, true) => "远端对象大小不一致",
-                        (true, false) => "远端对象 sha256 校验值不一致",
-                        (false, false) => "远端对象大小和 sha256 校验值均不一致",
-                        (true, true) => "远端对象校验状态异常",
-                    },
+                    &config,
+                    BackupError::new(
+                        code::REMOTE_VERIFICATION_FAILED,
+                        match (size_matches, sha256_matches) {
+                            (false, true) => "远端对象大小不一致",
+                            (true, false) => "远端对象 sha256 校验值不一致",
+                            (false, false) => "远端对象大小和 sha256 校验值均不一致",
+                            (true, true) => "远端对象校验状态异常",
+                        }
+                        .to_owned(),
+                    ),
                )
                .await?;
            }
@@ -556,11 +561,13 @@ impl BackupTask {
                .await?;
            }
            Err(error) => {
-                let _ = store.delete_object(&config, &record.object_key).await;
-                self.fail_task(
+                self.fail_uploaded_task(
                    record,
-                    error.code(),
-                    format!("远端对象校验失败：{}", error.message()),
+                    &config,
+                    BackupError::new(
+                        error.code(),
+                        format!("远端对象校验失败：{}", error.message()),
+                    ),
                )
                .await?;
            }
@@ -568,6 +575,24 @@ impl BackupTask {
        Ok(())
    }

+    /// 清理失败并入原终态，后续清理沿用备份记录的到期策略
+    async fn fail_uploaded_task(
+        &self,
+        record: &BackupRecord,
+        config: &BackupStorageConfig,
+        mut error: BackupError,
+    ) -> Result<(), WorkerTaskError> {
+        if let Err(cleanup) = self
+            .object_store
+            .delete_object(config, &record.object_key)
+            .await
+        {
+            error =
+                error.with_cleanup_failure("DeleteObject", &cleanup, record.expires_at.is_some());
+        }
+        self.fail_task(record, error.code(), error.message()).await
+    }
+
    /// 把活跃任务写入失败终态并清理暂存
    async fn fail_task(
        &self,
@@ -35,10 +35,11 @@ pub use use_case::{
    client_keys::ClientKeyService,
    credentials::{CredentialsService, ProviderCredentials},
    import_tasks::ImportTasksService,
-    observability::ObservabilityService,
+    observability::{ObservabilityService, ProviderUsageBillingProjector},
    proxies::ProxiesService,
    settings::SettingsService,
    system::SystemService,
+    usage_data::UsageDataService,
 };

 use model::AdminError;
@@ -217,6 +218,7 @@ pub struct AdminServices {
    client_distribution: Arc<dyn ClientDistributionService>,
    observability: Arc<dyn ObservabilityService>,
    settings: Arc<dyn SettingsService>,
+    usage_data: Arc<dyn UsageDataService>,
    system: Arc<dyn SystemService>,
    credentials: Arc<CredentialsService>,
    // Runtime 只持有 Weak，这个强引用保障账号端口与 Admin 服务同寿命
@@ -285,6 +287,11 @@ impl AdminServices {
        self.client_distribution.as_ref()
    }

+    #[must_use]
+    pub fn usage_data(&self) -> &dyn UsageDataService {
+        self.usage_data.as_ref()
+    }
+
    #[must_use]
    pub fn observability(&self) -> &dyn ObservabilityService {
        self.observability.as_ref()
@@ -405,9 +412,7 @@ async fn initialize_inner(
    let registry = providers;

    let auth = Arc::new(DefaultAuthService::new(
-        config.default_username,
-        config.session_ttl_minutes,
-        config.session_absolute_ttl_minutes,
+        &config,
        client_config.session_ttl_minutes,
        store.auth(),
        client_key_verifier.clone(),
@@ -441,11 +446,14 @@ async fn initialize_inner(
        plugin_inspector.clone(),
    ));
    let system = Arc::new(DefaultSystemService::new(system, system_preflight));
+    let observations: Arc<dyn ports::store::ObservabilityStore> = Arc::new(
+        use_case::observability::CachedObservabilityStore::new(store.observability()),
+    );
    let key_usage = Arc::new(use_case::key_usage::DefaultKeyUsageService::new(
        auth.clone(),
        client_key_verifier,
        store.client_keys(),
-        store.observability(),
+        observations.clone(),
        system.clone(),
        timezone,
    ));
@@ -466,8 +474,10 @@ async fn initialize_inner(
        registry.clone(),
        pricing_source,
    );
+    let usage_data = initialize_usage_data(store.usage_data(), store.settings(), registry.clone());
    let mut public_services = public_service::Registry::new(service_middleware);
    public_services.register_settings(&settings)?;
+    public_services.register_usage_data(&usage_data)?;
    let services = AdminServices {
        timezone,
        public_services: Arc::new(public_services),
@@ -506,13 +516,15 @@ async fn initialize_inner(
        )),
        client_distribution: Arc::new(DefaultClientDistributionService::new(client_distribution)),
        observability: Arc::new(DefaultObservabilityService::new(
-            store.observability(),
+            observations.clone(),
            store.accounts(),
            store.settings(),
            registry.clone(),
            timezone,
+            system.clone(),
        )),
        settings,
+        usage_data,
        system,
        credentials,
        _plugin_accounts: plugin_accounts,
@@ -643,3 +655,15 @@ pub fn initialize_settings(
        pricing_source,
    ))
 }
+
+/// HTTP、插件及 CLI 共用的用量领域用例，宿主提供已验证的调用主体
+#[must_use]
+pub fn initialize_usage_data(
+    store: Arc<dyn ports::usage_data::UsageDataStore>,
+    settings: Arc<dyn ports::store::SettingsStore>,
+    providers: ProviderAdminRegistry,
+) -> Arc<dyn UsageDataService> {
+    Arc::new(use_case::usage_data::DefaultUsageDataService::new(
+        store, settings, providers,
+    ))
+}
@@ -66,7 +66,7 @@ pub struct AccountGroupCapacity {
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct AccountGroupUsage {
    pub today_usd: DecimalAmount,
-    /// 当前 usage retention 窗口内、按请求发生时 routing group 快照归属的累计成本
+    /// 当前 usage retention 窗口内、当前组成员实际完成请求的累计成本
    pub retained_total_usd: DecimalAmount,
 }

@@ -100,6 +100,7 @@ pub struct AccountGroupListQuery {
 /// 完整账号分组摘要
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct AccountGroupRecord {
+    pub allow_image_generation: bool,
    pub fast_mode: FastMode,
    pub id: AccountGroupId,
    pub name: String,
@@ -139,6 +140,7 @@ pub struct AccountGroupOptionsPage {
 /// 创建账号分组
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct CreateAccountGroup {
+    pub allow_image_generation: bool,
    pub fast_mode: FastMode,
    pub name: String,
    pub description: Option<String>,
@@ -148,6 +150,7 @@ pub struct CreateAccountGroup {
 /// 已生成稳定标识、可直接提交存储的创建命令
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct NewAccountGroup {
+    pub allow_image_generation: bool,
    pub fast_mode: FastMode,
    pub id: AccountGroupId,
    pub name: String,
@@ -158,6 +161,7 @@ pub struct NewAccountGroup {
 /// 更新账号分组的描述字段
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct UpdateAccountGroup {
+    pub allow_image_generation: Option<bool>,
    pub fast_mode: Option<FastMode>,
    pub id: AccountGroupId,
    pub name: String,
@@ -124,6 +124,7 @@ pub struct AccountRecord {
    pub weight: AccountWeight,
    pub model_access: gateway_core::account::AccountModelAccess,
    pub outbound_proxy: Option<gateway_core::account::OutboundProxy>,
+    pub outbound_proxy_enabled: bool,
    pub credential_state: CredentialState,
    pub credential_observed_at: DateTime<Utc>,
    pub quota: QuotaState,
@@ -133,6 +134,16 @@ pub struct AccountRecord {
    pub updated_at: DateTime<Utc>,
 }

+impl AccountRecord {
+    /// 配置保留绑定，执行请求时禁用代理按直连处理
+    #[must_use]
+    pub fn effective_outbound_proxy(&self) -> Option<&gateway_core::account::OutboundProxy> {
+        self.outbound_proxy
+            .as_ref()
+            .filter(|_| self.outbound_proxy_enabled)
+    }
+}
+
 pub use super::observability::{
    AccountModelUsage, AccountPoolMetrics as AccountSummary, AccountRequestBucket,
    CurrencyCost as AccountCost,
@@ -146,9 +157,9 @@ pub struct AccountUsage {
    pub success_count: u64,
    pub input_tokens: Option<u64>,
    pub output_tokens: Option<u64>,
-    pub cached_tokens: Option<u64>,
-    pub cache_write_tokens: Option<u64>,
-    pub reasoning_tokens: Option<u64>,
+    pub cached_input_tokens: Option<u64>,
+    pub cache_write_input_tokens: Option<u64>,
+    pub reasoning_output_tokens: Option<u64>,
    pub image_input_tokens: Option<u64>,
    pub image_output_tokens: Option<u64>,
    pub image_request_count: u64,
@@ -0,0 +1,65 @@
+//! 统计投影的新鲜度、覆盖范围与预计算费用合同
+
+use chrono::{DateTime, Utc};
+
+use super::observability::{DecimalAmount, RequestMetricPoint, UsageOverview};
+
+/// 数据可见性状态，不以缺失投影冒充零统计
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
+pub enum AnalyticsState {
+    Ready,
+    #[default]
+    Building,
+    Lagging,
+    Stale,
+}
+
+impl AnalyticsState {
+    #[must_use]
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::Ready => "ready",
+            Self::Building => "building",
+            Self::Lagging => "lagging",
+            Self::Stale => "stale",
+        }
+    }
+}
+
+/// 与统计结果在同一读取快照内取得的覆盖和版本事实
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub struct AnalyticsMetadata {
+    pub coverage_start: Option<DateTime<Utc>>,
+    pub coverage_end: Option<DateTime<Utc>>,
+    pub generated_at: DateTime<Utc>,
+    pub lag_seconds: u64,
+    pub state: AnalyticsState,
+    pub percentiles_approximate: bool,
+    pub schema_version: u32,
+    pub histogram_version: u32,
+    /// 派生数据版本供缓存判断失效，不作为源事务提交顺序
+    pub generation: u64,
+}
+
+/// 单次请求经 Provider 费用合同确认后可累加的 USD 情景金额
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub struct UsageBillingProjection {
+    pub standard_amount: Option<DecimalAmount>,
+    pub no_cache_amount: Option<DecimalAmount>,
+}
+
+/// 时间桶内的情景费用，未知金额不改写为零
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct UsageProjectedCostPoint {
+    pub bucket_start: DateTime<Utc>,
+    pub standard_amount: Option<DecimalAmount>,
+    pub no_cache_amount: Option<DecimalAmount>,
+}
+
+/// 同一数据库快照内的完整洞察输入
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct UsageInsightsObservation {
+    pub overview: UsageOverview,
+    pub trend: Vec<RequestMetricPoint>,
+    pub costs: Vec<UsageProjectedCostPoint>,
+}
@@ -76,18 +76,23 @@ impl std::fmt::Debug for LoginCommand {
    }
 }

-/// 登录成功后返回的会话事实
+/// 登录或刷新后仅向当前浏览器交付的会话凭据
 #[derive(Clone, PartialEq, Eq)]
-pub struct LoginResult {
+pub struct SessionGrant {
    pub session_id: String,
+    pub refresh_token: Option<String>,
    pub session: AuthSession,
 }

-impl std::fmt::Debug for LoginResult {
+impl std::fmt::Debug for SessionGrant {
    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        formatter
-            .debug_struct("LoginResult")
+            .debug_struct("SessionGrant")
            .field("session_id", &"[REDACTED]")
+            .field(
+                "refresh_token",
+                &self.refresh_token.as_ref().map(|_| "[REDACTED]"),
+            )
            .field("session", &self.session)
            .finish()
    }
@@ -138,12 +143,41 @@ impl std::fmt::Debug for ChangePassword {
    }
 }

-/// 会话有效期与管理员续期上限；没有上限字段的旧会话保持固定有效期
+/// 访问有效期与逻辑会话；没有续期凭据的会话保持固定期限
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct AuthSession {
    pub subject: SessionSubject,
    pub expires_at: DateTime<Utc>,
    pub absolute_expires_at: Option<DateTime<Utc>>,
+    pub renewal: Option<SessionRenewal>,
+}
+
+/// 长效登录的凭据摘要与续期窗口；访问到期不删除整段登录
+#[derive(Debug, Clone, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct SessionRenewal {
+    pub expires_at: DateTime<Utc>,
+    pub access_digest: [u8; 32],
+    pub refresh_digest: [u8; 32],
+    pub previous: Option<SessionRefreshReplay>,
+}
+
+/// 仅保存上一代摘要及派生盐；响应丢失时须持有上一代凭据才能重建同一响应
+#[derive(Debug, Clone, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct SessionRefreshReplay {
+    pub digest: [u8; 32],
+    pub salt: [u8; 32],
+    pub expires_at: DateTime<Utc>,
+}
+
+impl AuthSession {
+    #[must_use]
+    pub fn retained_until(&self) -> DateTime<Utc> {
+        self.renewal
+            .as_ref()
+            .map_or(self.expires_at, |renewal| renewal.expires_at)
+    }
 }

 /// 安全审计事件类型
@@ -474,6 +474,26 @@ impl BackupError {
    pub fn message(&self) -> &str {
        &self.message
    }
+
+    /// 清理失败附加到原始终态，不覆盖上传失败或主动取消的分类
+    #[must_use]
+    pub fn with_cleanup_failure(
+        mut self,
+        stage: &'static str,
+        error: &Self,
+        retry_on_expiration: bool,
+    ) -> Self {
+        let recovery = if retry_on_expiration {
+            "等待备份到期清理"
+        } else {
+            "未安排自动重试"
+        };
+        self.message.push_str(&format!(
+            "；清理阶段 {stage} 失败（{}），{recovery}",
+            error.code()
+        ));
+        self
+    }
 }

 /// 构造稳定错误码常量
@@ -0,0 +1,44 @@
+//! 故障诊断导出的目标、已采集证据与缺口
+
+use chrono::{DateTime, Utc};
+
+use super::{
+    observability::{OpsError, UsageDetail},
+    system::SystemVersion,
+};
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum DiagnosticTarget {
+    Request(String),
+    Operation(String),
+}
+
+impl DiagnosticTarget {
+    #[must_use]
+    pub fn id(&self) -> &str {
+        match self {
+            Self::Request(id) | Self::Operation(id) => id,
+        }
+    }
+}
+
+pub struct DiagnosticGap {
+    pub section: String,
+    pub reason: &'static str,
+}
+
+pub struct DiagnosticRequest {
+    pub request_id: String,
+    pub detail: Option<UsageDetail>,
+    pub errors: Vec<OpsError>,
+}
+
+/// 原始受控详情只能经导出投影脱敏后交付，不参与普通日志或 Debug
+pub struct DiagnosticBundle {
+    pub target: DiagnosticTarget,
+    pub collected_at: DateTime<Utc>,
+    pub environment: Option<SystemVersion>,
+    pub error: Option<OpsError>,
+    pub requests: Vec<DiagnosticRequest>,
+    pub gaps: Vec<DiagnosticGap>,
+}
@@ -4,11 +4,13 @@ use std::num::{NonZeroU16, NonZeroU64};

 pub mod account_groups;
 pub mod accounts;
+pub mod analytics;
 pub mod audit;
 pub mod auth;
 pub mod backup;
 pub mod client_distribution;
 pub mod client_keys;
+pub mod diagnostics;
 pub mod import_tasks;
 pub mod key_usage;
 pub mod observability;
@@ -23,6 +25,7 @@ pub mod quota_forecast_sampling;
 pub mod retention;
 pub mod settings;
 pub mod system;
+pub mod usage_data;

 /// 管理用例对外返回的稳定错误分类
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
@@ -5,6 +5,10 @@ use std::{num::NonZeroU16, str::FromStr};
 use chrono::{DateTime, TimeDelta, Utc};

 use super::AdminModelError;
+pub use super::analytics::{
+    AnalyticsMetadata, AnalyticsState, UsageBillingProjection, UsageInsightsObservation,
+    UsageProjectedCostPoint,
+};

 /// 观测记录查询的页大小，由 HTTP、管理用例和存储端口共同使用
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
@@ -48,7 +52,7 @@ impl CalendarPeriod {
 }

 /// 外部观测查询的 UTC 时间范围
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
 pub struct TimeRange {
    pub start: DateTime<Utc>,
    pub end: DateTime<Utc>,
@@ -89,7 +93,7 @@ impl TimeRange {
 }

 /// 请求结果状态
-#[derive(Debug, Clone, PartialEq, Eq)]
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
 pub enum RequestOutcome {
    Running,
    Succeeded,
@@ -100,7 +104,7 @@ pub enum RequestOutcome {
 }

 /// 未知但有界的请求结果值；私有字段禁止绕过 [`RequestOutcome::new`] 构造
-#[derive(Debug, Clone, PartialEq, Eq)]
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
 pub struct OtherRequestOutcome(String);

 impl RequestOutcome {
@@ -151,7 +155,7 @@ impl OtherRequestOutcome {
 }

 /// 用量记录过滤条件
-#[derive(Debug, Clone, Default, PartialEq, Eq)]
+#[derive(Debug, Clone, Default, PartialEq, Eq, Hash)]
 pub struct UsageFilter {
    pub client_api_key_ref: Option<String>,
    pub request_id: Option<String>,
@@ -168,9 +172,19 @@ pub struct UsageFilter {
    pub search: Option<String>,
 }

+/// 请求列表的结果筛选，不改变汇总和计量口径
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
+pub enum UsageRecordStatus {
+    #[default]
+    Success,
+    Error,
+    All,
+}
+
 /// 用量记录分页查询
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct UsageQuery {
+    pub status: UsageRecordStatus,
    pub range: TimeRange,
    pub filter: UsageFilter,
    pub current_page: u32,
@@ -178,7 +192,7 @@ pub struct UsageQuery {
 }

 /// Admin 确定概览的数量、趋势粒度及最近请求筛选，Store 只执行该选择
-#[derive(Debug, Clone, PartialEq, Eq)]
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
 pub struct DashboardQuery {
    pub range: TimeRange,
    pub granularity: Granularity,
@@ -230,7 +244,7 @@ pub struct OpsErrorQuery {
 }

 /// 用量诊断维度
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
 pub enum DiagnosticDimension {
    Provider,
    Model,
@@ -363,8 +377,8 @@ pub struct ProviderBillingInput {
    pub service_tier: Option<String>,
    pub input_tokens: Option<u64>,
    pub output_tokens: Option<u64>,
-    pub cached_tokens: Option<u64>,
-    pub cache_write_tokens: Option<u64>,
+    pub cached_input_tokens: Option<u64>,
+    pub cache_write_input_tokens: Option<u64>,
    pub total: CurrencyCost,
 }

@@ -380,8 +394,8 @@ pub struct UsageCalculatedBillingFact {
    pub service_tier: Option<String>,
    pub input_tokens: Option<u64>,
    pub output_tokens: Option<u64>,
-    pub cached_tokens: Option<u64>,
-    pub cache_write_tokens: Option<u64>,
+    pub cached_input_tokens: Option<u64>,
+    pub cache_write_input_tokens: Option<u64>,
    pub total: CurrencyCost,
 }

@@ -408,7 +422,7 @@ pub struct CalculatedBillingBreakdown {
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct ImageBillingBreakdown {
    pub input_tokens: u64,
-    pub cached_tokens: u64,
+    pub cached_input_tokens: u64,
    pub input_amount: CurrencyCost,
    pub cache_read_amount: CurrencyCost,
    pub input_price_per_million: CurrencyCost,
@@ -454,9 +468,9 @@ pub struct RequestMetrics {
    pub caller_error_count: u64,
    pub input_tokens: u64,
    pub output_tokens: u64,
-    pub cached_tokens: u64,
-    pub cache_write_tokens: u64,
-    pub reasoning_tokens: u64,
+    pub cached_input_tokens: u64,
+    pub cache_write_input_tokens: u64,
+    pub reasoning_output_tokens: u64,
    pub total_tokens: u64,
    pub first_token_latency_sum_ms: u64,
    pub first_token_latency_count: u64,
@@ -496,7 +510,7 @@ pub struct AttemptMetrics {
 }

 /// 时间序列粒度
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
 pub enum Granularity {
    FifteenMinutes,
    Hour,
@@ -556,9 +570,9 @@ pub struct AccountModelUsage {
    pub success_count: u64,
    pub input_tokens: Option<u64>,
    pub output_tokens: Option<u64>,
-    pub cached_tokens: Option<u64>,
-    pub cache_write_tokens: Option<u64>,
-    pub reasoning_tokens: Option<u64>,
+    pub cached_input_tokens: Option<u64>,
+    pub cache_write_input_tokens: Option<u64>,
+    pub reasoning_output_tokens: Option<u64>,
    pub image_input_tokens: Option<u64>,
    pub image_output_tokens: Option<u64>,
    pub image_request_count: u64,
@@ -591,9 +605,9 @@ pub struct DashboardAccountUsage {
    pub success_count: u64,
    pub input_tokens: Option<u64>,
    pub output_tokens: Option<u64>,
-    pub cached_tokens: Option<u64>,
-    pub cache_write_tokens: Option<u64>,
-    pub reasoning_tokens: Option<u64>,
+    pub cached_input_tokens: Option<u64>,
+    pub cache_write_input_tokens: Option<u64>,
+    pub reasoning_output_tokens: Option<u64>,
    pub image_input_tokens: Option<u64>,
    pub image_output_tokens: Option<u64>,
    pub image_request_count: u64,
@@ -628,7 +642,7 @@ pub struct DashboardRuntimeSlots {
 pub struct DashboardTotals {
    pub request_count: u64,
    pub input_tokens: u64,
-    pub cached_tokens: u64,
+    pub cached_input_tokens: u64,
    pub total_tokens: u64,
    pub billing_usd: Option<DecimalAmount>,
 }
@@ -636,6 +650,7 @@ pub struct DashboardTotals {
 /// 仪表盘所需的当前区间事实及全历史累计
 #[derive(Debug, Clone, PartialEq)]
 pub struct DashboardObservation {
+    pub analytics: AnalyticsMetadata,
    pub range: TimeRange,
    pub totals: DashboardTotals,
    pub provider_accounts: AccountPoolMetrics,
@@ -648,6 +663,7 @@ pub struct DashboardObservation {
 /// 使用记录表格的窄读模型
 #[derive(Debug, Clone, PartialEq)]
 pub struct UsageListRecord {
+    pub outcome: RequestOutcome,
    pub client_api_key_name: Option<String>,
    pub id: String,
    pub endpoint: String,
@@ -657,9 +673,9 @@ pub struct UsageListRecord {
    pub provider_account_ref: Option<String>,
    pub provider_account_name: Option<String>,
    pub provider_account_email: Option<String>,
-    /// 账号当前备注，按内部账号 ID 关联，不属于请求历史快照
+    /// 请求选号时冻结的账号备注，未采集时保持未知
    pub provider_account_notes: Option<String>,
-    /// 账号当前套餐，不属于请求历史快照
+    /// 请求选号时冻结的账号套餐
    pub provider_account_plan_type: Option<String>,
    pub provider_account_plan_type_display: Option<String>,
    pub provider_account_authentication_kind: Option<String>,
@@ -669,9 +685,9 @@ pub struct UsageListRecord {
    pub service_tier: Option<String>,
    pub input_tokens: Option<u64>,
    pub output_tokens: Option<u64>,
-    pub cached_tokens: Option<u64>,
-    pub cache_write_tokens: Option<u64>,
-    pub reasoning_tokens: Option<u64>,
+    pub cached_input_tokens: Option<u64>,
+    pub cache_write_input_tokens: Option<u64>,
+    pub reasoning_output_tokens: Option<u64>,
    pub image_input_tokens: Option<u64>,
    pub image_output_tokens: Option<u64>,
    pub total_tokens: Option<u64>,
@@ -750,9 +766,9 @@ pub struct UsageRecord {
    pub retry_after_ms: Option<u64>,
    pub input_tokens: Option<u64>,
    pub output_tokens: Option<u64>,
-    pub cached_tokens: Option<u64>,
-    pub cache_write_tokens: Option<u64>,
-    pub reasoning_tokens: Option<u64>,
+    pub cached_input_tokens: Option<u64>,
+    pub cache_write_input_tokens: Option<u64>,
+    pub reasoning_output_tokens: Option<u64>,
    pub image_input_tokens: Option<u64>,
    pub image_output_tokens: Option<u64>,
    pub total_tokens: Option<u64>,
@@ -830,9 +846,9 @@ pub struct UsageAttempt {
    pub message: Option<String>,
    pub input_tokens: Option<u64>,
    pub output_tokens: Option<u64>,
-    pub cached_tokens: Option<u64>,
-    pub cache_write_tokens: Option<u64>,
-    pub reasoning_tokens: Option<u64>,
+    pub cached_input_tokens: Option<u64>,
+    pub cache_write_input_tokens: Option<u64>,
+    pub reasoning_output_tokens: Option<u64>,
    pub total_tokens: Option<u64>,
    pub cost_source: Option<String>,
    pub cost_amount: Option<DecimalAmount>,
@@ -840,7 +856,7 @@ pub struct UsageAttempt {
    pub occurred_at: DateTime<Utc>,
 }

-/// 一条请求及其全部尝试
+/// 一条请求及其保留的尝试与诊断轨迹
 #[derive(Debug, Clone, PartialEq)]
 pub struct UsageDetail {
    pub trace: Option<serde_json::Value>,
@@ -862,6 +878,7 @@ pub struct ProviderObservation {
 /// 用量总览
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct UsageOverview {
+    pub analytics: AnalyticsMetadata,
    pub range: TimeRange,
    pub requests: RequestMetrics,
    pub attempts: AttemptMetrics,
@@ -878,6 +895,7 @@ pub struct UsageSummary {
 /// 诊断聚合结果，分母包含截取展示项之前的全部匹配请求
 #[derive(Debug, Clone, Default, PartialEq, Eq)]
 pub struct DiagnosticsObservation {
+    pub analytics: AnalyticsMetadata,
    pub total_request_count: u64,
    pub items: Vec<DiagnosticObservation>,
 }
@@ -1001,7 +1019,7 @@ pub struct TrendSummary {
    pub request_count: u64,
    pub input_tokens: u64,
    pub output_tokens: u64,
-    pub cached_tokens: u64,
+    pub cached_input_tokens: u64,
    pub total_tokens: u64,
    pub service_failure_count: u64,
    pub average_latency_ms: Option<u64>,
@@ -1019,6 +1037,7 @@ pub struct TrendSummary {
 /// 趋势结果；API 再决定图表标签与数字格式
 #[derive(Debug, Clone, PartialEq)]
 pub struct Trend {
+    pub analytics: AnalyticsMetadata,
    pub kind: TrendKind,
    pub points: Vec<TrendPoint>,
    pub summary: TrendSummary,
@@ -1134,7 +1153,7 @@ pub struct DashboardPeriodMetrics {
    pub request_count: u64,
    pub input_tokens: u64,
    pub output_tokens: u64,
-    pub cached_tokens: u64,
+    pub cached_input_tokens: u64,
    pub total_tokens: u64,
    pub cached_token_rate: f64,
    pub observed_cached_token_rate: Option<f64>,
@@ -1224,7 +1243,7 @@ pub struct UsageInsightsCostPoint {
    pub bucket_start: DateTime<Utc>,
    pub input_tokens: u64,
    pub output_tokens: u64,
-    pub cached_tokens: u64,
+    pub cached_input_tokens: u64,
    pub total_tokens: u64,
    pub estimated_cost: Option<DecimalAmount>,
    pub standard_cost: Option<DecimalAmount>,
@@ -1249,7 +1268,7 @@ pub struct UsageInsightsCost {
    pub cache_hit_request_rate: Option<f64>,
    pub input_tokens: u64,
    pub output_tokens: u64,
-    pub cached_tokens: u64,
+    pub cached_input_tokens: u64,
    pub total_tokens: u64,
    pub points: Vec<UsageInsightsCostPoint>,
    pub costs: Vec<CurrencyCost>,
@@ -1259,6 +1278,7 @@ pub struct UsageInsightsCost {
 /// 用量洞察的完整用例结果；API 只负责标签、时区与字符串格式化
 #[derive(Debug, Clone, PartialEq)]
 pub struct UsageInsights {
+    pub analytics: AnalyticsMetadata,
    pub granularity: Granularity,
    pub health: UsageInsightsHealth,
    pub performance: UsageInsightsPerformance,
@@ -1294,6 +1314,7 @@ pub struct DiagnosticsItem {
 /// 诊断结果
 #[derive(Debug, Clone, PartialEq)]
 pub struct DiagnosticsResult {
+    pub analytics: AnalyticsMetadata,
    pub dimension: DiagnosticDimension,
    pub items: Vec<DiagnosticsItem>,
 }
@@ -69,6 +69,7 @@ pub struct ProxyTestResult {

 #[derive(Debug, Clone)]
 pub struct ProxyRecord {
+    pub enabled: bool,
    pub auto_location: bool,
    pub detected_location: Option<DetectedProxyLocation>,
    pub location: Option<gateway_core::account::RequestLocation>,
@@ -103,6 +104,7 @@ pub struct NewProxy {

 #[derive(Debug, Clone)]
 pub struct UpdateProxy {
+    pub enabled: Option<bool>,
    pub auto_location: Option<bool>,
    pub test: Option<ProxyTestResult>,
    /// 外层为空保留配置，内层为空恢复全局继承
@@ -15,7 +15,7 @@ pub struct QuotaForecastUsage {
    pub tokens: u64,
    pub input_tokens: u64,
    pub output_tokens: u64,
-    pub cached_tokens: u64,
+    pub cached_input_tokens: u64,
    pub missing_token_count: u64,
    pub known_cost_count: u64,
    pub unavailable_cost_count: u64,
@@ -35,7 +35,9 @@ impl QuotaForecastUsage {
            tokens: self.tokens.checked_sub(baseline.tokens)?,
            input_tokens: self.input_tokens.checked_sub(baseline.input_tokens)?,
            output_tokens: self.output_tokens.checked_sub(baseline.output_tokens)?,
-            cached_tokens: self.cached_tokens.checked_sub(baseline.cached_tokens)?,
+            cached_input_tokens: self
+                .cached_input_tokens
+                .checked_sub(baseline.cached_input_tokens)?,
            missing_token_count: self
                .missing_token_count
                .checked_sub(baseline.missing_token_count)?,
@@ -140,7 +142,7 @@ pub fn select_forecast_sample(
    };
    history.push(current);
    // 重置边界不在查询起点时，从首个新观测重新计数，避免把旧周期累计带入总量
-    let mut cycle_baseline = interrupted.then(|| &history[0]);
+    let cycle_baseline = interrupted.then(|| &history[0]);
    let mut anchors: Vec<&QuotaForecastPoint> = Vec::new();
    let mut high_water: Option<&QuotaForecastPoint> = None;
    for point in &history {
@@ -153,9 +155,9 @@ pub fn select_forecast_sample(
                if previous.used_percent - point.used_percent <= 1.0 {
                    continue;
                }
+                // 同窗口回落不能证明周期重置，只重建采样并保留已记录累计
                sample.discontinuous = true;
                anchors.clear();
-                cycle_baseline = Some(point);
            }
        }
        high_water = Some(point);
@@ -24,7 +24,7 @@ impl RetentionPolicy {
        audit_days: u32,
    ) -> Result<(), &'static str> {
        for (valid, field) in [
-            (usage_days >= 31, "usage_retention_days"),
+            ((1..=31).contains(&usage_days), "usage_retention_days"),
            (ops_days > 0, "ops_event_retention_days"),
            (audit_days > 0, "audit_retention_days"),
        ] {
@@ -38,7 +38,7 @@ impl RetentionPolicy {
    pub fn try_new(usage_days: u32, ops_days: u32, audit_days: u32) -> Result<Self, AdminError> {
        if Self::validate_values(usage_days, ops_days, audit_days).is_err() {
            return Err(AdminError::invalid(
-                "请求保留期至少 31 天，事件与审计保留期必须为正数",
+                "请求保留期必须为 1～31 天，事件与审计保留期必须为正数",
            ));
        }
        Ok(Self {
@@ -45,12 +45,12 @@ pub use gateway_core::account::RotationStrategy;
 /// 运行设置的共同值；版本、Provider 画像更新和数据库秘密由外层类型拥有
 #[derive(Debug, Clone, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
 pub struct RuntimeSettingsValues {
+    pub codex_privacy_policy: gateway_core::settings::privacy::CodexPrivacyPolicy,
    pub request_location_enabled: bool,
    pub request_location: gateway_core::account::RequestLocation,
    pub refresh_margin_seconds: u64,
    pub refresh_concurrency: u32,
    pub max_concurrent_per_account: u32,
-    pub request_interval_ms: u64,
    pub max_waiting_per_key: u32,
    pub max_waiting_per_account: u32,
    pub concurrency_wait_timeout_seconds: u32,
@@ -211,10 +211,6 @@ impl RuntimeSettingsValues {
                "refresh_margin_seconds",
            ),
            (self.refresh_concurrency > 0, "refresh_concurrency"),
-            (
-                i64::try_from(self.request_interval_ms).is_ok(),
-                "request_interval_ms",
-            ),
        ] {
            if !valid {
                return Err(field);
@@ -0,0 +1,26 @@
+//! 由宿主传入的可信写入主体，不属于插件请求载荷
+
+use serde::{Deserialize, Serialize};
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(tag = "kind", rename_all = "snake_case", deny_unknown_fields)]
+pub enum UsageActor {
+    Admin {
+        subject: String,
+    },
+    Plugin {
+        publisher: String,
+        name: String,
+        instance_id: String,
+    },
+    System,
+}
+
+impl super::UsageRecordChange {
+    #[must_use]
+    pub fn id(&self) -> &str {
+        match self {
+            Self::Put { id, .. } | Self::Update { id, .. } | Self::Delete { id } => id,
+        }
+    }
+}
@@ -0,0 +1,87 @@
+//! 按归属时间和维度维护统计贡献，业务来源与调整历史由调用方保存
+
+use super::{UsageDelta, UsageRecordFilter};
+use serde::{Deserialize, Serialize};
+use std::collections::BTreeMap;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum UsageMetric {
+    RequestCount,
+    SuccessCount,
+    FailureCount,
+    CancelledCount,
+    IncompleteCount,
+    CompletedRequestCount,
+    InputTokens,
+    OutputTokens,
+    CachedInputTokens,
+    CacheWriteInputTokens,
+    ReasoningOutputTokens,
+    ImageInputTokens,
+    ImageOutputTokens,
+    TotalTokens,
+}
+
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct UsageDimensions {
+    pub provider: Option<String>,
+    pub model: Option<String>,
+    pub account_ref: Option<String>,
+    pub client_key_ref: Option<String>,
+    pub operation: Option<String>,
+    pub transport: Option<String>,
+}
+
+/// 整个键决定覆盖目标；调用方可将来源标识编码进 key，重试相同键不会累计
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct UsageAggregateKey {
+    pub bucket_start_ms: i64,
+    pub dimensions: UsageDimensions,
+    pub key: String,
+}
+
+/// 值按 bucket_start_ms 归属，不自动摊分；负值用于相对原生统计的修正
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct UsageAggregate {
+    pub identity: UsageAggregateKey,
+    pub counts: BTreeMap<UsageMetric, UsageDelta>,
+    pub costs: BTreeMap<String, String>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(tag = "kind", rename_all = "snake_case", deny_unknown_fields)]
+pub enum UsageAggregateChange {
+    Put { aggregate: UsageAggregate },
+    Delete { identity: UsageAggregateKey },
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct WriteUsageAggregates {
+    pub changes: Vec<UsageAggregateChange>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct UsageAggregateWriteResult {
+    pub changed: Vec<UsageAggregateKey>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct ListUsageAggregates {
+    pub filter: UsageRecordFilter,
+    pub cursor: Option<String>,
+    pub limit: Option<u16>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct UsageAggregatePage {
+    pub items: Vec<UsageAggregate>,
+    pub next_cursor: Option<String>,
+}
@@ -0,0 +1,44 @@
+//! 用量基础操作的错误分类，不保存失败或重试状态
+
+use serde::{Deserialize, Serialize};
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum UsageErrorKind {
+    InvalidInput,
+    NotFound,
+    Conflict,
+    CapacityExceeded,
+    Unavailable,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct UsageDataError {
+    pub kind: UsageErrorKind,
+    pub message: String,
+}
+impl UsageDataError {
+    #[must_use]
+    pub fn new(kind: UsageErrorKind, message: impl Into<String>) -> Self {
+        Self {
+            kind,
+            message: message.into(),
+        }
+    }
+    #[must_use]
+    pub fn invalid(message: impl Into<String>) -> Self {
+        Self::new(UsageErrorKind::InvalidInput, message)
+    }
+    #[must_use]
+    pub fn unavailable(message: impl Into<String>) -> Self {
+        Self::new(UsageErrorKind::Unavailable, message)
+    }
+}
+impl std::fmt::Display for UsageDataError {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter.write_str(&self.message)
+    }
+}
+impl std::error::Error for UsageDataError {}
+pub type UsageDataResult<T> = Result<T, UsageDataError>;
@@ -0,0 +1,22 @@
+//! 用量明细、聚合维护与纯计价的公开合同
+
+mod value;
+pub use value::*;
+mod record;
+pub use record::*;
+mod query;
+pub use query::*;
+mod pricing;
+pub use pricing::*;
+mod error;
+pub use error::*;
+
+pub const USAGE_DATA_MAX_TARGETS: usize = 500;
+pub const USAGE_DATA_MAX_REQUEST_BYTES: usize = 2 * 1024 * 1024;
+pub const USAGE_DATA_MAX_PAGE_SIZE: u16 = 200;
+
+mod actor;
+pub use actor::*;
+
+mod aggregate;
+pub use aggregate::*;
@@ -0,0 +1,62 @@
+//! 纯 Token 计价合同，费用是否采用与额外费用合并由调用方决定
+
+use super::{UsageCost, UsageTokens};
+use gateway_core::metering::ModelPriceOverride;
+use serde::{Deserialize, Serialize};
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(tag = "kind", rename_all = "snake_case", deny_unknown_fields)]
+pub enum UsagePriceSelection {
+    Current,
+    Override { price: Box<ModelPriceOverride> },
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct UsagePricingInput {
+    pub id: String,
+    pub provider: String,
+    pub model: String,
+    pub tokens: UsageTokens,
+    pub service_tier: Option<String>,
+    pub price: UsagePriceSelection,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct EvaluateUsagePricing {
+    pub items: Vec<UsagePricingInput>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct UsagePricingBreakdown {
+    pub input_amount: String,
+    pub output_amount: String,
+    pub cache_read_amount: String,
+    pub cache_write_amount: String,
+    pub standard_amount: String,
+    pub long_context_billing_applied: bool,
+    pub service_tier: Option<String>,
+    pub custom_multiplier_bps: u32,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(tag = "status", rename_all = "snake_case", deny_unknown_fields)]
+pub enum UsagePricingResult {
+    Estimated {
+        id: String,
+        cost: UsageCost,
+        breakdown: UsagePricingBreakdown,
+    },
+    NotEstimable {
+        id: String,
+        reason: String,
+    },
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct UsagePricingEvaluation {
+    pub items: Vec<UsagePricingResult>,
+}
@@ -0,0 +1,36 @@
+//! 请求明细的有界筛选与稳定顺序分页
+
+use super::UsageRecord;
+use serde::{Deserialize, Serialize};
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct GetUsageRecord {
+    pub id: String,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct UsageRecordFilter {
+    pub start_ms: i64,
+    pub end_ms: i64,
+    pub provider: Option<String>,
+    pub model: Option<String>,
+    pub account_ref: Option<String>,
+    pub client_key_ref: Option<String>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct ListUsageRecords {
+    pub filter: UsageRecordFilter,
+    pub cursor: Option<String>,
+    pub limit: Option<u16>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct UsageRecordPage {
+    pub items: Vec<UsageRecord>,
+    pub next_cursor: Option<String>,
+}
@@ -0,0 +1,106 @@
+//! 既有请求明细的用量读写合同，不承载插件任务或来源状态
+
+use super::UsageCount;
+use serde::{Deserialize, Serialize};
+
+/// Token 使用宿主口径：缓存包含在输入中，推理包含在输出中，未知值为 null
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct UsageTokens {
+    pub input_tokens: Option<UsageCount>,
+    pub output_tokens: Option<UsageCount>,
+    pub cached_input_tokens: Option<UsageCount>,
+    pub cache_write_input_tokens: Option<UsageCount>,
+    pub reasoning_output_tokens: Option<UsageCount>,
+    pub image_input_tokens: Option<UsageCount>,
+    pub image_output_tokens: Option<UsageCount>,
+    pub total_tokens: Option<UsageCount>,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum UsageCostSource {
+    ProviderReported,
+    Calculated,
+}
+
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(tag = "kind", rename_all = "snake_case", deny_unknown_fields)]
+pub enum UsageCost {
+    #[default]
+    Unavailable,
+    Known {
+        source: UsageCostSource,
+        amount: String,
+        currency: String,
+    },
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum UsageOutcome {
+    Running,
+    Succeeded,
+    Failed,
+    Cancelled,
+    Incomplete,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct UsageRecordData {
+    pub client_key_ref: String,
+    pub provider: Option<String>,
+    pub account_ref: Option<String>,
+    pub requested_model: Option<String>,
+    pub model: Option<String>,
+    pub protocol: String,
+    pub operation: String,
+    pub endpoint: String,
+    pub client_transport: String,
+    pub service_tier: Option<String>,
+    pub started_at_ms: i64,
+    pub completed_at_ms: Option<i64>,
+    pub outcome: UsageOutcome,
+    pub tokens: UsageTokens,
+    pub cost: UsageCost,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct UsageRecord {
+    pub id: String,
+    pub data: UsageRecordData,
+    pub billing_snapshot: Option<serde_json::Value>,
+    pub provider_observation: Option<serde_json::Value>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(tag = "kind", rename_all = "snake_case", deny_unknown_fields)]
+pub enum UsageRecordChange {
+    Put {
+        id: String,
+        data: Box<UsageRecordData>,
+    },
+    /// tokens 替换全部 Token 字段；cost 的 unavailable 明确清空费用
+    Update {
+        id: String,
+        tokens: Option<UsageTokens>,
+        cost: Option<UsageCost>,
+    },
+    Delete {
+        id: String,
+    },
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct WriteUsageRecords {
+    pub changes: Vec<UsageRecordChange>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct UsageWriteResult {
+    pub changed_ids: Vec<String>,
+}
@@ -0,0 +1,63 @@
+//! 用量计数使用十进制字符串，避免插件前端丢失整数精度
+
+use serde::{Deserialize, Deserializer, Serialize, Serializer, de::Error};
+use std::fmt;
+
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub struct UsageCount(pub u64);
+impl UsageCount {
+    pub const ZERO: Self = Self(0);
+    #[must_use]
+    pub const fn get(self) -> u64 {
+        self.0
+    }
+}
+impl From<u64> for UsageCount {
+    fn from(value: u64) -> Self {
+        Self(value)
+    }
+}
+impl fmt::Display for UsageCount {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        self.0.fmt(formatter)
+    }
+}
+impl Serialize for UsageCount {
+    fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        serializer.serialize_str(&self.0.to_string())
+    }
+}
+impl<'de> Deserialize<'de> for UsageCount {
+    fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+        let value = String::deserialize(deserializer)?;
+        if value.is_empty() || !value.bytes().all(|byte| byte.is_ascii_digit()) {
+            return Err(D::Error::custom("count must be an unsigned decimal string"));
+        }
+        value.parse().map(Self).map_err(D::Error::custom)
+    }
+}
+
+/// 有符号统计贡献受 PostgreSQL bigint 范围限制，JSON 使用十进制字符串
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub struct UsageDelta(pub i64);
+impl UsageDelta {
+    #[must_use]
+    pub const fn get(self) -> i64 {
+        self.0
+    }
+}
+impl Serialize for UsageDelta {
+    fn serialize<S: Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        serializer.serialize_str(&self.0.to_string())
+    }
+}
+impl<'de> Deserialize<'de> for UsageDelta {
+    fn deserialize<D: Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+        let value = String::deserialize(deserializer)?;
+        let digits = value.strip_prefix('-').unwrap_or(&value);
+        if digits.is_empty() || !digits.bytes().all(|byte| byte.is_ascii_digit()) {
+            return Err(D::Error::custom("delta must be a signed decimal string"));
+        }
+        value.parse().map(Self).map_err(D::Error::custom)
+    }
+}
@@ -14,3 +14,4 @@ pub mod proxy;
 pub mod retention;
 pub mod store;
 pub mod system;
+pub mod usage_data;
@@ -26,6 +26,14 @@ use crate::model::{
    quota_forecast_sampling::QuotaForecastObservation,
 };

+/// 按原生 Token 口径计算的报价输入，额外费用由调用方处理
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ProviderUsagePricingInput {
+    pub upstream_model_id: String,
+    pub service_tier: Option<String>,
+    pub usage: gateway_core::metering::Usage,
+}
+
 /// Provider 管理失败的稳定分类
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum ProviderAdminErrorKind {
@@ -130,11 +138,45 @@ struct ProviderAdminDiagnostic {
 /// 运行时资源通知只在事务成功后发生
 #[async_trait]
 pub trait ProviderAdmin: Send + Sync {
+    fn compile_privacy_policy(
+        &self,
+        _policy: &gateway_core::settings::privacy::CodexPrivacyPolicy,
+    ) -> Result<
+        Arc<dyn gateway_core::settings::privacy::CompiledPrivacyPolicy>,
+        gateway_core::settings::privacy::PrivacyError,
+    > {
+        Err(gateway_core::settings::privacy::PrivacyError {
+            rule_index: 0,
+            reason: "Provider 不支持隐私策略",
+        })
+    }
+
+    fn preview_privacy_policy(
+        &self,
+        _request: gateway_core::settings::privacy::PrivacyPreviewRequest,
+    ) -> Result<
+        gateway_core::settings::privacy::PrivacyPreviewResult,
+        gateway_core::settings::privacy::PrivacyError,
+    > {
+        Err(gateway_core::settings::privacy::PrivacyError {
+            rule_index: 0,
+            reason: "Provider 不支持隐私策略",
+        })
+    }
+
    /// 只读内置价目；没有本地计价能力的 Provider 返回空目录
    fn pricing_catalog(&self) -> crate::model::pricing::ProviderPricingCatalog {
        Default::default()
    }

+    fn evaluate_usage_pricing(
+        &self,
+        _input: &ProviderUsagePricingInput,
+        _pricing: Option<&gateway_core::metering::ModelPriceOverride>,
+    ) -> Result<Option<gateway_core::metering::CalculatedCostBreakdown>, ProviderAdminError> {
+        Err(ProviderAdminError::new(ProviderAdminErrorKind::Unsupported))
+    }
+
    fn provider_kind(&self) -> &ProviderKind;

    /// 只读取原生 Provider 能力及账号类型，不执行网络或数据库查询
@@ -6,7 +6,6 @@ use std::{collections::BTreeMap, net::IpAddr, sync::Arc, time::Duration};

 use async_trait::async_trait;
 use chrono::{DateTime, Utc};
-use futures::stream::BoxStream;

 use super::backup::BackupStorePorts;
 use crate::model::{
@@ -30,7 +29,8 @@ use crate::model::{
    observability::{
        DashboardObservation, DashboardQuery, DiagnosticDimension, DiagnosticsObservation,
        Granularity, OpsErrorPage, OpsErrorQuery, RequestMetricPoint, TimeRange,
-        UsageCalculatedBillingFact, UsageDetail, UsageFilter, UsageOverview, UsagePage, UsageQuery,
+        UsageBillingProjection, UsageCalculatedBillingFact, UsageDetail, UsageFilter,
+        UsageInsightsObservation, UsageOverview, UsagePage, UsageQuery,
    },
    provider_credentials::{
        AuthorizationCommit, CredentialDetails, CredentialImportCommit, CredentialImportResult,
@@ -294,12 +294,12 @@ pub trait AuthStore: Send + Sync {

    async fn store_session(&self, session_id: &str, session: &AuthSession) -> AdminStoreResult<()>;

-    /// 只延长仍存在且匹配的会话；并发续期返回当前值，已退出或过期时不重建
-    async fn renew_session(
+    /// 原子替换或撤销仍匹配的会话并返回当前值；过期或退出后不重新创建
+    async fn compare_exchange_session(
        &self,
        session_id: &str,
        expected: &AuthSession,
-        expires_at: chrono::DateTime<chrono::Utc>,
+        replacement: Option<&AuthSession>,
    ) -> AdminStoreResult<Option<AuthSession>>;

    async fn delete_session(&self, session_id: &str) -> AdminStoreResult<Option<AuthSession>>;
@@ -421,13 +421,23 @@ pub trait AccountGroupStore: Send + Sync {
    ) -> AdminStoreResult<AccountGroupMutation>;
 }

-/// 逐条读取的已计算费用事实；消费结束或丢弃时释放查询资源
-pub type UsageCalculatedBillingStream<'a> =
-    BoxStream<'a, AdminStoreResult<UsageCalculatedBillingFact>>;
+/// 后台投影复用 Admin 与 Provider 的费用规则，Store 不重新解释价格
+pub trait UsageBillingProjector: Send + Sync {
+    fn project(
+        &self,
+        fact: &UsageCalculatedBillingFact,
+    ) -> Result<UsageBillingProjection, crate::model::AdminError>;
+}

 /// 用量、趋势、诊断与运维错误的只读能力
 #[async_trait]
 pub trait ObservabilityStore: Send + Sync {
+    /// 读取实现声明的总预算，缓存等待沿用同一配置，避免外层提前截断
+    fn query_timeout(&self) -> std::time::Duration;
+
+    /// 缓存必须与删除和后台投影提交的版本一致
+    async fn analytics_cache_generation(&self) -> AdminStoreResult<u64>;
+
    /// 返回历史统计区间和指定观测时刻下的实时账号状态
    async fn dashboard_summary(
        &self,
@@ -448,14 +458,13 @@ pub trait ObservabilityStore: Send + Sync {
        granularity: Granularity,
    ) -> AdminStoreResult<Vec<RequestMetricPoint>>;

-    /// 流式返回可由 Provider 重新校验的已计算费用事实，不保证顺序
-    /// 查询及解码错误由流返回；调用方应逐条聚合，避免收集整个区间
-    fn usage_calculated_billing_facts(
+    /// 同一读取快照中的汇总、趋势和已投影情景费用
+    async fn usage_insights_observation(
        &self,
        range: TimeRange,
        filter: UsageFilter,
        granularity: Granularity,
-    ) -> UsageCalculatedBillingStream<'_>;
+    ) -> AdminStoreResult<UsageInsightsObservation>;

    async fn list_usage_records(&self, query: UsageQuery) -> AdminStoreResult<UsagePage>;

@@ -476,6 +485,13 @@ pub trait ObservabilityStore: Send + Sync {
    ) -> AdminStoreResult<DiagnosticsObservation>;

    async fn list_ops_errors(&self, query: OpsErrorQuery) -> AdminStoreResult<OpsErrorPage>;
+
+    /// 按精确目标读取受控错误，不受列表时间窗口与当前页面影响
+    async fn diagnostic_errors(
+        &self,
+        target: &crate::model::diagnostics::DiagnosticTarget,
+        limit: u16,
+    ) -> AdminStoreResult<Vec<crate::model::observability::OpsError>>;
 }

 /// Runtime settings 与管理员 API Key 写入
@@ -556,9 +572,15 @@ pub struct AdminStorePorts {
    plugins: Arc<dyn super::plugins::PluginStore>,
    plugin_state: Arc<dyn super::plugins::PluginStateStore>,
    plugin_resources: Arc<dyn super::plugin_resources::PluginResourceStore>,
+    usage_data: Arc<dyn super::usage_data::UsageDataStore>,
 }

 impl AdminStorePorts {
+    #[must_use]
+    pub fn usage_data(&self) -> Arc<dyn super::usage_data::UsageDataStore> {
+        self.usage_data.clone()
+    }
+
    #[must_use]
    pub fn plugin_resources(&self) -> Arc<dyn super::plugin_resources::PluginResourceStore> {
        self.plugin_resources.clone()
@@ -589,6 +611,7 @@ impl AdminStorePorts {
        plugins: Arc<dyn super::plugins::PluginStore>,
        plugin_state: Arc<dyn super::plugins::PluginStateStore>,
        plugin_resources: Arc<dyn super::plugin_resources::PluginResourceStore>,
+        usage_data: Arc<dyn super::usage_data::UsageDataStore>,
    ) -> Self {
        Self {
            accounts,
@@ -600,6 +623,7 @@ impl AdminStorePorts {
            plugins,
            plugin_state,
            plugin_resources,
+            usage_data,
        }
    }

@@ -0,0 +1,27 @@
+//! 原生请求用量的有界读取和事务写入端口
+
+use crate::model::{auth::AdminAuditEvent, usage_data::*};
+use async_trait::async_trait;
+
+pub struct StoredUsageWrite {
+    pub changes: Vec<(UsageRecordChange, AdminAuditEvent)>,
+}
+
+pub struct StoredAggregateWrite {
+    pub changes: Vec<(UsageAggregateChange, AdminAuditEvent)>,
+}
+
+#[async_trait]
+pub trait UsageDataStore: Send + Sync {
+    async fn list_aggregates(
+        &self,
+        request: ListUsageAggregates,
+    ) -> UsageDataResult<UsageAggregatePage>;
+    async fn write_aggregates(
+        &self,
+        command: StoredAggregateWrite,
+    ) -> UsageDataResult<UsageAggregateWriteResult>;
+    async fn get_record(&self, request: GetUsageRecord) -> UsageDataResult<UsageRecord>;
+    async fn list_records(&self, request: ListUsageRecords) -> UsageDataResult<UsageRecordPage>;
+    async fn write_records(&self, command: StoredUsageWrite) -> UsageDataResult<UsageWriteResult>;
+}
@@ -0,0 +1,21 @@
+//! 公开服务写入主体由受信宿主边界设置，插件输入不能覆盖
+
+use crate::model::usage_data::UsageActor;
+use std::future::Future;
+
+tokio::task_local! {
+    static ACTOR: UsageActor;
+}
+
+/// 与 middleware Origin 独立传递，嵌套服务不会丢失真实调用主体
+pub async fn scope_actor<F: Future>(actor: UsageActor, future: F) -> F::Output {
+    ACTOR.scope(actor, future).await
+}
+
+pub(super) fn current_actor() -> Result<UsageActor, crate::model::usage_data::UsageDataError> {
+    ACTOR.try_with(Clone::clone).map_err(|_| {
+        crate::model::usage_data::UsageDataError::invalid(
+            "usage mutation requires a trusted caller identity",
+        )
+    })
+}
@@ -1,7 +1,10 @@
 //! 主动服务调用的统一组合入口；普通业务方法由所属 HTTP 或执行边界包裹

+mod actor;
 mod registry;
 mod settings;
+mod usage_data;
+pub use actor::scope_actor;
 pub use registry::Registry;

 use std::{future::Future, sync::Arc};
@@ -54,6 +54,57 @@ impl Registry {
        Ok(())
    }

+    pub fn register_usage_data(
+        &mut self,
+        service: &Arc<dyn crate::UsageDataService>,
+    ) -> Result<(), AdminError> {
+        super::usage_data::register(self, service)
+    }
+
+    pub(crate) fn register_usage<I, O>(
+        &mut self,
+        name: &'static str,
+        handler: impl Fn(I) -> BoxFuture<'static, crate::model::usage_data::UsageDataResult<O>>
+        + Send
+        + Sync
+        + 'static,
+    ) -> Result<(), AdminError>
+    where
+        I: DeserializeOwned + Send + 'static,
+        O: Serialize + Send + 'static,
+    {
+        let std::collections::btree_map::Entry::Vacant(entry) = self.operations.entry(name) else {
+            return Err(AdminError::internal(format!("公开服务重复登记：{name}")));
+        };
+        let handler = Arc::new(handler);
+        entry.insert(Arc::new(move |input| {
+            let handler = handler.clone();
+            Box::pin(async move {
+                // 在反序列化之前限制编码后的完整请求，避免单条记录绕过批量行数约束
+                let bytes =
+                    serde_json::to_vec(&input).map_err(|_| Error::invalid("服务输入编码无效"))?;
+                if bytes.len() > crate::model::usage_data::USAGE_DATA_MAX_REQUEST_BYTES {
+                    return Err(super::usage_data::encode_error(
+                        crate::model::usage_data::UsageDataError::new(
+                            crate::model::usage_data::UsageErrorKind::CapacityExceeded,
+                            "usage input exceeds 2 MiB",
+                        ),
+                    ));
+                }
+                let input = serde_json::from_value(input).map_err(|_| {
+                    super::usage_data::encode_error(
+                        crate::model::usage_data::UsageDataError::invalid("服务输入类型无效"),
+                    )
+                })?;
+                let output = handler(input)
+                    .await
+                    .map_err(super::usage_data::encode_error)?;
+                serde_json::to_value(output).map_err(|_| Error::unavailable("服务结果编码失败"))
+            })
+        }));
+        Ok(())
+    }
+
    pub async fn call(&self, operation: &str, input: Value) -> Result<Value, Error> {
        let (operation, handler) =
            self.operations
@@ -25,6 +25,13 @@ pub(super) fn register(
        }};
    }
    register!(Load, load, (), ());
+    register!(
+        PreviewPrivacyPolicy,
+        preview_privacy_policy,
+        gateway_core::settings::privacy::PrivacyPreviewRequest,
+        request,
+        request
+    );
    register!(
        Replace,
        replace,
@@ -0,0 +1,63 @@
+//! 原生用量能力的公开服务登记
+
+use crate::{
+    UsageDataService,
+    model::{AdminError, usage_data::*},
+};
+use std::sync::Arc;
+
+pub(super) fn register(
+    registry: &mut super::Registry,
+    service: &Arc<dyn UsageDataService>,
+) -> Result<(), AdminError> {
+    macro_rules! read {
+        ($name:literal, $method:ident, $input:ty) => {{
+            let service = service.clone();
+            registry.register_usage($name, move |request: $input| {
+                let service = service.clone();
+                Box::pin(async move { service.$method(request).await })
+            })?;
+        }};
+    }
+    read!("usage.records.get", get_record, GetUsageRecord);
+    read!("usage.records.list", list_records, ListUsageRecords);
+    read!(
+        "usage.aggregates.list",
+        list_aggregates,
+        ListUsageAggregates
+    );
+    read!("pricing.evaluate", evaluate_pricing, EvaluateUsagePricing);
+    let aggregates = service.clone();
+    registry.register_usage(
+        "usage.aggregates.write",
+        move |request: WriteUsageAggregates| {
+            let service = aggregates.clone();
+            Box::pin(async move {
+                let actor = super::actor::current_actor()?;
+                service.write_aggregates(&actor, request).await
+            })
+        },
+    )?;
+    let service = service.clone();
+    registry.register_usage("usage.records.write", move |request: WriteUsageRecords| {
+        let service = service.clone();
+        Box::pin(async move {
+            let actor = super::actor::current_actor()?;
+            service.write_records(&actor, request).await
+        })
+    })?;
+    Ok(())
+}
+
+pub(super) fn encode_error(
+    error: UsageDataError,
+) -> gateway_core::engine::middleware::service::Error {
+    gateway_core::engine::middleware::service::Error {
+        kind: serde_json::to_value(error.kind)
+            .ok()
+            .and_then(|v| v.as_str().map(str::to_owned))
+            .unwrap_or_else(|| "unavailable".into()),
+        message: error.message.clone(),
+        details: serde_json::to_value(error).ok(),
+    }
+}
@@ -160,6 +160,7 @@ impl AccountGroupService for DefaultAccountGroupService {
            self.store
                .create_account_group(
                    NewAccountGroup {
+                        allow_image_generation: command.allow_image_generation,
                        id,
                        name: command.name,
                        description: command.description,
@@ -0,0 +1,139 @@
+//! 控制面认证端口、会话策略与访问和续期共用的身份校验
+
+use std::{net::IpAddr, sync::Arc};
+
+use async_trait::async_trait;
+use base64::{Engine as _, engine::general_purpose::URL_SAFE_NO_PAD};
+use chrono::{Duration, Utc};
+use gateway_core::engine::execution::ClientKeyVerifier;
+use sha2::{Digest as _, Sha256};
+
+use super::map_store_error;
+use crate::{
+    model::{
+        AdminError,
+        auth::{
+            AuthSession, ChangePassword, LoginCommand, LoginError, SessionGrant, SessionSubject,
+        },
+    },
+    ports::store::AuthStore,
+};
+
+mod service;
+mod session;
+
+/// 所有控制面接口消费同一个会话服务，权限由服务端身份决定
+#[async_trait]
+pub trait AuthService: Send + Sync {
+    async fn change_password(
+        &self,
+        session_id: Option<&str>,
+        command: ChangePassword,
+        source_ip: IpAddr,
+    ) -> Result<(), AdminError>;
+    async fn ensure_default_admin(&self, password: &str) -> Result<bool, AdminError>;
+    async fn session(&self, session_id: Option<&str>) -> Result<Option<AuthSession>, AdminError>;
+    async fn renew_session(
+        &self,
+        refresh_token: Option<&str>,
+        access_token: Option<&str>,
+    ) -> Result<Option<SessionGrant>, AdminError>;
+    async fn resolve_admin_user_id(
+        &self,
+        session_id: Option<&str>,
+    ) -> Result<Option<String>, AdminError>;
+    async fn verify_admin_api_key(&self, key: &str) -> Result<bool, AdminError>;
+    async fn login(
+        &self,
+        command: LoginCommand,
+        source_ip: IpAddr,
+        previous_session_id: Option<&str>,
+    ) -> Result<SessionGrant, LoginError>;
+    async fn logout(&self, session_id: &str) -> Result<(), AdminError>;
+}
+
+const MAX_SESSION_TTL_MINUTES: i64 = 366 * 24 * 60;
+
+pub(crate) struct DefaultAuthService {
+    default_admin_user_id: String,
+    admin_access_ttl: Duration,
+    admin_session_ttl: Duration,
+    admin_session_absolute_ttl: Duration,
+    key_session_ttl: Duration,
+    store: Arc<dyn AuthStore>,
+    verifier: Arc<dyn ClientKeyVerifier>,
+}
+
+impl DefaultAuthService {
+    #[must_use]
+    pub(crate) fn new(
+        config: &crate::AdminConfig,
+        key_session_ttl_minutes: u64,
+        store: Arc<dyn AuthStore>,
+        verifier: Arc<dyn ClientKeyVerifier>,
+    ) -> Self {
+        let admin_session_ttl = session_ttl(config.session_ttl_minutes);
+        Self {
+            default_admin_user_id: config.default_username.clone(),
+            // 访问凭据最多有效 24 小时，较短的不活动期限也要留出续期窗口
+            admin_access_ttl: Duration::hours(24).min(admin_session_ttl / 4),
+            admin_session_ttl,
+            admin_session_absolute_ttl: session_ttl(config.session_absolute_ttl_minutes),
+            key_session_ttl: session_ttl(key_session_ttl_minutes),
+            store,
+            verifier,
+        }
+    }
+
+    async fn load_live_session(&self, id: &str) -> Result<Option<AuthSession>, AdminError> {
+        let Some(session) = self
+            .store
+            .load_session(id)
+            .await
+            .map_err(|error| map_store_error(error, "authentication session"))?
+        else {
+            return Ok(None);
+        };
+        if session.retained_until() <= Utc::now()
+            || session
+                .absolute_expires_at
+                .is_some_and(|expiry| expiry <= Utc::now())
+        {
+            return Ok(None);
+        }
+        let valid = match &session.subject {
+            SessionSubject::Admin {
+                admin_user_id,
+                credential_fingerprint,
+            } => self
+                .store
+                .load_password_hash(admin_user_id)
+                .await
+                .map_err(|error| map_store_error(error, "administrator session"))?
+                .is_some_and(|hash| password_fingerprint(&hash) == *credential_fingerprint),
+            SessionSubject::Key { client_key_id } => self
+                .store
+                .client_key_enabled(client_key_id)
+                .await
+                .map_err(|error| map_store_error(error, "session key"))?,
+        };
+        if !valid {
+            let _ = self.store.delete_session(id).await;
+            return Ok(None);
+        }
+        Ok(Some(session))
+    }
+}
+
+fn session_ttl(minutes: u64) -> Duration {
+    Duration::minutes(
+        i64::try_from(minutes)
+            .unwrap_or(MAX_SESSION_TTL_MINUTES)
+            .clamp(1, MAX_SESSION_TTL_MINUTES),
+    )
+}
+
+// 指纹只绑定已加盐的密码哈希，不把密码或原始哈希复制到 Redis 会话
+fn password_fingerprint(password_hash: &str) -> String {
+    URL_SAFE_NO_PAD.encode(Sha256::digest(password_hash.as_bytes()))
+}
@@ -1,93 +1,35 @@
-//! 控制面登录、会话恢复与身份校验的唯一 owner
+//! 管理员和 Key 的登录、退出、密码策略与会话访问

-use std::{net::IpAddr, sync::Arc, time::Duration as StdDuration};
+use std::{net::IpAddr, time::Duration as StdDuration};

 use argon2::{Argon2, PasswordHash, PasswordHasher, PasswordVerifier};
 use async_trait::async_trait;
 use base64::{Engine as _, engine::general_purpose::URL_SAFE_NO_PAD};
-use chrono::{Duration, Utc};
-use gateway_core::engine::execution::ClientKeyVerifier;
+use chrono::Utc;
 use rand_core::{OsRng, RngCore as _};
-use sha2::{Digest, Sha256};
 use subtle::ConstantTimeEq as _;
 use uuid::Uuid;

+use super::{
+    AuthService, DefaultAuthService, password_fingerprint,
+    session::{self, Credential, storage_id},
+};
 use crate::{
    model::{
        AdminError, AdminErrorKind,
        auth::{
            AdminAuditEvent, AuditActorKind, AuthSession, ChangePassword, LoginCommand, LoginError,
-            LoginResult, SessionSubject,
+            SessionGrant, SessionSubject,
        },
    },
-    ports::store::AuthStore,
+    use_case::map_store_error,
 };

-use super::map_store_error;
-
-/// 所有控制面接口消费同一个会话服务，权限由服务端身份决定
-#[async_trait]
-pub trait AuthService: Send + Sync {
-    async fn change_password(
-        &self,
-        session_id: Option<&str>,
-        command: ChangePassword,
-        source_ip: IpAddr,
-    ) -> Result<(), AdminError>;
-    async fn ensure_default_admin(&self, password: &str) -> Result<bool, AdminError>;
-    async fn session(&self, session_id: Option<&str>) -> Result<Option<AuthSession>, AdminError>;
-    async fn renew_session(
-        &self,
-        session_id: Option<&str>,
-    ) -> Result<Option<AuthSession>, AdminError>;
-    async fn resolve_admin_user_id(
-        &self,
-        session_id: Option<&str>,
-    ) -> Result<Option<String>, AdminError>;
-    async fn verify_admin_api_key(&self, key: &str) -> Result<bool, AdminError>;
-    async fn login(
-        &self,
-        command: LoginCommand,
-        source_ip: IpAddr,
-        previous_session_id: Option<&str>,
-    ) -> Result<LoginResult, LoginError>;
-    async fn logout(&self, session_id: &str) -> Result<(), AdminError>;
-}
-
-const MAX_SESSION_TTL_MINUTES: i64 = 366 * 24 * 60;
 const LOGIN_WINDOW: StdDuration = StdDuration::from_secs(60);
 const LOGIN_ATTEMPTS_PER_SOURCE: u32 = 10;
 const LOGIN_ATTEMPTS_GLOBAL: u32 = 200;

-pub(crate) struct DefaultAuthService {
-    default_admin_user_id: String,
-    admin_session_ttl: Duration,
-    admin_session_absolute_ttl: Duration,
-    key_session_ttl: Duration,
-    store: Arc<dyn AuthStore>,
-    verifier: Arc<dyn ClientKeyVerifier>,
-}
-
 impl DefaultAuthService {
-    #[must_use]
-    pub(crate) fn new(
-        default_admin_user_id: impl Into<String>,
-        admin_session_ttl_minutes: u64,
-        admin_session_absolute_ttl_minutes: u64,
-        key_session_ttl_minutes: u64,
-        store: Arc<dyn AuthStore>,
-        verifier: Arc<dyn ClientKeyVerifier>,
-    ) -> Self {
-        Self {
-            default_admin_user_id: default_admin_user_id.into(),
-            admin_session_ttl: session_ttl(admin_session_ttl_minutes),
-            admin_session_absolute_ttl: session_ttl(admin_session_absolute_ttl_minutes),
-            key_session_ttl: session_ttl(key_session_ttl_minutes),
-            store,
-            verifier,
-        }
-    }
-
    fn auth_audit(&self, action: &str, admin_user_id: &str) -> AdminAuditEvent {
        AdminAuditEvent {
            id: format!("audit_{}", Uuid::now_v7().simple()),
@@ -228,50 +170,23 @@ impl AuthService for DefaultAuthService {
    }

    async fn session(&self, session_id: Option<&str>) -> Result<Option<AuthSession>, AdminError> {
-        let Some(session_id) = session_id.filter(|value| !value.is_empty()) else {
+        let Some(raw) = session_id.filter(|value| !value.is_empty()) else {
            return Ok(None);
        };
-        let Some(session) = self
-            .store
-            .load_session(session_id)
-            .await
-            .map_err(|error| map_store_error(error, "authentication session"))?
-        else {
+        let Some(session) = self.load_live_session(storage_id(raw)).await? else {
            return Ok(None);
        };
-        if session.expires_at <= Utc::now()
-            || session
-                .absolute_expires_at
-                .is_some_and(|expiry| expiry <= Utc::now())
-        {
-            // Redis 的 TTL 负责过期清理，避免旧读取删除另一个请求刚续期的会话
+        if session.expires_at <= Utc::now() {
            return Ok(None);
        }
-        if let SessionSubject::Admin {
-            admin_user_id,
-            credential_fingerprint,
-        } = &session.subject
-        {
-            let password_hash = self
-                .store
-                .load_password_hash(admin_user_id)
-                .await
-                .map_err(|error| map_store_error(error, "administrator session"))?;
-            if password_hash
-                .is_none_or(|hash| password_fingerprint(&hash) != *credential_fingerprint)
-            {
-                let _ = self.store.delete_session(session_id).await;
+        if let Some(renewal) = &session.renewal {
+            let Some(credential) = Credential::parse(raw).filter(|value| !value.refresh) else {
+                return Ok(None);
+            };
+            if !credential.owns(renewal) {
                return Ok(None);
            }
-        }
-        if let SessionSubject::Key { client_key_id } = &session.subject
-            && !self
-                .store
-                .client_key_enabled(client_key_id)
-                .await
-                .map_err(|error| map_store_error(error, "session key"))?
-        {
-            let _ = self.store.delete_session(session_id).await;
+        } else if Credential::parse(raw).is_some() {
            return Ok(None);
        }
        Ok(Some(session))
@@ -279,33 +194,25 @@ impl AuthService for DefaultAuthService {

    async fn renew_session(
        &self,
-        session_id: Option<&str>,
-    ) -> Result<Option<AuthSession>, AdminError> {
-        let Some(session_id) = session_id else {
-            return Ok(None);
-        };
-        let Some(session) = self.session(Some(session_id)).await? else {
-            return Ok(None);
-        };
-        // Key 与升级前的会话保留原有期限，不能凭续期获得新的最长登录窗口
-        let Some(absolute) = session
-            .absolute_expires_at
-            .filter(|_| matches!(session.subject, SessionSubject::Admin { .. }))
-        else {
-            return Ok(Some(session));
-        };
-        let now = Utc::now();
-        let expires_at = (now + self.admin_session_ttl).min(absolute);
-        let interval = (self.admin_session_ttl / 4).min(Duration::minutes(1));
-        if expires_at <= session.expires_at
-            || session.expires_at - now > self.admin_session_ttl - interval
-        {
-            return Ok(Some(session));
+        refresh_token: Option<&str>,
+        access_token: Option<&str>,
+    ) -> Result<Option<SessionGrant>, AdminError> {
+        if let Some(refresh) = refresh_token {
+            return self.refresh(refresh).await;
        }
-        self.store
-            .renew_session(session_id, &session, expires_at)
-            .await
-            .map_err(|error| map_store_error(error, "authentication session renewal"))
+        // Key 与升级前的单凭据仅返回仍有效的原会话，不授予新的续期能力
+        let Some(session) = self
+            .session(access_token)
+            .await?
+            .filter(|session| session.renewal.is_none())
+        else {
+            return Ok(None);
+        };
+        Ok(Some(SessionGrant {
+            session_id: access_token.unwrap_or_default().to_owned(),
+            refresh_token: None,
+            session,
+        }))
    }

    async fn resolve_admin_user_id(
@@ -346,7 +253,7 @@ impl AuthService for DefaultAuthService {
        command: LoginCommand,
        source_ip: IpAddr,
        previous_session_id: Option<&str>,
-    ) -> Result<LoginResult, LoginError> {
+    ) -> Result<SessionGrant, LoginError> {
        if let Some(retry_after) = self
            .store
            .consume_login_attempt(
@@ -370,14 +277,31 @@ impl AuthService for DefaultAuthService {
        let now = Utc::now();
        let absolute_expires_at = matches!(subject, SessionSubject::Admin { .. })
            .then_some(now + self.admin_session_absolute_ttl);
-        let session = AuthSession {
-            subject,
-            expires_at: (now + ttl).min(absolute_expires_at.unwrap_or(now + ttl)),
-            absolute_expires_at,
+        let refresh_expiry = (now + ttl).min(absolute_expires_at.unwrap_or(now + ttl));
+        let grant = if let Some(absolute) = absolute_expires_at {
+            session::issue(
+                subject,
+                (now + self.admin_access_ttl).min(refresh_expiry),
+                refresh_expiry,
+                absolute,
+            )
+            .map_err(|_| LoginError::Unavailable)?
+        } else {
+            SessionGrant {
+                session_id: random_session_token(),
+                refresh_token: None,
+                session: AuthSession {
+                    subject,
+                    expires_at: refresh_expiry,
+                    absolute_expires_at: None,
+                    renewal: None,
+                },
+            }
        };
-        let session_id = random_session_token();
+        let session_id = storage_id(&grant.session_id);
+        let session = &grant.session;
        self.store
-            .store_session(&session_id, &session)
+            .store_session(session_id, session)
            .await
            .map_err(|_| LoginError::Unavailable)?;
        if let SessionSubject::Admin { admin_user_id, .. } = &session.subject
@@ -387,26 +311,39 @@ impl AuthService for DefaultAuthService {
                .await
                .is_err()
        {
-            let _ = self.store.delete_session(&session_id).await;
+            let _ = self.store.delete_session(session_id).await;
            return Err(LoginError::Unavailable);
        }
        // 新身份验证成功后才撤销旧会话；撤销失败时不向浏览器提交新会话
        if let Some(previous) = previous_session_id.filter(|value| !value.is_empty())
            && self.logout(previous).await.is_err()
        {
-            let _ = self.store.delete_session(&session_id).await;
+            let _ = self.store.delete_session(session_id).await;
            return Err(LoginError::Unavailable);
        }
-        Ok(LoginResult {
-            session_id,
-            session,
-        })
+        Ok(grant)
    }

    async fn logout(&self, session_id: &str) -> Result<(), AdminError> {
+        let id = storage_id(session_id);
+        let Some(stored) = self
+            .store
+            .load_session(id)
+            .await
+            .map_err(|error| map_store_error(error, "authentication session"))?
+        else {
+            return Ok(());
+        };
+        if let Some(renewal) = &stored.renewal {
+            if !Credential::parse(session_id).is_some_and(|credential| credential.owns(renewal)) {
+                return Ok(());
+            }
+        } else if Credential::parse(session_id).is_some() {
+            return Ok(());
+        }
        let session = self
            .store
-            .delete_session(session_id)
+            .delete_session(id)
            .await
            .map_err(|error| map_store_error(error, "authentication session"))?;
        if let Some(AuthSession {
@@ -423,14 +360,6 @@ impl AuthService for DefaultAuthService {
    }
 }

-fn session_ttl(minutes: u64) -> Duration {
-    Duration::minutes(
-        i64::try_from(minutes)
-            .unwrap_or(MAX_SESSION_TTL_MINUTES)
-            .clamp(1, MAX_SESSION_TTL_MINUTES),
-    )
-}
-
 fn validate_new_password(password: &str) -> Result<(), AdminError> {
    if password.trim().chars().count() < 12
        || password.len() > 1024
@@ -470,8 +399,3 @@ fn valid_admin_api_key_shape(value: &str) -> bool {
        && value.starts_with("admin-")
        && value[6..].bytes().all(|byte| byte.is_ascii_hexdigit())
 }
-
-// 指纹只绑定已加盐的密码哈希，不把密码或原始哈希复制到 Redis 会话
-fn password_fingerprint(password_hash: &str) -> String {
-    URL_SAFE_NO_PAD.encode(Sha256::digest(password_hash.as_bytes()))
-}
@@ -0,0 +1,214 @@
+//! 双凭据会话的签发、摘要校验与短窗口重试，不持久化可直接使用的凭据
+
+use base64::{Engine as _, engine::general_purpose::URL_SAFE_NO_PAD};
+use chrono::{DateTime, Duration, Utc};
+use rand_core::{OsRng, RngCore as _};
+use sha2::{Digest as _, Sha256};
+use subtle::ConstantTimeEq as _;
+
+use super::DefaultAuthService;
+use crate::{
+    model::{
+        AdminError, AdminErrorKind,
+        auth::{AuthSession, SessionGrant, SessionRefreshReplay, SessionRenewal, SessionSubject},
+    },
+    use_case::map_store_error,
+};
+
+const REPLAY_WINDOW: Duration = Duration::seconds(30);
+
+pub(super) struct Credential<'a> {
+    pub id: &'a str,
+    pub secret: &'a str,
+    pub refresh: bool,
+}
+
+impl<'a> Credential<'a> {
+    pub fn parse(value: &'a str) -> Option<Self> {
+        let mut parts = value.split('.');
+        let refresh = match parts.next()? {
+            "a2" => false,
+            "r2" => true,
+            _ => return None,
+        };
+        let id = parts.next()?;
+        let secret = parts.next()?;
+        if parts.next().is_some() || !valid_secret(id) || !valid_secret(secret) {
+            return None;
+        }
+        Some(Self {
+            id,
+            secret,
+            refresh,
+        })
+    }
+
+    pub fn digest(&self) -> [u8; 32] {
+        digest(self.secret)
+    }
+
+    pub fn owns(&self, renewal: &SessionRenewal) -> bool {
+        if self.refresh {
+            matches_digest(&renewal.refresh_digest, &self.digest())
+                || renewal
+                    .previous
+                    .as_ref()
+                    .is_some_and(|previous| matches_digest(&previous.digest, &self.digest()))
+        } else {
+            matches_digest(&renewal.access_digest, &self.digest())
+        }
+    }
+}
+
+fn valid_secret(value: &str) -> bool {
+    value.len() == 43
+        && URL_SAFE_NO_PAD
+            .decode(value)
+            .is_ok_and(|bytes| bytes.len() == 32)
+}
+
+pub(super) fn storage_id(value: &str) -> &str {
+    Credential::parse(value).map_or(value, |credential| credential.id)
+}
+
+fn matches_digest(left: &[u8; 32], right: &[u8; 32]) -> bool {
+    bool::from(left.ct_eq(right))
+}
+
+fn digest(secret: &str) -> [u8; 32] {
+    Sha256::digest(secret.as_bytes()).into()
+}
+
+fn random_bytes() -> [u8; 32] {
+    let mut bytes = [0; 32];
+    OsRng.fill_bytes(&mut bytes);
+    bytes
+}
+
+// 使用标准 HKDF 的独立用途标签；只有盐和摘要留在 Store，重试仍须持有原始凭据
+fn derive(secret: &str, salt: Option<&[u8]>, purpose: &[u8]) -> Result<String, AdminError> {
+    let mut output = [0; 32];
+    hkdf::Hkdf::<Sha256>::new(salt, secret.as_bytes())
+        .expand(purpose, &mut output)
+        .map_err(|_| AdminError::internal("会话凭据派生失败"))?;
+    Ok(URL_SAFE_NO_PAD.encode(output))
+}
+
+fn access_secret(refresh: &str) -> Result<String, AdminError> {
+    derive(refresh, None, b"cpr-session-v2/access")
+}
+
+pub(super) fn issue(
+    subject: SessionSubject,
+    access_expiry: DateTime<Utc>,
+    refresh_expiry: DateTime<Utc>,
+    absolute: DateTime<Utc>,
+) -> Result<SessionGrant, AdminError> {
+    let id = URL_SAFE_NO_PAD.encode(random_bytes());
+    let secret = URL_SAFE_NO_PAD.encode(random_bytes());
+    let session = AuthSession {
+        subject,
+        expires_at: access_expiry,
+        absolute_expires_at: Some(absolute),
+        renewal: Some(SessionRenewal {
+            expires_at: refresh_expiry,
+            access_digest: digest(&access_secret(&secret)?),
+            refresh_digest: digest(&secret),
+            previous: None,
+        }),
+    };
+    grant(&id, &secret, session)
+}
+
+fn grant(id: &str, refresh: &str, session: AuthSession) -> Result<SessionGrant, AdminError> {
+    Ok(SessionGrant {
+        session_id: format!("a2.{id}.{}", access_secret(refresh)?),
+        refresh_token: Some(format!("r2.{id}.{refresh}")),
+        session,
+    })
+}
+
+impl DefaultAuthService {
+    pub(super) async fn refresh(&self, raw: &str) -> Result<Option<SessionGrant>, AdminError> {
+        let Some(credential) = Credential::parse(raw).filter(|value| value.refresh) else {
+            return Ok(None);
+        };
+        let mut current = self.load_live_session(credential.id).await?;
+        // CAS 冲突只重新解释同一请求的凭据，不对并发退出进行补建
+        for _ in 0..3 {
+            let Some(session) = current else {
+                return Ok(None);
+            };
+            let Some(renewal) = &session.renewal else {
+                return Ok(None);
+            };
+            let now = Utc::now();
+            if session.retained_until() <= now
+                || session.absolute_expires_at.is_none_or(|limit| limit <= now)
+            {
+                return Ok(None);
+            }
+            if matches_digest(&renewal.refresh_digest, &credential.digest()) {
+                // 其他标签页已经刷新或客户端重试时复用当前代，避免 Cookie 响应相互覆盖
+                if session.expires_at > now {
+                    return grant(credential.id, credential.secret, session).map(Some);
+                }
+                let absolute = session
+                    .absolute_expires_at
+                    .ok_or_else(|| AdminError::internal("缺少会话最长有效期"))?;
+                let salt = random_bytes();
+                let next_secret =
+                    derive(credential.secret, Some(&salt), b"cpr-session-v2/refresh")?;
+                let refresh_expiry = (now + self.admin_session_ttl).min(absolute);
+                let access_expiry = (now + self.admin_access_ttl).min(refresh_expiry);
+                let replacement = AuthSession {
+                    expires_at: access_expiry,
+                    renewal: Some(SessionRenewal {
+                        expires_at: refresh_expiry,
+                        access_digest: digest(&access_secret(&next_secret)?),
+                        refresh_digest: digest(&next_secret),
+                        previous: Some(SessionRefreshReplay {
+                            digest: credential.digest(),
+                            salt,
+                            expires_at: (now + REPLAY_WINDOW).min(access_expiry),
+                        }),
+                    }),
+                    ..session.clone()
+                };
+                current = self
+                    .store
+                    .compare_exchange_session(credential.id, &session, Some(&replacement))
+                    .await
+                    .map_err(|error| map_store_error(error, "authentication session rotation"))?;
+                if current.as_ref() == Some(&replacement) {
+                    return grant(credential.id, &next_secret, replacement).map(Some);
+                }
+            } else if let Some(previous) = renewal
+                .previous
+                .as_ref()
+                .filter(|previous| matches_digest(&previous.digest, &credential.digest()))
+            {
+                if previous.expires_at > now {
+                    let secret = derive(
+                        credential.secret,
+                        Some(&previous.salt),
+                        b"cpr-session-v2/refresh",
+                    )?;
+                    return grant(credential.id, &secret, session).map(Some);
+                }
+                // 已知上一代在重试窗口外再次使用，原子撤销整个会话
+                current = self
+                    .store
+                    .compare_exchange_session(credential.id, &session, None)
+                    .await
+                    .map_err(|error| map_store_error(error, "authentication session revocation"))?;
+            } else {
+                return Ok(None);
+            }
+        }
+        Err(AdminError::new(
+            AdminErrorKind::Unavailable,
+            "会话正在变更，请重试",
+        ))
+    }
+}
@@ -106,7 +106,8 @@ pub(super) async fn pending_authorization(
            proxy = required_credential(accounts, provider_kind, account_id, resource)
                .await?
                .credential
-                .outbound_proxy;
+                .effective_outbound_proxy()
+                .cloned();
            AuthorizationMutationTarget::Reauthorize {
                account_id: account_id.clone(),
            }
@@ -121,6 +122,9 @@ pub(super) async fn pending_authorization(
                        .await
                        .map_err(|error| map_store_error(error, "proxy"))?;
                    proxy_id = Some(record.id);
+                    if !record.enabled {
+                        return Err(AdminError::invalid("代理已禁用，请启用后再选择"));
+                    }
                    Some(record.proxy)
                }
                Some(AccountProxySelection::Direct) | None => None,
@@ -192,10 +192,12 @@ impl KeyUsageService for DefaultKeyUsageService {
                .ok_or_else(|| AdminError::internal("时间超出支持范围"))?,
            end: now,
        };
-        let (overview, trend, health_points) = futures::try_join!(
-            self.observations.usage_summary(query.range, filter.clone()),
-            self.observations
-                .usage_trend(query.range, filter, Granularity::for_range(query.range)),
+        let (observation, health_points) = futures::try_join!(
+            self.observations.usage_insights_observation(
+                query.range,
+                filter,
+                Granularity::for_range(query.range)
+            ),
            self.observations.usage_trend(
                today,
                usage_filter(&id, None),
@@ -205,8 +207,8 @@ impl KeyUsageService for DefaultKeyUsageService {
        .map_err(|error| map_store_error(error, "key usage overview"))?;
        Ok(Some(KeyUsageOverview {
            key,
-            overview,
-            trend,
+            overview: observation.overview,
+            trend: observation.trend,
            health_timeline: health_timeline_at(&health_points, now, self.timezone)?,
        }))
    }
@@ -223,6 +225,7 @@ impl KeyUsageService for DefaultKeyUsageService {
            KeyUsageRecordKind::Success => KeyUsageRecords::Success(
                self.observations
                    .list_usage_records(UsageQuery {
+                        status: Default::default(),
                        range: query.usage.range,
                        filter: usage_filter(&id, query.usage.model),
                        current_page: query.current_page,
@@ -18,6 +18,7 @@ pub mod plugins;
 pub mod proxies;
 pub mod settings;
 pub mod system;
+pub mod usage_data;

 mod credential_mutation;
 mod error;
@@ -0,0 +1,227 @@
+//! 按故障目标收集诊断证据，补充读取失败不丢弃已取得的记录
+
+use std::{
+    collections::{HashSet, VecDeque},
+    time::Duration,
+};
+
+use tokio::time::{Instant, timeout_at};
+
+use super::{DefaultObservabilityService, map_store_error};
+use crate::model::{
+    AdminError, AdminErrorKind,
+    diagnostics::{DiagnosticBundle, DiagnosticGap, DiagnosticRequest, DiagnosticTarget},
+    observability::OpsError,
+};
+
+const MAX_REQUESTS: usize = 8;
+const MAX_ERRORS: u16 = 128;
+
+impl DefaultObservabilityService {
+    pub(super) async fn collect_diagnostics(
+        &self,
+        target: DiagnosticTarget,
+    ) -> Result<DiagnosticBundle, AdminError> {
+        if target.id().trim().is_empty() || target.id().len() > 256 {
+            return Err(AdminError::invalid("诊断目标 ID 不合法"));
+        }
+        let deadline = Instant::now() + Duration::from_secs(20);
+        let (collected, environment) = tokio::join!(
+            self.collect_records(target, deadline),
+            timeout_at(deadline, self.system.version()),
+        );
+        let mut bundle = collected?;
+        match environment {
+            Ok(Ok(version)) => bundle.environment = Some(version),
+            _ => gap(&mut bundle, "environment", "collection_failed"),
+        }
+        Ok(bundle)
+    }
+
+    async fn collect_records(
+        &self,
+        target: DiagnosticTarget,
+        deadline: Instant,
+    ) -> Result<DiagnosticBundle, AdminError> {
+        let mut bundle = DiagnosticBundle {
+            target,
+            collected_at: chrono::Utc::now(),
+            environment: None,
+            error: None,
+            requests: Vec::new(),
+            gaps: Vec::new(),
+        };
+        let mut remaining_errors = MAX_ERRORS;
+        let first_id = match &bundle.target {
+            DiagnosticTarget::Request(id) => Some(id.clone()),
+            DiagnosticTarget::Operation(_) => {
+                let mut errors = self.export_errors(&bundle.target, 1, deadline).await?;
+                let error = errors
+                    .pop()
+                    .ok_or_else(|| AdminError::not_found("错误记录不存在或已过期"))?;
+                let id = error.request_id.clone();
+                bundle.error = Some(error);
+                remaining_errors -= 1;
+                id
+            }
+        };
+        let mut pending = VecDeque::from_iter(first_id);
+        let mut seen = HashSet::new();
+        while let Some(id) = pending.pop_front() {
+            if !seen.insert(id.clone()) {
+                continue;
+            }
+            if bundle.requests.len() >= MAX_REQUESTS {
+                gap(&mut bundle, "requests", "related_request_limit");
+                break;
+            }
+            let section = format!("requests.{id}");
+            let target = DiagnosticTarget::Request(id.clone());
+            let selected = bundle
+                .error
+                .as_ref()
+                .filter(|error| error.request_id.as_deref() == Some(id.as_str()));
+            // 事件导出已经持有选中记录，额外读取一个槽位用于去重后判断是否超限
+            let read_limit = remaining_errors + 1 + u16::from(selected.is_some());
+            let (detail, errors) = tokio::join!(
+                timeout_at(deadline, self.store.usage_record_detail(&id)),
+                self.export_errors(&target, read_limit, deadline),
+            );
+            let (detail, detail_error) = match detail {
+                Ok(Ok(detail)) => (Some(detail), None),
+                Ok(Err(error)) => (None, Some(map_store_error(error, "diagnostic request"))),
+                Err(_) => (
+                    None,
+                    Some(AdminError::new(AdminErrorKind::Unavailable, "诊断采集超时")),
+                ),
+            };
+            let mut errors = match errors {
+                Ok(mut errors) => {
+                    if let Some(selected) = selected {
+                        errors.retain(|error| {
+                            error.source != selected.source || error.event_id != selected.event_id
+                        });
+                    }
+                    errors
+                }
+                Err(error) => {
+                    if detail.is_none() && bundle.requests.is_empty() && bundle.error.is_none() {
+                        return Err(error);
+                    }
+                    gap(
+                        &mut bundle,
+                        &format!("{section}.errors"),
+                        "collection_failed",
+                    );
+                    Vec::new()
+                }
+            };
+            if detail.is_none()
+                && errors.is_empty()
+                && bundle.requests.is_empty()
+                && bundle.error.is_none()
+            {
+                return Err(
+                    detail_error.unwrap_or_else(|| AdminError::not_found("请求记录不存在或已过期"))
+                );
+            }
+            if errors.len() > usize::from(remaining_errors) {
+                gap(
+                    &mut bundle,
+                    &format!("{section}.errors"),
+                    "error_record_limit",
+                );
+                errors.truncate(usize::from(remaining_errors));
+            }
+            remaining_errors =
+                remaining_errors.saturating_sub(u16::try_from(errors.len()).unwrap_or(MAX_ERRORS));
+            if let Some(record) = &detail {
+                for related in &record.related_requests {
+                    if let Some(id) = related.get("requestId").and_then(serde_json::Value::as_str) {
+                        pending.push_back(id.to_owned());
+                    }
+                }
+                if record.request.outcome == crate::model::observability::RequestOutcome::Running {
+                    gap(&mut bundle, &section, "request_not_finalized");
+                }
+                match &record.trace {
+                    None => gap(
+                        &mut bundle,
+                        &format!("{section}.trace"),
+                        "not_recorded_or_retained",
+                    ),
+                    Some(trace) => {
+                        if trace["droppedEvents"].as_u64().unwrap_or(0) > 0 {
+                            gap(&mut bundle, &format!("{section}.trace"), "events_evicted");
+                        }
+                        let events = trace["events"].as_array();
+                        if !events.is_some_and(|events| {
+                            events.iter().any(|event| {
+                                event["stage"] == "request.routed"
+                                    && event["data"]["accountPolicy"].is_object()
+                            })
+                        }) {
+                            gap(&mut bundle, &section, "incident_policy_not_recorded");
+                        }
+                        for event in events.into_iter().flatten() {
+                            if event["stage"] == "capture.gap" || event["data"]["truncated"] == true
+                            {
+                                gap(
+                                    &mut bundle,
+                                    &format!("{section}.trace"),
+                                    "capture_gap_or_truncation",
+                                );
+                            }
+                            if event["stage"] == "retry.decided" && event["data"]["phase"].is_null()
+                            {
+                                gap(
+                                    &mut bundle,
+                                    &format!("{section}.trace"),
+                                    "legacy_retry_facts_not_recorded",
+                                );
+                            }
+                        }
+                    }
+                }
+                gap(
+                    &mut bundle,
+                    &format!("{section}.attempts"),
+                    "best_effort_persistence",
+                );
+            } else {
+                gap(&mut bundle, &section, "request_detail_unavailable");
+            }
+            bundle.requests.push(DiagnosticRequest {
+                request_id: id,
+                detail,
+                errors,
+            });
+        }
+        Ok(bundle)
+    }
+
+    async fn export_errors(
+        &self,
+        target: &DiagnosticTarget,
+        limit: u16,
+        deadline: Instant,
+    ) -> Result<Vec<OpsError>, AdminError> {
+        timeout_at(deadline, self.store.diagnostic_errors(target, limit))
+            .await
+            .map_err(|_| AdminError::new(AdminErrorKind::Unavailable, "诊断采集超时"))?
+            .map_err(|error| map_store_error(error, "diagnostic errors"))
+    }
+}
+
+fn gap(bundle: &mut DiagnosticBundle, section: &str, reason: &'static str) {
+    if !bundle
+        .gaps
+        .iter()
+        .any(|gap| gap.section == section && gap.reason == reason)
+    {
+        bundle.gaps.push(DiagnosticGap {
+            section: section.to_owned(),
+            reason,
+        });
+    }
+}
@@ -4,12 +4,10 @@ use std::{
    collections::{BTreeMap, HashMap, btree_map::Entry},
    str::FromStr,
    sync::Arc,
-    time::{Duration as StdDuration, Instant},
 };

 use async_trait::async_trait;
 use chrono::{DateTime, Duration, Utc};
-use futures::TryStreamExt;
 use gateway_core::{account::ProviderAccountId, routing::ProviderKind};

 use crate::{
@@ -21,16 +19,16 @@ use crate::{
            DiagnosticDimension, DiagnosticsItem, DiagnosticsResult, Granularity, HealthStatus,
            HealthTimeline, HealthTimelinePoint, OpsErrorPage, OpsErrorQuery, ProviderBillingInput,
            RequestMetricPoint, RequestMetrics, TimeRange, Trend, TrendKind, TrendPoint,
-            TrendSummary, UsageBilling, UsageCalculatedBillingFact, UsageDetail, UsageFilter,
-            UsageInsights, UsageInsightsCost, UsageInsightsCostPoint, UsageInsightsHealth,
-            UsageInsightsHealthPoint, UsageInsightsPerformance, UsageInsightsPerformancePoint,
-            UsageOverview, UsagePage, UsageQuery, UsageSummary,
+            TrendSummary, UsageBilling, UsageBillingProjection, UsageCalculatedBillingFact,
+            UsageDetail, UsageFilter, UsageInsights, UsageInsightsCost, UsageInsightsCostPoint,
+            UsageInsightsHealth, UsageInsightsHealthPoint, UsageInsightsPerformance,
+            UsageInsightsPerformancePoint, UsageOverview, UsagePage, UsageQuery, UsageSummary,
        },
        provider_credentials::ProviderQuotaRequest,
    },
    ports::{
        provider::{ProviderAdminErrorKind, ProviderAdminRegistry},
-        store::{AccountStore, ObservabilityStore, SettingsStore, UsageCalculatedBillingStream},
+        store::{AccountStore, ObservabilityStore, SettingsStore, UsageBillingProjector},
    },
 };

@@ -39,59 +37,10 @@ use super::{map_provider_error, map_store_error};
 const HEALTH_TIMELINE_SLOT_MINUTES: i64 = 15;
 const HEALTH_TIMELINE_MIN_SAMPLE_SIZE: u64 = 10;
 const HEALTH_TIMELINE_UNAVAILABLE_FAILURE_THRESHOLD: u64 = 3;
-const HEALTH_TIMELINE_STABLE_RELIABILITY: f64 = 99.0;
-const DASHBOARD_QUERY_BUCKET_SECONDS: i64 = 2;
-const DASHBOARD_QUERY_CACHE_RETENTION: StdDuration = StdDuration::from_secs(2);
-
-#[derive(Clone, Copy, PartialEq, Eq, Hash)]
-struct DashboardQueryKey {
-    start: DateTime<Utc>,
-    end_bucket: i64,
-}
-
-impl DashboardQueryKey {
-    fn new(range: TimeRange) -> Self {
-        Self {
-            start: range.start,
-            end_bucket: range
-                .end
-                .timestamp()
-                .div_euclid(DASHBOARD_QUERY_BUCKET_SECONDS),
-        }
-    }
-}
-
-struct DashboardQueryEntry {
-    created_at: Instant,
-    result: Arc<tokio::sync::OnceCell<Result<DashboardResult, AdminError>>>,
-}
-
-#[derive(Default)]
-struct DashboardQueryCache {
-    entries: tokio::sync::Mutex<HashMap<DashboardQueryKey, DashboardQueryEntry>>,
-}
-
-impl DashboardQueryCache {
-    async fn result_cell(
-        &self,
-        key: DashboardQueryKey,
-    ) -> Arc<tokio::sync::OnceCell<Result<DashboardResult, AdminError>>> {
-        let now = Instant::now();
-        let mut entries = self.entries.lock().await;
-        entries.retain(|_, entry| {
-            now.duration_since(entry.created_at) < DASHBOARD_QUERY_CACHE_RETENTION
-        });
-        Arc::clone(
-            &entries
-                .entry(key)
-                .or_insert_with(|| DashboardQueryEntry {
-                    created_at: now,
-                    result: Arc::new(tokio::sync::OnceCell::new()),
-                })
-                .result,
-        )
-    }
-}
+const HEALTH_TIMELINE_STABLE_RELIABILITY: f64 = 95.0;
+mod export;
+mod store_cache;
+pub(crate) use store_cache::CachedObservabilityStore;

 /// API 消费的观测控制面服务
 #[async_trait]
@@ -122,6 +71,10 @@ pub trait ObservabilityService: Send + Sync {
        dimension: DiagnosticDimension,
    ) -> Result<DiagnosticsResult, AdminError>;
    async fn ops_errors(&self, query: OpsErrorQuery) -> Result<OpsErrorPage, AdminError>;
+    async fn export_diagnostics(
+        &self,
+        target: crate::model::diagnostics::DiagnosticTarget,
+    ) -> Result<crate::model::diagnostics::DiagnosticBundle, AdminError>;
 }

 pub(crate) struct DefaultObservabilityService {
@@ -130,7 +83,7 @@ pub(crate) struct DefaultObservabilityService {
    accounts: Arc<dyn AccountStore>,
    settings: Arc<dyn SettingsStore>,
    providers: ProviderAdminRegistry,
-    dashboard_queries: DashboardQueryCache,
+    system: Arc<dyn super::system::SystemService>,
 }

 impl DefaultObservabilityService {
@@ -141,6 +94,7 @@ impl DefaultObservabilityService {
        settings: Arc<dyn SettingsStore>,
        providers: ProviderAdminRegistry,
        timezone: gateway_core::time::DeploymentTimeZone,
+        system: Arc<dyn super::system::SystemService>,
    ) -> Self {
        Self {
            timezone,
@@ -148,7 +102,7 @@ impl DefaultObservabilityService {
            accounts,
            settings,
            providers,
-            dashboard_queries: DashboardQueryCache::default(),
+            system,
        }
    }

@@ -185,7 +139,7 @@ impl DefaultObservabilityService {
        let yesterday = dashboard_period_metrics(&observation.trend, yesterday_start, today_start);
        let total_billing_usd = observation.totals.billing_usd.clone();
        let total_cached_token_rate = rate_or_zero(
-            observation.totals.cached_tokens,
+            observation.totals.cached_input_tokens,
            observation.totals.input_tokens,
        );
        let (first_token_latency_sum_ms, first_token_latency_count) = observation
@@ -199,7 +153,11 @@ impl DefaultObservabilityService {
            });
        let average_first_token_latency_ms =
            average(first_token_latency_sum_ms, first_token_latency_count);
-        let trend = trend(TrendKind::Usage, observation.trend.clone())?;
+        let trend = trend(
+            TrendKind::Usage,
+            observation.trend.clone(),
+            observation.analytics.clone(),
+        )?;
        let health_timeline =
            health_timeline_at(&observation.trend, observation.range.end, self.timezone)?;
        let wire_profiles = self
@@ -242,20 +200,24 @@ impl DefaultObservabilityService {

 #[async_trait]
 impl ObservabilityService for DefaultObservabilityService {
+    async fn export_diagnostics(
+        &self,
+        target: crate::model::diagnostics::DiagnosticTarget,
+    ) -> Result<crate::model::diagnostics::DiagnosticBundle, AdminError> {
+        self.collect_diagnostics(target).await
+    }
+
    async fn dashboard_summary(
        &self,
        range: TimeRange,
        kind: TrendKind,
    ) -> Result<DashboardResult, AdminError> {
-        let cell = self
-            .dashboard_queries
-            .result_cell(DashboardQueryKey::new(range))
-            .await;
-        let mut result = cell
-            .get_or_init(|| self.load_dashboard_summary(range))
-            .await
-            .clone()?;
-        result.trend = trend(kind, result.observation.trend.clone())?;
+        let mut result = self.load_dashboard_summary(range).await?;
+        result.trend = trend(
+            kind,
+            result.observation.trend.clone(),
+            result.observation.analytics.clone(),
+        )?;
        Ok(result)
    }

@@ -264,12 +226,16 @@ impl ObservabilityService for DefaultObservabilityService {
        range: TimeRange,
        kind: TrendKind,
    ) -> Result<Trend, AdminError> {
-        let points = self
+        let observation = self
            .store
-            .dashboard_trend(range, Granularity::for_range(range))
+            .usage_insights_observation(
+                range,
+                UsageFilter::default(),
+                Granularity::for_range(range),
+            )
            .await
            .map_err(|error| map_store_error(error, "dashboard trend"))?;
-        trend(kind, points)
+        trend(kind, observation.trend, observation.overview.analytics)
    }

    async fn usage_records(&self, query: UsageQuery) -> Result<UsagePage, AdminError> {
@@ -321,21 +287,22 @@ impl ObservabilityService for DefaultObservabilityService {
        filter: UsageFilter,
    ) -> Result<UsageInsights, AdminError> {
        let granularity = Granularity::for_range(range);
-        let aggregates = async {
-            futures::try_join!(
-                self.store.usage_summary(range, filter.clone()),
-                self.store.usage_trend(range, filter.clone(), granularity),
-            )
-            .map_err(|error| map_store_error(error, "usage insights"))
-        };
-        let ((overview, trend), standard_costs) = futures::try_join!(
-            aggregates,
-            recover_standard_costs(
-                &self.providers,
-                self.store
-                    .usage_calculated_billing_facts(range, filter.clone(), granularity),
-            ),
-        )?;
+        let observation = self
+            .store
+            .usage_insights_observation(range, filter, granularity)
+            .await
+            .map_err(|error| map_store_error(error, "usage insights"))?;
+        let mut standard_costs = UsageCostScenarios::default();
+        for point in observation.costs {
+            if let Some(amount) = point.standard_amount {
+                standard_costs.standard.add(point.bucket_start, amount)?;
+            }
+            if let Some(amount) = point.no_cache_amount {
+                standard_costs.no_cache.add(point.bucket_start, amount)?;
+            }
+        }
+        let overview = observation.overview;
+        let trend = observation.trend;
        build_usage_insights(overview, trend, standard_costs)
    }

@@ -389,7 +356,11 @@ impl ObservabilityService for DefaultObservabilityService {
                }
            })
            .collect::<Vec<_>>();
-        Ok(DiagnosticsResult { dimension, items })
+        Ok(DiagnosticsResult {
+            analytics: observation.analytics,
+            dimension,
+            items,
+        })
    }

    async fn ops_errors(&self, query: OpsErrorQuery) -> Result<OpsErrorPage, AdminError> {
@@ -423,8 +394,9 @@ fn build_usage_insights(
    }

    let requests = &overview.requests;
-    let failed_requests = service_failure_count(requests);
-    let health_requests = requests.success_count.saturating_add(failed_requests);
+    let health_window = HealthWindow::from_metrics(requests);
+    let failed_requests = health_window.failed_requests;
+    let health_requests = health_window.eligible_requests();
    let health = UsageInsightsHealth {
        total_requests: requests.request_count,
        success_requests: requests.success_count,
@@ -442,17 +414,19 @@ fn build_usage_insights(
        points: trend
            .iter()
            .map(|point| {
-                let failed_requests = service_failure_count(&point.metrics);
-                let health_requests = point.metrics.success_count.saturating_add(failed_requests);
+                let health_window = HealthWindow::from_metrics(&point.metrics);
                UsageInsightsHealthPoint {
                    total_requests: point.metrics.request_count,
                    bucket_start: point.bucket_start,
                    success_requests: point.metrics.success_count,
-                    failed_requests,
+                    failed_requests: health_window.failed_requests,
                    cancelled_requests: point.metrics.cancelled_count,
                    incomplete_requests: point.metrics.incomplete_count,
                    caller_error_requests: point.metrics.caller_error_count,
-                    error_rate: rate_or_zero(failed_requests, health_requests),
+                    error_rate: rate_or_zero(
+                        health_window.non_success_requests(),
+                        health_window.eligible_requests(),
+                    ),
                }
            })
            .collect(),
@@ -533,14 +507,14 @@ fn build_usage_insights(
        tier_premium,
        tokens_per_request: rate_or_zero(requests.total_tokens, requests.request_count),
        cost_per_successful_request,
-        cached_token_rate: rate_or_zero(requests.cached_tokens, requests.input_tokens),
+        cached_token_rate: rate_or_zero(requests.cached_input_tokens, requests.input_tokens),
        cache_hit_request_rate: ratio(
            requests.cache_hit_request_count,
            requests.cache_eligible_request_count,
        ),
        input_tokens: requests.input_tokens,
        output_tokens: requests.output_tokens,
-        cached_tokens: requests.cached_tokens,
+        cached_input_tokens: requests.cached_input_tokens,
        total_tokens: requests.total_tokens,
        points: trend
            .iter()
@@ -548,7 +522,7 @@ fn build_usage_insights(
                bucket_start: point.bucket_start,
                input_tokens: point.metrics.input_tokens,
                output_tokens: point.metrics.output_tokens,
-                cached_tokens: point.metrics.cached_tokens,
+                cached_input_tokens: point.metrics.cached_input_tokens,
                total_tokens: point.metrics.total_tokens,
                estimated_cost: usd_cost(&point.costs),
                standard_cost: standard_costs_by_bucket.get(&point.bucket_start).cloned(),
@@ -558,7 +532,7 @@ fn build_usage_insights(
                    usd_cost(&point.costs).as_ref(),
                ),
                cached_token_rate: rate_or_zero(
-                    point.metrics.cached_tokens,
+                    point.metrics.cached_input_tokens,
                    point.metrics.input_tokens,
                ),
                cache_hit_request_rate: ratio(
@@ -571,6 +545,7 @@ fn build_usage_insights(
        coverage: overview.attempts.cost_coverage.clone(),
    };
    Ok(UsageInsights {
+        analytics: overview.analytics,
        granularity,
        health,
        performance,
@@ -620,58 +595,65 @@ struct UsageCostScenarios {
    no_cache: ScenarioCosts,
 }

-async fn recover_standard_costs(
-    providers: &ProviderAdminRegistry,
-    mut facts: UsageCalculatedBillingStream<'_>,
-) -> Result<UsageCostScenarios, AdminError> {
-    let mut scenarios = UsageCostScenarios::default();
-    while let Some(mut fact) = facts
-        .try_next()
-        .await
-        .map_err(|error| map_store_error(error, "usage billing facts"))?
-    {
+/// 在后台投影时恢复费用场景，查询不再逐请求读取计费快照
+pub struct ProviderUsageBillingProjector {
+    providers: ProviderAdminRegistry,
+}
+
+impl ProviderUsageBillingProjector {
+    #[must_use]
+    pub fn new(providers: ProviderAdminRegistry) -> Self {
+        Self { providers }
+    }
+}
+
+impl UsageBillingProjector for ProviderUsageBillingProjector {
+    fn project(
+        &self,
+        fact: &UsageCalculatedBillingFact,
+    ) -> Result<UsageBillingProjection, AdminError> {
        let Ok(provider_kind) = ProviderKind::new(fact.provider_kind.clone()) else {
-            continue;
+            return Ok(UsageBillingProjection::default());
        };
        let input = ProviderBillingInput {
            upstream_model_id: fact.upstream_model_id.clone(),
            service_tier: fact.service_tier.clone(),
            input_tokens: fact.input_tokens,
            output_tokens: fact.output_tokens,
-            cached_tokens: fact.cached_tokens,
-            cache_write_tokens: fact.cache_write_tokens,
+            cached_input_tokens: fact.cached_input_tokens,
+            cache_write_input_tokens: fact.cache_write_input_tokens,
            total: fact.total.clone(),
        };
        let breakdown = match fact
            .breakdown
-            .take()
-            .filter(|b| b.total_amount == input.total)
+            .as_ref()
+            .filter(|breakdown| breakdown.total_amount == input.total)
+            .cloned()
            .map_or_else(
-                || providers.calculated_billing(&provider_kind, &input),
-                |b| Ok(Some(b)),
+                || self.providers.calculated_billing(&provider_kind, &input),
+                |breakdown| Ok(Some(breakdown)),
            ) {
            Ok(breakdown) => breakdown,
-            Err(error) if error.kind() == ProviderAdminErrorKind::Unsupported => continue,
+            Err(error) if error.kind() == ProviderAdminErrorKind::Unsupported => {
+                return Ok(UsageBillingProjection::default());
+            }
            Err(error) => return Err(map_provider_error(error, "usage billing")),
        };
        let Some(breakdown) = breakdown else {
-            continue;
+            return Ok(UsageBillingProjection::default());
        };
        if !breakdown
            .standard_amount
            .currency
            .eq_ignore_ascii_case("USD")
        {
-            continue;
-        }
-        scenarios
-            .standard
-            .add(fact.bucket_start, breakdown.standard_amount.amount.clone())?;
-        if let Some(no_cache_cost) = no_cache_cost(&fact, &breakdown) {
-            scenarios.no_cache.add(fact.bucket_start, no_cache_cost)?;
+            return Ok(UsageBillingProjection::default());
        }
+        Ok(UsageBillingProjection {
+            standard_amount: Some(breakdown.standard_amount.amount.clone()),
+            no_cache_amount: no_cache_cost(fact, &breakdown),
+        })
    }
-    Ok(scenarios)
 }

 fn no_cache_cost(
@@ -682,19 +664,21 @@ fn no_cache_cost(
    let input_tokens = fact
        .input_tokens?
        .checked_sub(image.map_or(0, |i| i.input_tokens))?;
-    let cached_tokens = fact
-        .cached_tokens
+    let cached_input_tokens = fact
+        .cached_input_tokens
        .unwrap_or_default()
-        .checked_sub(image.map_or(0, |i| i.cached_tokens))?
+        .checked_sub(image.map_or(0, |i| i.cached_input_tokens))?
        .min(input_tokens);
-    let cache_write_tokens = fact
-        .cache_write_tokens
+    let cache_write_input_tokens = fact
+        .cache_write_input_tokens
        .unwrap_or_default()
-        .min(input_tokens.saturating_sub(cached_tokens));
+        .min(input_tokens.saturating_sub(cached_input_tokens));
    let input_rate = decimal(&breakdown.input_price_per_million.amount)?;
    let replaced_input_amount = input_rate
        .scaled()
-        .checked_mul(u128::from(cached_tokens.saturating_add(cache_write_tokens)))?
+        .checked_mul(u128::from(
+            cached_input_tokens.saturating_add(cache_write_input_tokens),
+        ))?
        .checked_div(1_000_000)?;
    let mut total = decimal(&breakdown.total_amount.amount)?
        .scaled()
@@ -704,7 +688,7 @@ fn no_cache_cost(
    if let Some(image) = image {
        let image_no_cache = decimal(&image.input_price_per_million.amount)?
            .scaled()
-            .checked_mul(u128::from(image.cached_tokens))?
+            .checked_mul(u128::from(image.cached_input_tokens))?
            .checked_div(1_000_000)?;
        total = total
            .checked_sub(decimal(&image.cache_read_amount.amount)?.scaled())?
@@ -829,8 +813,8 @@ impl DefaultObservabilityService {
                service_tier: record.service_tier.clone(),
                input_tokens: record.input_tokens,
                output_tokens: record.output_tokens,
-                cached_tokens: record.cached_tokens,
-                cache_write_tokens: record.cache_write_tokens,
+                cached_input_tokens: record.cached_input_tokens,
+                cache_write_input_tokens: record.cache_write_input_tokens,
                total: total.clone(),
            };
            if let Ok(Some(breakdown)) = self.providers.calculated_billing(&provider_kind, &input) {
@@ -861,8 +845,8 @@ impl DefaultObservabilityService {
                service_tier: record.service_tier.clone(),
                input_tokens: record.input_tokens,
                output_tokens: record.output_tokens,
-                cached_tokens: record.cached_tokens,
-                cache_write_tokens: record.cache_write_tokens,
+                cached_input_tokens: record.cached_input_tokens,
+                cache_write_input_tokens: record.cache_write_input_tokens,
                total: total.clone(),
            };
            if let Ok(Some(breakdown)) = self.providers.calculated_billing(&provider_kind, &input) {
@@ -951,7 +935,11 @@ pub(super) fn health_timeline_at(
    })
 }

-fn trend(kind: TrendKind, points: Vec<RequestMetricPoint>) -> Result<Trend, AdminError> {
+fn trend(
+    kind: TrendKind,
+    points: Vec<RequestMetricPoint>,
+    analytics: crate::model::analytics::AnalyticsMetadata,
+) -> Result<Trend, AdminError> {
    let mut metrics = RequestMetrics::default();
    let mut coverage = CostCoverage::default();
    let mut costs = BTreeMap::<String, DecimalAmount>::new();
@@ -986,7 +974,7 @@ fn trend(kind: TrendKind, points: Vec<RequestMetricPoint>) -> Result<Trend, Admi
    let service_failure_count = service_failure_count(&metrics);
    let success_rate = ratio(
        metrics.success_count,
-        metrics.success_count.saturating_add(service_failure_count),
+        HealthWindow::from_metrics(&metrics).eligible_requests(),
    );
    let cache_hit_request_rate = ratio(
        metrics.cache_hit_request_count,
@@ -1007,13 +995,14 @@ fn trend(kind: TrendKind, points: Vec<RequestMetricPoint>) -> Result<Trend, Admi
        .filter_map(|point| point.metrics.output_throughput_p50)
        .min();
    Ok(Trend {
+        analytics,
        kind,
        points: points.into_iter().map(trend_point).collect(),
        summary: TrendSummary {
            request_count: metrics.request_count,
            input_tokens: metrics.input_tokens,
            output_tokens: metrics.output_tokens,
-            cached_tokens: metrics.cached_tokens,
+            cached_input_tokens: metrics.cached_input_tokens,
            total_tokens: metrics.total_tokens,
            service_failure_count,
            average_latency_ms,
@@ -1044,12 +1033,18 @@ fn trend_point(point: RequestMetricPoint) -> TrendPoint {
            point.metrics.first_token_latency_sum_ms,
            point.metrics.first_token_latency_count,
        ),
-        cached_token_rate: rate_or_zero(point.metrics.cached_tokens, point.metrics.input_tokens),
+        cached_token_rate: rate_or_zero(
+            point.metrics.cached_input_tokens,
+            point.metrics.input_tokens,
+        ),
        cache_hit_request_rate: ratio(
            point.metrics.cache_hit_request_count,
            point.metrics.cache_eligible_request_count,
        ),
-        success_rate: ratio(point.metrics.success_count, point.metrics.request_count),
+        success_rate: ratio(
+            point.metrics.success_count,
+            HealthWindow::from_metrics(&point.metrics).eligible_requests(),
+        ),
        metrics: point.metrics,
        cost_coverage: point.cost_coverage,
        costs: point.costs,
@@ -1070,11 +1065,13 @@ fn dashboard_period_metrics(
        result.request_count = result.request_count.saturating_add(metrics.request_count);
        result.input_tokens = result.input_tokens.saturating_add(metrics.input_tokens);
        result.output_tokens = result.output_tokens.saturating_add(metrics.output_tokens);
-        result.cached_tokens = result.cached_tokens.saturating_add(metrics.cached_tokens);
+        result.cached_input_tokens = result
+            .cached_input_tokens
+            .saturating_add(metrics.cached_input_tokens);
        result.total_tokens = result.total_tokens.saturating_add(metrics.total_tokens);
    }
-    result.cached_token_rate = rate_or_zero(result.cached_tokens, result.input_tokens);
-    result.observed_cached_token_rate = ratio(result.cached_tokens, result.input_tokens);
+    result.cached_token_rate = rate_or_zero(result.cached_input_tokens, result.input_tokens);
+    result.observed_cached_token_rate = ratio(result.cached_input_tokens, result.input_tokens);
    result
 }

@@ -1091,13 +1088,15 @@ fn add_request_metrics(total: &mut RequestMetrics, value: &RequestMetrics) {
        .saturating_add(value.caller_error_count);
    total.input_tokens = total.input_tokens.saturating_add(value.input_tokens);
    total.output_tokens = total.output_tokens.saturating_add(value.output_tokens);
-    total.cached_tokens = total.cached_tokens.saturating_add(value.cached_tokens);
-    total.cache_write_tokens = total
-        .cache_write_tokens
-        .saturating_add(value.cache_write_tokens);
-    total.reasoning_tokens = total
-        .reasoning_tokens
-        .saturating_add(value.reasoning_tokens);
+    total.cached_input_tokens = total
+        .cached_input_tokens
+        .saturating_add(value.cached_input_tokens);
+    total.cache_write_input_tokens = total
+        .cache_write_input_tokens
+        .saturating_add(value.cache_write_input_tokens);
+    total.reasoning_output_tokens = total
+        .reasoning_output_tokens
+        .saturating_add(value.reasoning_output_tokens);
    total.total_tokens = total.total_tokens.saturating_add(value.total_tokens);
    total.first_token_latency_sum_ms = total
        .first_token_latency_sum_ms
@@ -1145,20 +1144,29 @@ struct HealthWindow {
 }

 impl HealthWindow {
+    fn from_metrics(metrics: &RequestMetrics) -> Self {
+        Self {
+            success_requests: metrics.success_count,
+            failed_requests: service_failure_count(metrics),
+            cancelled_requests: metrics.cancelled_count,
+            incomplete_requests: metrics.incomplete_count,
+            caller_error_requests: metrics.caller_error_count,
+        }
+    }
+
+    // 未完成保留交付终态，但上游失败、超时和进程中断都不能视为服务成功
+    fn non_success_requests(self) -> u64 {
+        self.failed_requests
+            .saturating_add(self.incomplete_requests)
+    }
+
+    fn eligible_requests(self) -> u64 {
+        self.success_requests
+            .saturating_add(self.non_success_requests())
+    }
+
    fn add_metrics(&mut self, metrics: &RequestMetrics) {
-        self.success_requests = self.success_requests.saturating_add(metrics.success_count);
-        self.failed_requests = self
-            .failed_requests
-            .saturating_add(service_failure_count(metrics));
-        self.cancelled_requests = self
-            .cancelled_requests
-            .saturating_add(metrics.cancelled_count);
-        self.incomplete_requests = self
-            .incomplete_requests
-            .saturating_add(metrics.incomplete_count);
-        self.caller_error_requests = self
-            .caller_error_requests
-            .saturating_add(metrics.caller_error_count);
+        self.add_window(Self::from_metrics(metrics));
    }

    fn add_window(&mut self, other: Self) {
@@ -1177,15 +1185,13 @@ impl HealthWindow {
 }

 fn health_status(bucket: HealthWindow, is_future: bool) -> HealthStatus {
-    let eligible_requests = bucket
-        .success_requests
-        .saturating_add(bucket.failed_requests);
+    let eligible_requests = bucket.eligible_requests();
    if is_future {
        HealthStatus::Future
    } else if eligible_requests == 0 {
        HealthStatus::NoData
    } else if bucket.success_requests == 0
-        && bucket.failed_requests >= HEALTH_TIMELINE_UNAVAILABLE_FAILURE_THRESHOLD
+        && bucket.non_success_requests() >= HEALTH_TIMELINE_UNAVAILABLE_FAILURE_THRESHOLD
    {
        HealthStatus::Unavailable
    } else if eligible_requests < HEALTH_TIMELINE_MIN_SAMPLE_SIZE {
@@ -1200,9 +1206,7 @@ fn health_status(bucket: HealthWindow, is_future: bool) -> HealthStatus {
 }

 fn health_reliability(bucket: HealthWindow) -> Option<f64> {
-    let eligible_requests = bucket
-        .success_requests
-        .saturating_add(bucket.failed_requests);
+    let eligible_requests = bucket.eligible_requests();
    (eligible_requests > 0)
        .then(|| bucket.success_requests as f64 / eligible_requests as f64 * 100.0)
 }
@@ -0,0 +1,300 @@
+//! 有界统计缓存：身份和完整筛选参与键，统计发布代次使旧快照失效
+
+use crate::model::observability::*;
+use crate::ports::store::{
+    AdminStoreError, AdminStoreErrorKind, AdminStoreResult, ObservabilityStore,
+};
+use async_trait::async_trait;
+use chrono::{DateTime, Utc};
+use std::{collections::HashMap, future::Future, hash::Hash, sync::Arc, time::Duration};
+use tokio::{sync::Mutex, time::Instant};
+
+const CAPACITY: usize = 64;
+const TTL: Duration = Duration::from_secs(15);
+const MAX_STALE: Duration = Duration::from_secs(60);
+
+type Slot<T> = Arc<Mutex<Option<Cached<T>>>>;
+struct Cached<T> {
+    value: T,
+    created: Instant,
+}
+struct Entry<T> {
+    slot: Slot<T>,
+    touched: Instant,
+}
+struct Cache<K, T> {
+    entries: Mutex<HashMap<K, Entry<T>>>,
+}
+impl<K, T> Default for Cache<K, T> {
+    fn default() -> Self {
+        Self {
+            entries: Mutex::new(HashMap::new()),
+        }
+    }
+}
+
+trait AnalyticsValue: Clone {
+    fn metadata(&mut self) -> &mut AnalyticsMetadata;
+}
+impl AnalyticsValue for DashboardObservation {
+    fn metadata(&mut self) -> &mut AnalyticsMetadata {
+        &mut self.analytics
+    }
+}
+impl AnalyticsValue for UsageOverview {
+    fn metadata(&mut self) -> &mut AnalyticsMetadata {
+        &mut self.analytics
+    }
+}
+impl AnalyticsValue for UsageInsightsObservation {
+    fn metadata(&mut self) -> &mut AnalyticsMetadata {
+        &mut self.overview.analytics
+    }
+}
+impl AnalyticsValue for DiagnosticsObservation {
+    fn metadata(&mut self) -> &mut AnalyticsMetadata {
+        &mut self.analytics
+    }
+}
+
+impl<K: Eq + Hash, T: AnalyticsValue> Cache<K, T> {
+    async fn get<F, Fut>(
+        &self,
+        key: K,
+        store: &dyn ObservabilityStore,
+        ttl: Duration,
+        load: F,
+    ) -> AdminStoreResult<T>
+    where
+        F: FnOnce() -> Fut,
+        Fut: Future<Output = AdminStoreResult<T>>,
+    {
+        // 刷新失败后的同键等待也计入预算，避免串行重试把延迟放大为队列长度倍数
+        tokio::time::timeout(
+            store.query_timeout(),
+            self.get_within_budget(key, store, ttl, load),
+        )
+        .await
+        .map_err(|source| {
+            AdminStoreError::new(
+                AdminStoreErrorKind::Unavailable,
+                "observability cache",
+                "observability cache execution budget is exhausted",
+            )
+            .with_source(source)
+        })?
+    }
+
+    async fn get_within_budget<F, Fut>(
+        &self,
+        key: K,
+        store: &dyn ObservabilityStore,
+        ttl: Duration,
+        load: F,
+    ) -> AdminStoreResult<T>
+    where
+        F: FnOnce() -> Fut,
+        Fut: Future<Output = AdminStoreResult<T>>,
+    {
+        let slot = {
+            let mut entries = self.entries.lock().await;
+            if !entries.contains_key(&key) && entries.len() >= CAPACITY {
+                let oldest = entries
+                    .iter()
+                    .filter(|(_, entry)| Arc::strong_count(&entry.slot) == 1)
+                    .min_by_key(|(_, entry)| entry.touched)
+                    .map(|(_, entry)| entry.touched);
+                if let Some(oldest) = oldest {
+                    entries.retain(|_, entry| entry.touched != oldest);
+                }
+            }
+            if !entries.contains_key(&key) && entries.len() >= CAPACITY {
+                drop(entries);
+                return load().await;
+            }
+            let entry = entries.entry(key).or_insert_with(|| Entry {
+                slot: Arc::new(Mutex::new(None)),
+                touched: Instant::now(),
+            });
+            entry.touched = Instant::now();
+            entry.slot.clone()
+        };
+        // 同键刷新只执行一次；失败不会缓存成成功，也不延长旧结果寿命
+        let mut cached = slot.lock().await;
+        // 等锁期间代次可能推进；取得同键锁后再核对，失败时也不能回用已被新统计替代的快照
+        let generation = store.analytics_cache_generation().await?;
+        if let Some(entry) = cached.as_mut()
+            && entry.value.metadata().generation == generation
+            && entry.created.elapsed() < ttl
+        {
+            return Ok(with_age(entry.value.clone(), false));
+        }
+        match load().await {
+            Ok(value) => {
+                *cached = Some(Cached {
+                    value: value.clone(),
+                    created: Instant::now(),
+                });
+                Ok(value)
+            }
+            Err(error) => {
+                if ttl == TTL
+                    && error.kind() == AdminStoreErrorKind::Unavailable
+                    && let Some(entry) = cached.as_mut()
+                    && entry.created.elapsed() <= MAX_STALE
+                    && Utc::now()
+                        .signed_duration_since(entry.value.metadata().generated_at)
+                        .to_std()
+                        .unwrap_or_default()
+                        <= MAX_STALE
+                    && entry.value.metadata().state != AnalyticsState::Building
+                    && entry.value.metadata().generation
+                        == store.analytics_cache_generation().await?
+                {
+                    return Ok(with_age(entry.value.clone(), true));
+                }
+                Err(error)
+            }
+        }
+    }
+}
+
+fn with_age<T: AnalyticsValue>(mut value: T, stale: bool) -> T {
+    let metadata = value.metadata();
+    metadata.lag_seconds = metadata.lag_seconds.saturating_add(
+        Utc::now()
+            .signed_duration_since(metadata.generated_at)
+            .num_seconds()
+            .max(0) as u64,
+    );
+    if stale {
+        metadata.state = AnalyticsState::Stale;
+    }
+    value
+}
+
+type UsageKey = (TimeRange, UsageFilter);
+pub(crate) struct CachedObservabilityStore {
+    inner: Arc<dyn ObservabilityStore>,
+    dashboard: Cache<DashboardQuery, DashboardObservation>,
+    summaries: Cache<UsageKey, UsageOverview>,
+    insights: Cache<(UsageKey, Granularity), UsageInsightsObservation>,
+    diagnostics: Cache<(UsageKey, DiagnosticDimension, u16), DiagnosticsObservation>,
+}
+impl CachedObservabilityStore {
+    pub(crate) fn new(inner: Arc<dyn ObservabilityStore>) -> Self {
+        Self {
+            inner,
+            dashboard: Cache::default(),
+            summaries: Cache::default(),
+            insights: Cache::default(),
+            diagnostics: Cache::default(),
+        }
+    }
+}
+
+#[async_trait]
+impl ObservabilityStore for CachedObservabilityStore {
+    fn query_timeout(&self) -> Duration {
+        self.inner.query_timeout()
+    }
+
+    async fn analytics_cache_generation(&self) -> AdminStoreResult<u64> {
+        self.inner.analytics_cache_generation().await
+    }
+    async fn dashboard_summary(
+        &self,
+        query: DashboardQuery,
+        observed_at: DateTime<Utc>,
+    ) -> AdminStoreResult<DashboardObservation> {
+        // 复合概览还包含账号容量和最近请求，保持原有两秒实时刷新上限
+        self.dashboard
+            .get(
+                query.clone(),
+                self.inner.as_ref(),
+                Duration::from_secs(2),
+                || self.inner.dashboard_summary(query, observed_at),
+            )
+            .await
+    }
+    async fn dashboard_trend(
+        &self,
+        range: TimeRange,
+        granularity: Granularity,
+    ) -> AdminStoreResult<Vec<RequestMetricPoint>> {
+        self.inner.dashboard_trend(range, granularity).await
+    }
+    async fn usage_trend(
+        &self,
+        range: TimeRange,
+        filter: UsageFilter,
+        granularity: Granularity,
+    ) -> AdminStoreResult<Vec<RequestMetricPoint>> {
+        self.inner.usage_trend(range, filter, granularity).await
+    }
+    async fn usage_insights_observation(
+        &self,
+        range: TimeRange,
+        filter: UsageFilter,
+        granularity: Granularity,
+    ) -> AdminStoreResult<UsageInsightsObservation> {
+        self.insights
+            .get(
+                ((range, filter.clone()), granularity),
+                self.inner.as_ref(),
+                TTL,
+                || {
+                    self.inner
+                        .usage_insights_observation(range, filter, granularity)
+                },
+            )
+            .await
+    }
+    async fn usage_summary(
+        &self,
+        range: TimeRange,
+        filter: UsageFilter,
+    ) -> AdminStoreResult<UsageOverview> {
+        self.summaries
+            .get((range, filter.clone()), self.inner.as_ref(), TTL, || {
+                self.inner.usage_summary(range, filter)
+            })
+            .await
+    }
+    async fn usage_diagnostics(
+        &self,
+        range: TimeRange,
+        filter: UsageFilter,
+        dimension: DiagnosticDimension,
+        limit: u16,
+    ) -> AdminStoreResult<DiagnosticsObservation> {
+        self.diagnostics
+            .get(
+                ((range, filter.clone()), dimension, limit),
+                self.inner.as_ref(),
+                TTL,
+                || {
+                    self.inner
+                        .usage_diagnostics(range, filter, dimension, limit)
+                },
+            )
+            .await
+    }
+    async fn list_usage_records(&self, query: UsageQuery) -> AdminStoreResult<UsagePage> {
+        self.inner.list_usage_records(query).await
+    }
+    async fn usage_record_detail(&self, request_id: &str) -> AdminStoreResult<UsageDetail> {
+        self.inner.usage_record_detail(request_id).await
+    }
+    async fn list_ops_errors(&self, query: OpsErrorQuery) -> AdminStoreResult<OpsErrorPage> {
+        self.inner.list_ops_errors(query).await
+    }
+
+    async fn diagnostic_errors(
+        &self,
+        target: &crate::model::diagnostics::DiagnosticTarget,
+        limit: u16,
+    ) -> AdminStoreResult<Vec<crate::model::observability::OpsError>> {
+        self.inner.diagnostic_errors(target, limit).await
+    }
+}
@@ -52,6 +52,7 @@ impl PluginResourceAccess for DefaultPluginResourceAccess {
                    owner,
                    resource_key,
                    NewAccountGroup {
+                        allow_image_generation: command.allow_image_generation,
                        id,
                        name: command.name,
                        description: command.description,
@@ -305,6 +305,9 @@ impl PluginsService {
            .get(id)
            .await
            .map_err(|error| map_store_error(error, "proxy"))?;
+        if !record.enabled {
+            return Err(AdminError::invalid("下载代理已禁用，请启用或改为直连"));
+        }
        Ok(Some(PluginDistributionEgress::new(
            record.id,
            record.revision,
@@ -22,6 +22,13 @@ use super::{map_store_error, publish_committed};
 /// API 消费的 Runtime settings 管理服务
 #[async_trait]
 pub trait SettingsService: Send + Sync {
+    async fn preview_privacy_policy(
+        &self,
+        _request: gateway_core::settings::privacy::PrivacyPreviewRequest,
+    ) -> Result<gateway_core::settings::privacy::PrivacyPreviewResult, AdminError> {
+        Err(AdminError::invalid("隐私预览不可用"))
+    }
+
    async fn preview_pricing_sync(
        &self,
    ) -> Result<crate::model::pricing::PricingSyncPreview, AdminError>;
@@ -117,6 +124,21 @@ fn validate_settings(command: &ReplaceRuntimeSettings) -> Result<(), AdminError>

 #[async_trait]
 impl SettingsService for DefaultSettingsService {
+    async fn preview_privacy_policy(
+        &self,
+        request: gateway_core::settings::privacy::PrivacyPreviewRequest,
+    ) -> Result<gateway_core::settings::privacy::PrivacyPreviewResult, AdminError> {
+        self.profile_provider("openai")?
+            .preview_privacy_policy(request)
+            .map_err(|error| {
+                AdminError::invalid(format!(
+                    "第 {} 条规则：{}",
+                    error.rule_index + 1,
+                    error.reason
+                ))
+            })
+    }
+
    async fn preview_pricing_sync(
        &self,
    ) -> Result<crate::model::pricing::PricingSyncPreview, AdminError> {
@@ -238,10 +260,12 @@ impl SettingsService for DefaultSettingsService {
            PricingChange::Replace(pricing) => {
                pricing.validate().map_err(AdminError::invalid)?;
                if command.provider == "xai"
-                    && pricing
-                        .bands
-                        .keys()
-                        .any(|band| matches!(band.as_str(), "image" | "flex" | "long_flex"))
+                    && pricing.bands.keys().any(|band| {
+                        matches!(
+                            band.as_str(),
+                            "image" | "flex" | "long_flex" | "ultrafast" | "long_ultrafast"
+                        )
+                    })
                {
                    return Err(AdminError::invalid("xAI 不支持此价格档位"));
                }
@@ -342,6 +366,17 @@ impl SettingsService for DefaultSettingsService {
        mut command: ReplaceRuntimeSettings,
    ) -> Result<RuntimeSettings, AdminError> {
        validate_settings(&command)?;
+        if command.values.codex_privacy_policy != Default::default() {
+            self.profile_provider("openai")?
+                .compile_privacy_policy(&command.values.codex_privacy_policy)
+                .map_err(|error| {
+                    AdminError::invalid(format!(
+                        "第 {} 条规则：{}",
+                        error.rule_index + 1,
+                        error.reason
+                    ))
+                })?;
+        }
        if command
            .request_profile_updates
            .values()
@@ -0,0 +1,184 @@
+//! 公开原生用量读写与纯计价，插件拥有跨调用流程和恢复策略
+
+mod pricing;
+mod validation;
+
+use crate::{
+    model::{
+        auth::{AdminAuditEvent, AuditActorKind},
+        usage_data::*,
+    },
+    ports::{provider::ProviderAdminRegistry, store::SettingsStore, usage_data::*},
+};
+use async_trait::async_trait;
+use std::sync::Arc;
+
+#[async_trait]
+pub trait UsageDataService: Send + Sync {
+    async fn list_aggregates(
+        &self,
+        request: ListUsageAggregates,
+    ) -> UsageDataResult<UsageAggregatePage>;
+    async fn write_aggregates(
+        &self,
+        actor: &UsageActor,
+        request: WriteUsageAggregates,
+    ) -> UsageDataResult<UsageAggregateWriteResult>;
+    async fn get_record(&self, request: GetUsageRecord) -> UsageDataResult<UsageRecord>;
+    async fn list_records(&self, request: ListUsageRecords) -> UsageDataResult<UsageRecordPage>;
+    async fn write_records(
+        &self,
+        actor: &UsageActor,
+        request: WriteUsageRecords,
+    ) -> UsageDataResult<UsageWriteResult>;
+    async fn evaluate_pricing(
+        &self,
+        request: EvaluateUsagePricing,
+    ) -> UsageDataResult<UsagePricingEvaluation>;
+}
+
+pub struct DefaultUsageDataService {
+    store: Arc<dyn UsageDataStore>,
+    settings: Arc<dyn SettingsStore>,
+    providers: ProviderAdminRegistry,
+}
+impl DefaultUsageDataService {
+    pub fn new(
+        store: Arc<dyn UsageDataStore>,
+        settings: Arc<dyn SettingsStore>,
+        providers: ProviderAdminRegistry,
+    ) -> Self {
+        Self {
+            store,
+            settings,
+            providers,
+        }
+    }
+}
+
+#[async_trait]
+impl UsageDataService for DefaultUsageDataService {
+    async fn list_aggregates(
+        &self,
+        request: ListUsageAggregates,
+    ) -> UsageDataResult<UsageAggregatePage> {
+        validation::query(&request.filter, request.cursor.as_deref(), request.limit)?;
+        self.store.list_aggregates(request).await
+    }
+    async fn write_aggregates(
+        &self,
+        actor: &UsageActor,
+        request: WriteUsageAggregates,
+    ) -> UsageDataResult<UsageAggregateWriteResult> {
+        validation::bounded(&request, request.changes.len())?;
+        let mut changes = Vec::with_capacity(request.changes.len());
+        for change in request.changes {
+            validation::aggregate(&change)?;
+            let identity = match &change {
+                UsageAggregateChange::Put { aggregate } => &aggregate.identity,
+                UsageAggregateChange::Delete { identity } => identity,
+            };
+            let action = match &change {
+                UsageAggregateChange::Put { .. } => "usage.aggregate.put",
+                UsageAggregateChange::Delete { .. } => "usage.aggregate.delete",
+            };
+            let audit = audit_event(
+                actor,
+                action,
+                "usage_aggregate",
+                &identity.key,
+                vec!["aggregate".into()],
+            );
+            changes.push((change, audit));
+        }
+        self.store
+            .write_aggregates(StoredAggregateWrite { changes })
+            .await
+    }
+    async fn get_record(&self, request: GetUsageRecord) -> UsageDataResult<UsageRecord> {
+        validation::text(&request.id, 128)?;
+        self.store.get_record(request).await
+    }
+    async fn list_records(&self, request: ListUsageRecords) -> UsageDataResult<UsageRecordPage> {
+        validation::query(&request.filter, request.cursor.as_deref(), request.limit)?;
+        self.store.list_records(request).await
+    }
+    async fn write_records(
+        &self,
+        actor: &UsageActor,
+        request: WriteUsageRecords,
+    ) -> UsageDataResult<UsageWriteResult> {
+        validation::bounded(&request, request.changes.len())?;
+        let mut changes = Vec::with_capacity(request.changes.len());
+        for change in request.changes {
+            validation::change(&change)?;
+            let action = match &change {
+                UsageRecordChange::Put { .. } => "usage.put",
+                UsageRecordChange::Update { .. } => "usage.update",
+                UsageRecordChange::Delete { .. } => "usage.delete",
+            };
+            let fields = match &change {
+                UsageRecordChange::Update { tokens, cost, .. } => tokens
+                    .as_ref()
+                    .map(|_| "tokens".to_owned())
+                    .into_iter()
+                    .chain(cost.as_ref().map(|_| "cost".to_owned()))
+                    .collect(),
+                _ => vec!["record".into()],
+            };
+            let audit = audit_event(actor, action, "model_request", change.id(), fields);
+            changes.push((change, audit));
+        }
+        self.store.write_records(StoredUsageWrite { changes }).await
+    }
+    async fn evaluate_pricing(
+        &self,
+        request: EvaluateUsagePricing,
+    ) -> UsageDataResult<UsagePricingEvaluation> {
+        validation::bounded(&request, request.items.len())?;
+        let stored = self
+            .settings
+            .load_pricing()
+            .await
+            .map_err(|_| UsageDataError::unavailable("读取价目失败"))?;
+        let prices = gateway_core::metering::merge_pricing(stored.synced, &stored.overrides);
+        let mut items = Vec::with_capacity(request.items.len());
+        for input in request.items {
+            validation::text(&input.id, 128)?;
+            items.push(self.evaluate_one(input, &prices)?);
+        }
+        Ok(UsagePricingEvaluation { items })
+    }
+}
+
+fn audit_event(
+    actor: &UsageActor,
+    action: &str,
+    entity_kind: &str,
+    id: &str,
+    changed_fields: Vec<String>,
+) -> AdminAuditEvent {
+    let actor_ref = match actor {
+        UsageActor::Plugin {
+            instance_id,
+            publisher,
+            name,
+            ..
+        } => format!("plugin:{publisher}/{name}:{instance_id}"),
+        UsageActor::Admin { subject } => format!("admin:{subject}"),
+        UsageActor::System => "system".into(),
+    };
+    AdminAuditEvent {
+        id: format!("audit_{}", uuid::Uuid::now_v7().simple()),
+        actor_kind: AuditActorKind::System,
+        actor_admin_user_id: None,
+        actor_ref,
+        request_id: None,
+        action: action.into(),
+        entity_kind: entity_kind.into(),
+        entity_ref: id.to_owned(),
+        config_revision: None,
+        changed_fields,
+        occurred_at: chrono::Utc::now(),
+    }
+}
@@ -0,0 +1,87 @@
+//! 复用 Provider 的单请求 Token 计价规则，不写入历史或账本
+
+use super::{DefaultUsageDataService, validation};
+use crate::{
+    model::usage_data::*,
+    ports::provider::{ProviderAdminErrorKind, ProviderUsagePricingInput},
+};
+use gateway_core::{
+    metering::{PricingOverrides, Usage},
+    routing::ProviderKind,
+};
+
+impl DefaultUsageDataService {
+    pub(super) fn evaluate_one(
+        &self,
+        input: UsagePricingInput,
+        prices: &PricingOverrides,
+    ) -> UsageDataResult<UsagePricingResult> {
+        validation::text(&input.provider, 128)?;
+        validation::text(&input.model, 128)?;
+        validation::tokens(&input.tokens)?;
+        let unavailable = |reason: &str| UsagePricingResult::NotEstimable {
+            id: input.id.clone(),
+            reason: reason.into(),
+        };
+        let kind = ProviderKind::new(input.provider.clone())
+            .map_err(|_| UsageDataError::invalid("Provider 无效"))?;
+        let Ok(provider) = self.providers.require(&kind) else {
+            return Ok(unavailable("Provider 没有可用的计价规则"));
+        };
+        let tokens = &input.tokens;
+        let price = match &input.price {
+            UsagePriceSelection::Current => prices
+                .get(&input.provider)
+                .and_then(|models| models.get(&input.model)),
+            UsagePriceSelection::Override { price } => {
+                price.validate().map_err(UsageDataError::invalid)?;
+                Some(price.as_ref())
+            }
+        };
+        let request = ProviderUsagePricingInput {
+            upstream_model_id: input.model.clone(),
+            service_tier: input.service_tier.clone(),
+            usage: Usage {
+                input_tokens: tokens.input_tokens.map(UsageCount::get),
+                output_tokens: tokens.output_tokens.map(UsageCount::get),
+                cached_input_tokens: tokens.cached_input_tokens.map(UsageCount::get),
+                cache_write_input_tokens: tokens.cache_write_input_tokens.map(UsageCount::get),
+                reasoning_output_tokens: tokens.reasoning_output_tokens.map(UsageCount::get),
+                image_input_tokens: tokens.image_input_tokens.map(UsageCount::get),
+                image_output_tokens: tokens.image_output_tokens.map(UsageCount::get),
+                total_tokens: tokens.total_tokens.map(UsageCount::get),
+            },
+        };
+        let calculated = match provider.evaluate_usage_pricing(&request, price) {
+            Ok(Some(value)) => value,
+            Ok(None) => return Ok(unavailable("用量不完整、包含图像或价格不可用")),
+            Err(error)
+                if matches!(
+                    error.kind(),
+                    ProviderAdminErrorKind::Unsupported | ProviderAdminErrorKind::Invalid
+                ) =>
+            {
+                return Ok(unavailable("Provider 不支持该计价输入"));
+            }
+            Err(_) => return Err(UsageDataError::unavailable("Provider 计价失败")),
+        };
+        Ok(UsagePricingResult::Estimated {
+            id: input.id,
+            cost: UsageCost::Known {
+                source: UsageCostSource::Calculated,
+                amount: calculated.total_amount().amount().canonical(),
+                currency: calculated.total_amount().currency().as_str().into(),
+            },
+            breakdown: UsagePricingBreakdown {
+                input_amount: calculated.input_amount().amount().canonical(),
+                output_amount: calculated.output_amount().amount().canonical(),
+                cache_read_amount: calculated.cache_read_amount().amount().canonical(),
+                cache_write_amount: calculated.cache_write_amount().amount().canonical(),
+                standard_amount: calculated.standard_amount().amount().canonical(),
+                long_context_billing_applied: calculated.long_context_billing_applied(),
+                service_tier: calculated.service_tier().map(str::to_owned),
+                custom_multiplier_bps: calculated.custom_multiplier_bps(),
+            },
+        })
+    }
+}
@@ -0,0 +1,194 @@
+//! 用量输入沿用原生记录的数值、时间和资源边界
+
+use crate::model::usage_data::*;
+use gateway_core::metering::Decimal;
+use serde::Serialize;
+
+pub(super) fn text(value: &str, max: usize) -> UsageDataResult<()> {
+    if value.trim().is_empty() || value.len() > max || value.chars().any(char::is_control) {
+        return Err(UsageDataError::invalid("文本为空、过长或包含控制字符"));
+    }
+    Ok(())
+}
+pub(super) fn bounded(value: &impl Serialize, count: usize) -> UsageDataResult<()> {
+    if count == 0
+        || count > USAGE_DATA_MAX_TARGETS
+        || serde_json::to_vec(value)
+            .map_err(|_| UsageDataError::invalid("请求编码失败"))?
+            .len()
+            > USAGE_DATA_MAX_REQUEST_BYTES
+    {
+        return Err(UsageDataError::new(
+            UsageErrorKind::CapacityExceeded,
+            "每次操作接受 1～500 项且不超过 2 MiB",
+        ));
+    }
+    Ok(())
+}
+pub(super) fn tokens(value: &UsageTokens) -> UsageDataResult<()> {
+    if [
+        value.input_tokens,
+        value.output_tokens,
+        value.cached_input_tokens,
+        value.cache_write_input_tokens,
+        value.reasoning_output_tokens,
+        value.image_input_tokens,
+        value.image_output_tokens,
+        value.total_tokens,
+    ]
+    .into_iter()
+    .flatten()
+    .any(|v| v.get() > i64::MAX as u64)
+    {
+        return Err(UsageDataError::invalid("Token 超出原生存储范围"));
+    }
+    Ok(())
+}
+fn cost(value: &UsageCost) -> UsageDataResult<()> {
+    if let UsageCost::Known {
+        amount, currency, ..
+    } = value
+    {
+        let _ = amount
+            .parse::<Decimal>()
+            .map_err(|_| UsageDataError::invalid("费用不是有效十进制数"))?;
+        if currency.len() != 3 || !currency.bytes().all(|b| b.is_ascii_uppercase()) {
+            return Err(UsageDataError::invalid("费用或币种不符合原生存储范围"));
+        }
+    }
+    Ok(())
+}
+pub(super) fn change(value: &UsageRecordChange) -> UsageDataResult<()> {
+    text(value.id(), 128)?;
+    match value {
+        UsageRecordChange::Put { data, .. } => {
+            text(&data.client_key_ref, 128)?;
+            for v in [
+                &data.provider,
+                &data.account_ref,
+                &data.requested_model,
+                &data.model,
+                &data.service_tier,
+            ]
+            .into_iter()
+            .flatten()
+            {
+                text(v, 128)?;
+            }
+            for v in [
+                &data.protocol,
+                &data.operation,
+                &data.endpoint,
+                &data.client_transport,
+            ] {
+                text(v, 256)?;
+            }
+            if data.outcome == UsageOutcome::Running
+                || data
+                    .completed_at_ms
+                    .is_none_or(|end| end < data.started_at_ms)
+            {
+                return Err(UsageDataError::invalid("只允许写入已结束的请求明细"));
+            }
+            for at in [Some(data.started_at_ms), data.completed_at_ms]
+                .into_iter()
+                .flatten()
+            {
+                if chrono::DateTime::from_timestamp_millis(at).is_none() {
+                    return Err(UsageDataError::invalid("请求时间无效"));
+                }
+            }
+            tokens(&data.tokens)?;
+            cost(&data.cost)?;
+        }
+        UsageRecordChange::Update {
+            tokens: new_tokens,
+            cost: new_cost,
+            ..
+        } => {
+            if new_tokens.is_none() && new_cost.is_none() {
+                return Err(UsageDataError::invalid("修改必须指定 Token 或费用"));
+            }
+            if let Some(value) = new_tokens {
+                tokens(value)?;
+            }
+            if let Some(value) = new_cost {
+                cost(value)?;
+            }
+        }
+        UsageRecordChange::Delete { .. } => {}
+    }
+    Ok(())
+}
+pub(super) fn query(
+    filter: &UsageRecordFilter,
+    cursor: Option<&str>,
+    limit: Option<u16>,
+) -> UsageDataResult<()> {
+    if limit.is_some_and(|v| v == 0 || v > USAGE_DATA_MAX_PAGE_SIZE)
+        || filter.start_ms >= filter.end_ms
+        || chrono::DateTime::from_timestamp_millis(filter.start_ms).is_none()
+        || chrono::DateTime::from_timestamp_millis(filter.end_ms).is_none()
+    {
+        return Err(UsageDataError::invalid("查询时间范围或分页大小无效"));
+    }
+    for v in [
+        &filter.provider,
+        &filter.model,
+        &filter.account_ref,
+        &filter.client_key_ref,
+    ]
+    .into_iter()
+    .flatten()
+    {
+        text(v, 128)?;
+    }
+    if cursor.is_some_and(|v| v.len() > 4096) {
+        return Err(UsageDataError::invalid("游标过长"));
+    }
+    Ok(())
+}
+
+pub(super) fn aggregate(value: &UsageAggregateChange) -> UsageDataResult<()> {
+    let identity = match value {
+        UsageAggregateChange::Put { aggregate } => &aggregate.identity,
+        UsageAggregateChange::Delete { identity } => identity,
+    };
+    text(&identity.key, 128)?;
+    if chrono::DateTime::from_timestamp_millis(identity.bucket_start_ms).is_none() {
+        return Err(UsageDataError::invalid("聚合归属时间无效"));
+    }
+    let d = &identity.dimensions;
+    for value in [
+        &d.provider,
+        &d.model,
+        &d.account_ref,
+        &d.client_key_ref,
+        &d.operation,
+        &d.transport,
+    ]
+    .into_iter()
+    .flatten()
+    {
+        text(value, 128)?;
+    }
+    if let UsageAggregateChange::Put { aggregate } = value {
+        if aggregate.costs.len() > 32 {
+            return Err(UsageDataError::invalid("费用币种数量超过限制"));
+        }
+        for (currency, amount) in &aggregate.costs {
+            if currency.len() != 3
+                || !currency.bytes().all(|b| b.is_ascii_uppercase())
+                || amount.len() > 128
+            {
+                return Err(UsageDataError::invalid("聚合费用格式无效"));
+            }
+            amount
+                .strip_prefix('-')
+                .unwrap_or(amount)
+                .parse::<Decimal>()
+                .map_err(|_| UsageDataError::invalid("聚合费用不是有效十进制数"))?;
+        }
+    }
+    Ok(())
+}
@@ -536,6 +536,9 @@ impl DatabaseDumpPort for FakeDumpPort {
 pub(crate) struct FakeObjectStore {
    pub(crate) objects: Mutex<std::collections::HashMap<String, Vec<u8>>>,
    upload_error: Option<BackupError>,
+    head_error: Option<BackupError>,
+    delete_error: Option<BackupError>,
+    connection_error: Option<BackupError>,
 }

 impl FakeObjectStore {
@@ -543,6 +546,9 @@ impl FakeObjectStore {
        Self {
            objects: Mutex::new(std::collections::HashMap::new()),
            upload_error: None,
+            head_error: None,
+            delete_error: None,
+            connection_error: None,
        }
    }

@@ -552,6 +558,21 @@ impl FakeObjectStore {
        self
    }

+    pub(crate) fn fail_head(mut self, code: &'static str) -> Self {
+        self.head_error = Some(BackupError::new(code, "HEAD failed".into()));
+        self
+    }
+
+    pub(crate) fn fail_delete(mut self, code: &'static str) -> Self {
+        self.delete_error = Some(BackupError::new(code, "DELETE failed".into()));
+        self
+    }
+
+    pub(crate) fn fail_connection(mut self, code: &'static str) -> Self {
+        self.connection_error = Some(BackupError::new(code, "DELETE failed".into()));
+        self
+    }
+
    pub(crate) fn object(&self, key: &str) -> Option<Vec<u8>> {
        self.objects.lock().expect("objects").get(key).cloned()
    }
@@ -563,6 +584,14 @@ impl BackupObjectStorePort for FakeObjectStore {
        &self,
        _config: &BackupStorageConfig,
    ) -> Result<ConnectionTestResult, gateway_admin::model::backup::BackupError> {
+        if let Some(error) = &self.connection_error {
+            return Ok(ConnectionTestResult {
+                ok: false,
+                stage: "deleteObject",
+                code: Some(error.code()),
+                message: error.message().into(),
+            });
+        }
        Ok(ConnectionTestResult {
            ok: true,
            stage: "deleteObject",
@@ -597,6 +626,9 @@ impl BackupObjectStorePort for FakeObjectStore {
        _config: &BackupStorageConfig,
        object_key: &str,
    ) -> Result<Option<BackupObjectMetadata>, gateway_admin::model::backup::BackupError> {
+        if let Some(error) = &self.head_error {
+            return Err(error.clone());
+        }
        let Some(content) = self.object(object_key) else {
            return Ok(None);
        };
@@ -613,6 +645,9 @@ impl BackupObjectStorePort for FakeObjectStore {
        _config: &BackupStorageConfig,
        object_key: &str,
    ) -> Result<(), gateway_admin::model::backup::BackupError> {
+        if let Some(error) = &self.delete_error {
+            return Err(error.clone());
+        }
        self.objects.lock().expect("objects").remove(object_key);
        Ok(())
    }
@@ -690,11 +725,11 @@ impl AuthStore for FakeAuthStore {
    ) -> AdminStoreResult<()> {
        Ok(())
    }
-    async fn renew_session(
+    async fn compare_exchange_session(
        &self,
        _: &str,
        _: &gateway_admin::model::auth::AuthSession,
-        _: chrono::DateTime<chrono::Utc>,
+        _: Option<&gateway_admin::model::auth::AuthSession>,
    ) -> AdminStoreResult<Option<gateway_admin::model::auth::AuthSession>> {
        Ok(None)
    }
@@ -324,3 +324,58 @@ async fn completed_recovery_removes_staging_for_dumping_and_uploading_tasks() {
        );
    }
 }
+
+#[tokio::test]
+async fn manual_backup_preserves_primary_and_final_delete_failures() {
+    for (upload_fails, expiring) in [(false, false), (true, false), (false, true)] {
+        let repository = Arc::new(FakeBackupRepository::new(configured_settings()));
+        let dump = Arc::new(FakeDumpPort::new());
+        let store = FakeObjectStore::new().fail_delete(code::S3_PERMISSION_DENIED);
+        let store = Arc::new(if upload_fails {
+            store.fail_upload(code::S3_UPLOAD_FAILED, "上传失败")
+        } else {
+            store.fail_head(code::REMOTE_VERIFICATION_FAILED)
+        });
+        let seed = BackupRecordSeed {
+            id: backup_id("cleanup-failure"),
+            trigger_kind: BackupTriggerKind::Manual,
+            scheduled_at: None,
+            object_key: "codex/cleanup-failure.dump".into(),
+            expires_at: expiring.then(|| Utc::now() + Duration::hours(1)),
+        };
+        repository.insert_backup_record(seed.clone()).await.unwrap();
+        let task = BackupTask::new(repository.clone(), dump.clone(), store.clone());
+        task.run_cycle(&CancellationToken::new()).await.unwrap();
+        let records = repository.all_records();
+        let record = &records[0];
+        assert_eq!(record.status, BackupStatus::Failed);
+        assert_eq!(
+            record.error_code.as_deref(),
+            Some(if upload_fails {
+                code::S3_UPLOAD_FAILED
+            } else {
+                code::REMOTE_VERIFICATION_FAILED
+            })
+        );
+        let message = record.error_message.as_deref().unwrap();
+        assert!(message.contains(if upload_fails {
+            "上传失败"
+        } else {
+            "HEAD failed"
+        }));
+        assert!(message.contains("DeleteObject"));
+        assert!(message.contains(code::S3_PERMISSION_DENIED));
+        assert!(message.contains(if expiring {
+            "等待备份到期清理"
+        } else {
+            "未安排自动重试"
+        }));
+        assert_eq!(store.object(&seed.object_key).is_some(), !upload_fails);
+        assert!(dump.inspect_staging(&seed.id).await.unwrap().is_none());
+        task.run_cycle(&CancellationToken::new()).await.unwrap();
+        assert_eq!(
+            repository.all_records()[0].error_message,
+            record.error_message
+        );
+    }
+}
@@ -170,9 +170,9 @@ fn usage_window_should_not_use_daily_rolling_usage_for_weekly_statistics() {
        success_count: 5,
        input_tokens: Some(100),
        output_tokens: Some(20),
-        cached_tokens: Some(80),
-        cache_write_tokens: Some(0),
-        reasoning_tokens: Some(0),
+        cached_input_tokens: Some(80),
+        cache_write_input_tokens: Some(0),
+        reasoning_output_tokens: Some(0),
        image_input_tokens: Some(0),
        image_output_tokens: Some(0),
        image_request_count: 0,
@@ -115,9 +115,9 @@ fn usage_window(key: &str, group: &str, seconds: u64) -> ProviderQuotaWindow {
            success_count: 0,
            input_tokens: None,
            output_tokens: None,
-            cached_tokens: None,
-            cache_write_tokens: None,
-            reasoning_tokens: None,
+            cached_input_tokens: None,
+            cache_write_input_tokens: None,
+            reasoning_output_tokens: None,
            image_input_tokens: None,
            image_output_tokens: None,
            image_request_count: 0,
@@ -32,9 +32,9 @@ fn window(key: &str, days: u64) -> ProviderQuotaWindow {
            success_count: 10,
            input_tokens: Some(900),
            output_tokens: Some(100),
-            cached_tokens: Some(800),
-            cache_write_tokens: None,
-            reasoning_tokens: None,
+            cached_input_tokens: Some(800),
+            cache_write_input_tokens: None,
+            reasoning_output_tokens: None,
            image_input_tokens: None,
            image_output_tokens: None,
            image_request_count: 0,
@@ -84,7 +84,7 @@ fn samples(quota: &ProviderQuota) -> Vec<QuotaForecastSample> {
                tokens: usage.total_tokens.unwrap_or(0),
                input_tokens: usage.input_tokens.unwrap_or(0),
                output_tokens: usage.output_tokens.unwrap_or(0),
-                cached_tokens: usage.cached_tokens.unwrap_or(0),
+                cached_input_tokens: usage.cached_input_tokens.unwrap_or(0),
                missing_token_count: u64::from(usage.total_tokens.is_none()),
                known_cost_count: if usd.is_some() {
                    usage.cost_coverage.known_count()
@@ -73,14 +73,14 @@ fn snapshot_at_a_block_boundary_keeps_only_three_recent_blocks() {
 }

 #[test]
-fn large_percentage_reversal_restarts_sampling_without_crossing_old_consumption() {
+fn large_percentage_reversal_restarts_only_sampling_without_crossing_old_consumption() {
    let sample = select(
        vec![point(1, 40.0, 100), point(2, 50.0, 200), point(3, 1.0, 210)],
        point(4, 8.0, 280),
    );
    assert_eq!(sample.baseline_percent, 1.0);
    assert_eq!(sample.usage.tokens, 70);
-    assert_eq!(sample.cycle_usage.tokens, 70);
+    assert_eq!(sample.cycle_usage.tokens, 280);
    assert_eq!(sample.sampled_percent, 7.0);
    assert!(!sample.discontinuous);
    let waiting = select(
@@ -90,6 +90,30 @@ fn large_percentage_reversal_restarts_sampling_without_crossing_old_consumption(
    assert!(waiting.discontinuous);
 }

+#[test]
+fn same_window_reversal_preserves_all_recorded_cycle_usage() {
+    let current = point(3, 35.0, 140);
+    let recorded = current.usage.clone();
+    let sample = select(vec![point(1, 32.0, 100), point(2, 30.0, 120)], current);
+    assert_eq!(sample.cycle_usage, recorded);
+    assert_eq!(sample.usage.tokens, 20);
+    assert!((sample.usage.usd - 0.02).abs() < 1e-10);
+    assert!(!sample.discontinuous);
+}
+
+#[test]
+fn small_reversals_after_full_usage_preserve_cycle_totals_and_cumulative_forecasts() {
+    let current = point(3, 99.5, 10_020);
+    let recorded = current.usage.clone();
+    let sample = select(
+        vec![point(1, 100.0, 10_000), point(2, 99.0, 10_010)],
+        current,
+    );
+    assert_eq!(sample.cycle_usage, recorded);
+    assert_eq!(sample.method, QuotaForecastMethod::Cumulative);
+    assert!(!sample.discontinuous);
+}
+
 #[test]
 fn one_point_reversal_is_skipped_without_counting_an_extra_block() {
    let sample = select(
@@ -128,17 +152,41 @@ fn counter_regressions_fail_closed_and_future_points_are_not_used() {
 }

 #[test]
-fn exhausted_history_is_retained_to_detect_a_reset_with_an_unchanged_deadline() {
+fn same_window_recovery_restarts_sampling_but_preserves_recorded_cycle_usage() {
    let sample = select(
        vec![point(1, 100.0, 10_000), point(2, 0.0, 10_000)],
        point(3, 10.0, 10_100),
    );
-    assert_eq!(sample.cycle_usage.tokens, 100);
+    assert_eq!(sample.cycle_usage.tokens, 10_100);
+    assert!((sample.cycle_usage.usd - 10.1).abs() < 1e-10);
    assert_eq!(sample.usage.tokens, 100);
    assert_eq!(sample.sampled_percent, 10.0);
    assert!(!sample.discontinuous);
 }

+#[test]
+fn a_single_non_exhausted_observation_does_not_restart_cycle_usage() {
+    let sample = select(vec![point(1, 100.0, 10_000)], point(2, 0.0, 10_000));
+    assert_eq!(sample.cycle_usage.tokens, 10_000);
+    assert!(sample.discontinuous);
+}
+
+#[test]
+fn repeated_same_window_recoveries_preserve_recorded_cycle_usage() {
+    let sample = select(
+        vec![
+            point(1, 100.0, 10_000),
+            point(2, 0.0, 10_000),
+            point(3, 100.0, 10_100),
+            point(4, 0.0, 10_100),
+        ],
+        point(5, 10.0, 10_200),
+    );
+    assert_eq!(sample.cycle_usage.tokens, 10_200);
+    assert_eq!(sample.usage.tokens, 100);
+    assert!(!sample.discontinuous);
+}
+
 #[test]
 fn changed_window_restarts_cycle_totals_at_first_matching_observation() {
    let sample = select_forecast_sample(
@@ -4,7 +4,13 @@ use gateway_admin::model::retention::{RetentionPolicy, RetentionTarget};

 #[test]
 fn retention_policy_rejects_invalid_windows_and_preserves_independent_windows() {
-    for (usage, ops, audit) in [(30, 1, 1), (31, 0, 1), (31, 1, 0)] {
+    for (usage, ops, audit) in [
+        (0, 1, 1),
+        (32, 1, 1),
+        (u32::MAX, 1, 1),
+        (1, 0, 1),
+        (1, 1, 0),
+    ] {
        assert!(RetentionPolicy::try_new(usage, ops, audit).is_err());
    }
    let policy = RetentionPolicy::try_new(31, 7, 90).unwrap();
@@ -12,3 +18,13 @@ fn retention_policy_rejects_invalid_windows_and_preserves_independent_windows()
    assert_eq!(policy.days(RetentionTarget::OpsEvents), 7);
    assert_eq!(policy.days(RetentionTarget::AdminAuditEvents), 90);
 }
+
+#[test]
+fn request_retention_accepts_short_windows_without_changing_other_targets() {
+    for days in [1, 3, 7, 15, 30, 31] {
+        let policy = RetentionPolicy::try_new(days, 30, 90).unwrap();
+        assert_eq!(policy.days(RetentionTarget::ModelRequests), days);
+        assert_eq!(policy.days(RetentionTarget::OpsEvents), 30);
+        assert_eq!(policy.days(RetentionTarget::AdminAuditEvents), 90);
+    }
+}
@@ -317,6 +317,7 @@ impl AccountRuntimeStore for FakeRuntimeStore {
 fn group_record() -> AccountGroupRecord {
    let now = Utc::now();
    AccountGroupRecord {
+        allow_image_generation: true,
        fast_mode: FastMode::Default,
        id: group_id(),
        name: "Primary".to_owned(),
@@ -390,6 +391,7 @@ async fn invalid_group_fields_are_rejected_before_store_mutations() {
        .create(
            &context,
            CreateAccountGroup {
+                allow_image_generation: true,
                fast_mode: FastMode::Default,
                name: " invalid".to_owned(),
                description: None,
@@ -403,6 +405,7 @@ async fn invalid_group_fields_are_rejected_before_store_mutations() {
        .update(
            &context,
            UpdateAccountGroup {
+                allow_image_generation: None,
                fast_mode: None,
                id: record.id,
                name: "valid".to_owned(),
@@ -1115,12 +1115,12 @@ impl SettingsStore for StaticSettingsStore {
            rotation_strategy: RotationStrategy::Smart,
            updated_at: Utc::now(),
            values: gateway_admin::model::settings::RuntimeSettingsValues {
+                codex_privacy_policy: Default::default(),
                request_location_enabled: false,
                request_location: Default::default(),
                refresh_margin_seconds: 300,
                refresh_concurrency: 2,
                max_concurrent_per_account: 1,
-                request_interval_ms: 0,
                max_waiting_per_key: 0,
                max_waiting_per_account: 0,
                concurrency_wait_timeout_seconds: 30,
@@ -2398,6 +2398,93 @@ async fn quota_forecast_only_queries_the_two_selected_source_windows() {
    );
 }

+#[tokio::test]
+async fn quota_forecast_same_window_reversal_keeps_recorded_usage_in_the_report() {
+    use gateway_admin::model::quota_forecast_sampling::QuotaForecastHistoryPoint;
+
+    for (percents, tokens, expected_tokens, expected_usd) in [
+        ([32.0, 30.0, 35.0], [100, 120, 140], 400, 0.4),
+        (
+            [100.0, 99.0, 99.5],
+            [10_000, 10_010, 10_020],
+            10_070,
+            10.02 / 0.995,
+        ),
+    ] {
+        let now = Utc::now();
+        let observed = now - TimeDelta::minutes(1);
+        let reset = now + TimeDelta::days(1);
+        let provider = FakeProviderAdmin::new("openai", events());
+        provider.set_quota(ProviderQuota {
+            plan_type: Some("pro".to_owned()),
+            observed_at: Some(observed),
+            windows: vec![ProviderQuotaWindow {
+                key: "week".to_owned(),
+                group: "shortTerm".to_owned(),
+                label: "周额度".to_owned(),
+                limit_id: None,
+                limit_name: None,
+                role: None,
+                local_usage_attribution: QuotaLocalUsageAttribution::AccountWide,
+                window_seconds: Some(604_800),
+                used_percent: Some(percents[2]),
+                reset_at: Some(reset),
+                limit_reached: false,
+                local_usage: None,
+                provider_data: None,
+            }],
+            ..empty_quota()
+        });
+        let mut account = account_record("openai");
+        account.created_at = now - TimeDelta::days(7);
+        let store = FakeAccountStore::with_account(account, events());
+        let usage = |requests, tokens| QuotaForecastUsage {
+            request_count: requests,
+            tokens,
+            input_tokens: tokens,
+            known_cost_count: requests,
+            usd: tokens as f64 / 1_000.0,
+            ..Default::default()
+        };
+        *store.quota_forecast_history.lock().unwrap() = QuotaForecastHistory {
+            points: [(3, percents[0], tokens[0]), (2, percents[1], tokens[1])]
+                .into_iter()
+                .enumerate()
+                .map(
+                    |(index, (minutes, percent, tokens))| QuotaForecastHistoryPoint {
+                        started_at: now - TimeDelta::minutes(5),
+                        completed_at: now - TimeDelta::minutes(minutes),
+                        usage: usage(index as u64 + 1, tokens),
+                        provider_observation: ProviderDocument::new(OpaqueProviderData::new(
+                            serde_json::json!({
+                                "percent": percent, "reset": reset.to_rfc3339(), "plan": "pro",
+                            })
+                            .as_object()
+                            .unwrap()
+                            .clone(),
+                        )),
+                    },
+                )
+                .collect(),
+            usage: usage(3, tokens[2]),
+            pending_request_count: 0,
+        };
+        let services = accounts_service(provider, store).await;
+        let result = services
+            .accounts()
+            .quota_forecast(&ProviderAccountId::new("acct_test").unwrap())
+            .await
+            .unwrap();
+        let forecast = &result.forecasts[0];
+        let source = forecast.source.as_ref().unwrap();
+        assert_eq!(source.tokens, Some(tokens[2]));
+        assert!((source.usd.unwrap() - tokens[2] as f64 / 1_000.0).abs() < 1e-10);
+        assert_eq!(forecast.estimated_tokens, Some(expected_tokens));
+        assert!((forecast.estimated_usd.unwrap() - expected_usd).abs() < 1e-10);
+        assert!(forecast.unavailable_reason.is_none());
+    }
+}
+
 #[tokio::test]
 async fn quota_forecast_mid_cycle_sampling_accepts_small_reset_jitter_but_not_a_changed_bucket() {
    use gateway_admin::model::quota_forecast_sampling::QuotaForecastHistoryPoint;
@@ -3031,9 +3118,9 @@ fn quota_local_usage(account_id: &str, total_tokens: u64) -> AccountUsage {
        success_count: 1,
        input_tokens: Some(total_tokens),
        output_tokens: Some(0),
-        cached_tokens: Some(0),
-        cache_write_tokens: Some(0),
-        reasoning_tokens: Some(0),
+        cached_input_tokens: Some(0),
+        cache_write_input_tokens: Some(0),
+        reasoning_output_tokens: Some(0),
        image_input_tokens: Some(0),
        image_output_tokens: Some(0),
        image_request_count: 0,
@@ -3050,6 +3137,7 @@ fn quota_local_usage(account_id: &str, total_tokens: u64) -> AccountUsage {
 pub(super) fn account_record(kind: &str) -> AccountRecord {
    let now = Utc::now();
    AccountRecord {
+        outbound_proxy_enabled: true,
        notes: None,
        model_access: Default::default(),
        outbound_proxy: None,
@@ -1,4 +1,4 @@
-//! 验证管理员认证、密码变更、会话绑定与限流行为
+//! 验证管理员认证、密码变更与限流，提供会话轮换的内存存储辅助

 use std::{collections::BTreeMap, sync::Mutex};

@@ -69,6 +69,7 @@ async fn password_change_obeys_rate_limit_and_rejects_unbound_legacy_sessions()
                admin_user_id: "admin".into(),
                credential_fingerprint: String::new(),
            },
+            renewal: None,
            absolute_expires_at: None,
            expires_at: Utc::now() + TimeDelta::hours(1),
        },
@@ -138,19 +139,24 @@ impl AuthStore for MemoryAuthStore {
        Ok(())
    }

-    async fn renew_session(
+    async fn compare_exchange_session(
        &self,
        session_id: &str,
        expected: &AuthSession,
-        expires_at: chrono::DateTime<chrono::Utc>,
+        replacement: Option<&AuthSession>,
    ) -> AdminStoreResult<Option<AuthSession>> {
        let mut sessions = self.sessions.lock().unwrap();
        if let Some(session) = sessions.get_mut(session_id) {
-            if session.expires_at <= chrono::Utc::now() {
+            if session.retained_until() <= chrono::Utc::now() {
                return Ok(None);
            }
            if session == expected {
-                session.expires_at = expires_at;
+                if let Some(replacement) = replacement {
+                    *session = replacement.clone();
+                } else {
+                    sessions.remove(session_id);
+                    return Ok(None);
+                }
            }
            return Ok(Some(session.clone()));
        }
@@ -190,8 +196,13 @@ impl AuthStore for MemoryAuthStore {
 #[tokio::test]
 async fn successful_login_should_create_expiring_session_and_audit() {
    let store = std::sync::Arc::new(MemoryAuthStore::default());
-    let services = super::AdminHarness::new().auth(store.clone()).build().await;
+    let services = super::AdminHarness::new()
+        .session_ttl_minutes(7 * 24 * 60)
+        .auth(store.clone())
+        .build()
+        .await;

+    let before = Utc::now();
    let result = services
        .auth()
        .login(
@@ -205,6 +216,17 @@ async fn successful_login_should_create_expiring_session_and_audit() {
        .await
        .expect("login");

+    let after = Utc::now();
+    for (expiry, ttl) in [
+        (result.session.expires_at, TimeDelta::hours(24)),
+        (result.session.retained_until(), TimeDelta::days(7)),
+        (
+            result.session.absolute_expires_at.unwrap(),
+            TimeDelta::days(30),
+        ),
+    ] {
+        assert!((before + ttl..=after + ttl).contains(&expiry));
+    }
    assert!(
        services
            .auth()
@@ -293,6 +315,7 @@ async fn expired_sessions_are_rejected_and_store_outages_are_not_treated_as_logo
                credential_fingerprint: String::new(),
                admin_user_id: "admin".to_owned(),
            },
+            renewal: None,
            absolute_expires_at: None,
            expires_at: Utc::now() - TimeDelta::seconds(1),
        },
@@ -362,7 +385,7 @@ async fn failed_rotation_discards_the_new_session_and_leaves_the_old_session_ret
        .await
        .unwrap();
    assert!(!format!("{original:?}").contains(&original.session_id));
-    *store.reject_delete.lock().unwrap() = Some(original.session_id.clone());
+    *store.reject_delete.lock().unwrap() = Some(stored_id(&original.session_id).to_owned());
    assert_eq!(
        services
            .auth()
@@ -391,109 +414,23 @@ async fn failed_rotation_discards_the_new_session_and_leaves_the_old_session_ret
    assert!(store.sessions.lock().unwrap().is_empty());
 }

-#[tokio::test]
-async fn renewal_is_throttled_and_capped_by_the_original_absolute_expiry() {
-    let store = std::sync::Arc::new(MemoryAuthStore::default());
-    let services = super::AdminHarness::new()
-        .auth(store.clone())
-        .session_ttl_minutes(60)
-        .build()
-        .await;
-    let auth = services.auth();
-    let login = auth
-        .login(
-            LoginCommand::Admin {
-                username: None,
-                password: "strong-test-password".into(),
-            },
-            std::net::Ipv4Addr::LOCALHOST.into(),
-            None,
-        )
-        .await
-        .unwrap();
-    assert_eq!(
-        auth.renew_session(Some(&login.session_id)).await.unwrap(),
-        Some(login.session.clone())
-    );
-    let limit = Utc::now() + TimeDelta::minutes(30);
-    {
-        let mut sessions = store.sessions.lock().unwrap();
-        let session = sessions.get_mut(&login.session_id).unwrap();
-        session.expires_at = Utc::now() + TimeDelta::minutes(1);
-        session.absolute_expires_at = Some(limit);
-    }
-    let renewed = auth
-        .renew_session(Some(&login.session_id))
-        .await
-        .unwrap()
-        .unwrap();
-    assert_eq!(renewed.expires_at, limit);
-    assert_eq!(renewed.absolute_expires_at, Some(limit));
-    assert_eq!(
-        auth.renew_session(Some(&login.session_id)).await.unwrap(),
-        Some(renewed)
-    );
+fn stored_id(token: &str) -> &str {
+    token.split('.').nth(1).unwrap_or(token)
 }

-#[tokio::test]
-async fn renewal_never_revives_expired_revoked_or_legacy_sessions() {
-    let store = std::sync::Arc::new(MemoryAuthStore::default());
-    let services = super::AdminHarness::new().auth(store.clone()).build().await;
-    let auth = services.auth();
-    let login = auth
-        .login(
-            LoginCommand::Admin {
-                username: None,
-                password: "strong-test-password".into(),
-            },
-            std::net::Ipv4Addr::LOCALHOST.into(),
-            None,
-        )
-        .await
-        .unwrap();
-    let mut session = login.session.clone();
-    session.absolute_expires_at = None;
-    session.expires_at = Utc::now() + TimeDelta::seconds(30);
-    store
-        .sessions
-        .lock()
-        .unwrap()
-        .insert(login.session_id.clone(), session.clone());
-    assert_eq!(
-        auth.renew_session(Some(&login.session_id)).await.unwrap(),
-        Some(session.clone())
-    );
-    session.expires_at = Utc::now() - TimeDelta::seconds(1);
-    store
-        .sessions
-        .lock()
-        .unwrap()
-        .insert(login.session_id.clone(), session);
-    assert!(
-        auth.renew_session(Some(&login.session_id))
-            .await
-            .unwrap()
-            .is_none()
-    );
-    let mut session = login.session;
-    session.absolute_expires_at = Some(Utc::now() - TimeDelta::seconds(1));
-    store
-        .sessions
-        .lock()
-        .unwrap()
-        .insert(login.session_id.clone(), session);
-    assert!(
-        auth.renew_session(Some(&login.session_id))
-            .await
-            .unwrap()
-            .is_none()
-    );
-    auth.logout(&login.session_id).await.unwrap();
-    assert!(
-        auth.renew_session(Some(&login.session_id))
-            .await
-            .unwrap()
-            .is_none()
-    );
-    assert!(store.sessions.lock().unwrap().is_empty());
+async fn admin_login(
+    auth: &dyn gateway_admin::AuthService,
+) -> gateway_admin::model::auth::SessionGrant {
+    auth.login(
+        LoginCommand::Admin {
+            username: None,
+            password: "strong-test-password".into(),
+        },
+        std::net::Ipv4Addr::LOCALHOST.into(),
+        None,
+    )
+    .await
+    .unwrap()
 }
+
+mod session;
@@ -0,0 +1,268 @@
+//! 验证双凭据续期、响应重试、并发撤销与固定期限边界
+
+use super::super::AdminHarness;
+use super::{MemoryAuthStore, admin_login, stored_id};
+use chrono::{TimeDelta, Utc};
+use gateway_admin::model::auth::AuthSession;
+
+#[tokio::test]
+async fn expired_access_is_restored_by_refresh_and_duplicate_refresh_replays_the_same_grant() {
+    let store = std::sync::Arc::new(MemoryAuthStore::default());
+    let services = AdminHarness::new().auth(store.clone()).build().await;
+    let auth = services.auth();
+    let login = admin_login(auth).await;
+    let refresh = login.refresh_token.as_deref().unwrap();
+    assert!(auth.session(Some(refresh)).await.unwrap().is_none());
+    assert!(
+        auth.renew_session(Some(&login.session_id), None)
+            .await
+            .unwrap()
+            .is_none()
+    );
+    assert!(
+        auth.renew_session(None, Some(&login.session_id))
+            .await
+            .unwrap()
+            .is_none()
+    );
+    assert_eq!(
+        auth.renew_session(Some(refresh), None).await.unwrap(),
+        Some(login.clone())
+    );
+    store
+        .sessions
+        .lock()
+        .unwrap()
+        .get_mut(stored_id(&login.session_id))
+        .unwrap()
+        .expires_at = Utc::now() - TimeDelta::seconds(1);
+    assert!(
+        auth.session(Some(&login.session_id))
+            .await
+            .unwrap()
+            .is_none()
+    );
+    let (first, concurrent) = tokio::join!(
+        auth.renew_session(Some(refresh), None),
+        auth.renew_session(Some(refresh), None)
+    );
+    let first = first.unwrap().unwrap();
+    assert_eq!(concurrent.unwrap().as_ref(), Some(&first));
+    assert_ne!(first.session_id, login.session_id);
+    assert_ne!(first.refresh_token, login.refresh_token);
+    assert_eq!(
+        first.session.absolute_expires_at,
+        login.session.absolute_expires_at
+    );
+    assert!(
+        auth.session(Some(&first.session_id))
+            .await
+            .unwrap()
+            .is_some()
+    );
+    assert_eq!(
+        auth.renew_session(first.refresh_token.as_deref(), None)
+            .await
+            .unwrap(),
+        Some(first.clone())
+    );
+    assert_eq!(
+        auth.renew_session(Some(refresh), None).await.unwrap(),
+        Some(first.clone())
+    );
+    let persisted = format!("{:?}", store.sessions.lock().unwrap());
+    for token in [
+        &first.session_id,
+        first.refresh_token.as_ref().unwrap(),
+        &login.session_id,
+        login.refresh_token.as_ref().unwrap(),
+    ] {
+        assert!(!persisted.contains(token));
+        assert!(!persisted.contains(token.rsplit('.').next().unwrap()));
+    }
+}
+
+#[tokio::test]
+async fn late_refresh_reuse_revokes_the_family_but_unknown_secrets_do_not() {
+    let store = std::sync::Arc::new(MemoryAuthStore::default());
+    let services = AdminHarness::new().auth(store.clone()).build().await;
+    let auth = services.auth();
+    let login = admin_login(auth).await;
+    store
+        .sessions
+        .lock()
+        .unwrap()
+        .get_mut(stored_id(&login.session_id))
+        .unwrap()
+        .expires_at = Utc::now() - TimeDelta::seconds(1);
+    let next = auth
+        .renew_session(login.refresh_token.as_deref(), None)
+        .await
+        .unwrap()
+        .unwrap();
+    let unknown = format!("r2.{}.{}", stored_id(&login.session_id), "A".repeat(43));
+    assert!(
+        auth.renew_session(Some(&unknown), None)
+            .await
+            .unwrap()
+            .is_none()
+    );
+    auth.logout(&unknown).await.unwrap();
+    auth.logout(stored_id(&login.session_id)).await.unwrap();
+    assert!(
+        auth.session(Some(&next.session_id))
+            .await
+            .unwrap()
+            .is_some()
+    );
+    store
+        .sessions
+        .lock()
+        .unwrap()
+        .get_mut(stored_id(&login.session_id))
+        .unwrap()
+        .renewal
+        .as_mut()
+        .unwrap()
+        .previous
+        .as_mut()
+        .unwrap()
+        .expires_at = Utc::now() - TimeDelta::seconds(1);
+    assert!(
+        auth.renew_session(login.refresh_token.as_deref(), None)
+            .await
+            .unwrap()
+            .is_none()
+    );
+    assert!(
+        auth.session(Some(&next.session_id))
+            .await
+            .unwrap()
+            .is_none()
+    );
+    assert!(
+        auth.renew_session(next.refresh_token.as_deref(), None)
+            .await
+            .unwrap()
+            .is_none()
+    );
+}
+
+#[tokio::test]
+async fn refresh_respects_idle_and_absolute_expiry_and_logout_after_access_expiry() {
+    let store = std::sync::Arc::new(MemoryAuthStore::default());
+    let services = AdminHarness::new().auth(store.clone()).build().await;
+    let auth = services.auth();
+    for absolute in [false, true] {
+        let login = admin_login(auth).await;
+        {
+            let mut sessions = store.sessions.lock().unwrap();
+            let session = sessions.get_mut(stored_id(&login.session_id)).unwrap();
+            if absolute {
+                session.absolute_expires_at = Some(Utc::now() - TimeDelta::seconds(1));
+            } else {
+                session.renewal.as_mut().unwrap().expires_at = Utc::now() - TimeDelta::seconds(1);
+            }
+        }
+        assert!(
+            auth.renew_session(login.refresh_token.as_deref(), None)
+                .await
+                .unwrap()
+                .is_none()
+        );
+        assert!(
+            auth.session(Some(&login.session_id))
+                .await
+                .unwrap()
+                .is_none()
+        );
+    }
+    let login = admin_login(auth).await;
+    store
+        .sessions
+        .lock()
+        .unwrap()
+        .get_mut(stored_id(&login.session_id))
+        .unwrap()
+        .expires_at = Utc::now() - TimeDelta::seconds(1);
+    auth.logout(login.refresh_token.as_deref().unwrap())
+        .await
+        .unwrap();
+    assert!(
+        auth.renew_session(login.refresh_token.as_deref(), None)
+            .await
+            .unwrap()
+            .is_none()
+    );
+}
+
+#[tokio::test]
+async fn refreshed_expiry_is_capped_and_store_outages_preserve_the_session() {
+    let store = std::sync::Arc::new(MemoryAuthStore::default());
+    let services = AdminHarness::new().auth(store.clone()).build().await;
+    let auth = services.auth();
+    let login = admin_login(auth).await;
+    let limit = Utc::now() + TimeDelta::minutes(1);
+    {
+        let mut sessions = store.sessions.lock().unwrap();
+        let session = sessions.get_mut(stored_id(&login.session_id)).unwrap();
+        session.absolute_expires_at = Some(limit);
+        session.expires_at = Utc::now() - TimeDelta::seconds(1);
+    }
+    store
+        .unavailable
+        .store(true, std::sync::atomic::Ordering::SeqCst);
+    assert!(
+        auth.renew_session(login.refresh_token.as_deref(), None)
+            .await
+            .is_err()
+    );
+    store
+        .unavailable
+        .store(false, std::sync::atomic::Ordering::SeqCst);
+    let refreshed = auth
+        .renew_session(login.refresh_token.as_deref(), None)
+        .await
+        .unwrap()
+        .unwrap();
+    assert_eq!(refreshed.session.expires_at, limit);
+    assert_eq!(refreshed.session.retained_until(), limit);
+    assert_eq!(refreshed.session.absolute_expires_at, Some(limit));
+}
+
+#[tokio::test]
+async fn fixed_sessions_cannot_acquire_refresh_credentials() {
+    let store = std::sync::Arc::new(MemoryAuthStore::default());
+    let services = AdminHarness::new().auth(store.clone()).build().await;
+    let auth = services.auth();
+    let login = admin_login(auth).await;
+    let fixed = AuthSession {
+        renewal: None,
+        ..login.session
+    };
+    store
+        .sessions
+        .lock()
+        .unwrap()
+        .insert("fixed".into(), fixed.clone());
+    let grant = auth
+        .renew_session(None, Some("fixed"))
+        .await
+        .unwrap()
+        .unwrap();
+    assert_eq!(grant.session, fixed);
+    assert!(grant.refresh_token.is_none());
+    store
+        .sessions
+        .lock()
+        .unwrap()
+        .get_mut("fixed")
+        .unwrap()
+        .expires_at = Utc::now() - TimeDelta::seconds(1);
+    assert!(
+        auth.renew_session(None, Some("fixed"))
+            .await
+            .unwrap()
+            .is_none()
+    );
+}
@@ -285,19 +285,24 @@ impl AuthStore for MemoryKeyAuthStore {
        Ok(())
    }

-    async fn renew_session(
+    async fn compare_exchange_session(
        &self,
        session_id: &str,
        expected: &AuthSession,
-        expires_at: chrono::DateTime<chrono::Utc>,
+        replacement: Option<&AuthSession>,
    ) -> AdminStoreResult<Option<AuthSession>> {
        let mut sessions = self.sessions.lock().unwrap();
        if let Some(session) = sessions.get_mut(session_id) {
-            if session.expires_at <= chrono::Utc::now() {
+            if session.retained_until() <= chrono::Utc::now() {
                return Ok(None);
            }
            if session == expected {
-                session.expires_at = expires_at;
+                if let Some(replacement) = replacement {
+                    *session = replacement.clone();
+                } else {
+                    sessions.remove(session_id);
+                    return Ok(None);
+                }
            }
            return Ok(Some(session.clone()));
        }
@@ -102,3 +102,51 @@ async fn backup_service_rejects_download_of_non_completed_record() {
        .expect_err("non-completed record must be rejected");
    assert_eq!(error.kind(), gateway_admin::model::AdminErrorKind::Conflict);
 }
+
+#[tokio::test]
+async fn failed_delete_probe_does_not_refresh_verification() {
+    use gateway_admin::{model::backup::code, ports::backup::BackupRepository as _};
+    for succeeds in [false, true] {
+        let mut settings = configured_settings();
+        settings.last_verified_at = None;
+        let repository = Arc::new(FakeBackupRepository::new(settings));
+        let auth = Arc::new(FakeAuthStore::new());
+        let store = FakeObjectStore::new();
+        let store = if succeeds {
+            store
+        } else {
+            store.fail_connection(code::S3_PERMISSION_DENIED)
+        };
+        let services = AdminHarness::new()
+            .auth(auth.clone())
+            .backup(BackupStorePorts::new(
+                repository.clone(),
+                Arc::new(FakeDumpPort::new()),
+                Arc::new(store),
+            ))
+            .build()
+            .await;
+        let result = services
+            .backups()
+            .test_connection(&system_context())
+            .await
+            .unwrap();
+        assert_eq!(result.ok, succeeds);
+        assert_eq!(
+            repository
+                .load_settings()
+                .await
+                .unwrap()
+                .last_verified_at
+                .is_some(),
+            succeeds
+        );
+        assert_eq!(
+            auth.audit_actions()
+                .iter()
+                .filter(|action| action.as_str() == "backup.s3_connection_tested")
+                .count(),
+            1
+        );
+    }
+}
@@ -32,12 +32,12 @@ fn runtime_settings(enabled: bool, probe_enabled: bool, adaptive: bool) -> Runti
        rotation_strategy: gateway_admin::model::settings::RotationStrategy::Smart,
        updated_at: Utc::now(),
        values: gateway_admin::model::settings::RuntimeSettingsValues {
+            codex_privacy_policy: Default::default(),
            request_location_enabled: false,
            request_location: Default::default(),
            refresh_margin_seconds: 300,
            refresh_concurrency: 2,
            max_concurrent_per_account: 5,
-            request_interval_ms: 0,
            max_waiting_per_key: 0,
            max_waiting_per_account: 0,
            concurrency_wait_timeout_seconds: 30,
@@ -15,6 +15,7 @@ mod plugins;
 mod proxies;
 mod settings;
 mod system;
+mod usage_data;

 use std::{
    str::FromStr,
@@ -273,6 +274,7 @@ impl AdminHarness {
                self.plugin_store,
                Arc::new(plugins::TestPluginPorts),
                Arc::new(plugins::TestPluginPorts),
+                Arc::new(plugins::TestPluginPorts),
            ),
            gateway_admin::AdminRuntimePorts {
                timezone: Default::default(),
@@ -369,11 +371,11 @@ impl AuthStore for BootstrapAuthStore {
        Err(unavailable("admin session"))
    }

-    async fn renew_session(
+    async fn compare_exchange_session(
        &self,
        _: &str,
        _: &gateway_admin::model::auth::AuthSession,
-        _: chrono::DateTime<chrono::Utc>,
+        _: Option<&gateway_admin::model::auth::AuthSession>,
    ) -> AdminStoreResult<Option<gateway_admin::model::auth::AuthSession>> {
        Ok(None)
    }
@@ -747,6 +749,18 @@ impl ClientKeyStore for UnavailableStore {

 #[async_trait]
 impl ObservabilityStore for UnavailableStore {
+    async fn diagnostic_errors(
+        &self,
+        _target: &gateway_admin::model::diagnostics::DiagnosticTarget,
+        _limit: u16,
+    ) -> AdminStoreResult<Vec<gateway_admin::model::observability::OpsError>> {
+        Err(unavailable("diagnostic errors"))
+    }
+
+    fn query_timeout(&self) -> std::time::Duration {
+        std::time::Duration::from_secs(10)
+    }
+
    async fn dashboard_summary(
        &self,
        _: DashboardQuery,
@@ -772,15 +786,17 @@ impl ObservabilityStore for UnavailableStore {
        Err(unavailable("usage trend"))
    }

-    fn usage_calculated_billing_facts(
+    async fn analytics_cache_generation(&self) -> AdminStoreResult<u64> {
+        Err(unavailable("analytics generation"))
+    }
+
+    async fn usage_insights_observation(
        &self,
        _: TimeRange,
        _: UsageFilter,
        _: Granularity,
-    ) -> gateway_admin::ports::store::UsageCalculatedBillingStream<'_> {
-        Box::pin(futures::stream::once(async {
-            Err(unavailable("usage billing facts"))
-        }))
+    ) -> AdminStoreResult<gateway_admin::model::observability::UsageInsightsObservation> {
+        Err(unavailable("usage insights"))
    }

    async fn list_usage_records(&self, _: UsageQuery) -> AdminStoreResult<UsagePage> {
@@ -17,13 +17,13 @@ use gateway_admin::{
    model::{
        MutationContext, Revision,
        observability::{
-            AccountPoolMetrics, AttemptMetrics, CostCoverage, CurrencyCost, DashboardAccountUsage,
-            DashboardObservation, DashboardQuery, DashboardRuntimeSlots, DiagnosticDimension,
-            DiagnosticObservation, DiagnosticsObservation, Granularity, HealthStatus,
-            LatencyPercentiles, ObservabilityPageSize, OpsErrorPage, OpsErrorQuery,
+            AccountPoolMetrics, AnalyticsState, AttemptMetrics, CostCoverage, CurrencyCost,
+            DashboardAccountUsage, DashboardObservation, DashboardQuery, DashboardRuntimeSlots,
+            DiagnosticDimension, DiagnosticObservation, DiagnosticsObservation, Granularity,
+            HealthStatus, LatencyPercentiles, ObservabilityPageSize, OpsErrorPage, OpsErrorQuery,
            PercentileMilliseconds, RequestMetricPoint, RequestMetrics, TimeRange, TrendKind,
-            UsageBilling, UsageCalculatedBillingFact, UsageDetail, UsageFilter, UsageListRecord,
-            UsageOverview, UsagePage, UsageQuery,
+            UsageBilling, UsageDetail, UsageFilter, UsageInsightsObservation, UsageListRecord,
+            UsageOverview, UsagePage, UsageProjectedCostPoint, UsageQuery,
        },
        settings::{
            AdminApiKey, AdminApiKeyMutation, ReplaceRuntimeSettings, RotationStrategy,
@@ -148,7 +148,7 @@ async fn dashboard_summary_should_derive_first_token_average_from_trend() {
 }

 #[tokio::test]
-async fn health_timeline_should_match_legacy_status_precedence_and_thresholds() {
+async fn health_timeline_should_apply_status_precedence_and_thresholds() {
    let now = Utc::now();
    let current_slot = quarter_hour_start(now);
    let store = Arc::new(FixtureObservabilityStore::new(observation_range(now)));
@@ -158,13 +158,28 @@ async fn health_timeline_should_match_legacy_status_precedence_and_thresholds()
            RequestMetrics {
                failure_count: 1,
                cancelled_count: 1,
-                incomplete_count: 1,
                caller_error_count: 1,
                ..RequestMetrics::default()
            },
            HealthStatus::NoData,
            None,
        ),
+        (
+            RequestMetrics {
+                incomplete_count: 1,
+                ..RequestMetrics::default()
+            },
+            HealthStatus::LowSample,
+            Some(0.0),
+        ),
+        (
+            RequestMetrics {
+                incomplete_count: 3,
+                ..RequestMetrics::default()
+            },
+            HealthStatus::Unavailable,
+            Some(0.0),
+        ),
        (
            RequestMetrics {
                failure_count: 3,
@@ -184,21 +199,21 @@ async fn health_timeline_should_match_legacy_status_precedence_and_thresholds()
        ),
        (
            RequestMetrics {
-                success_count: 98,
-                failure_count: 2,
+                success_count: 94,
+                failure_count: 6,
                ..RequestMetrics::default()
            },
            HealthStatus::Unstable,
-            Some(98.0),
+            Some(94.0),
        ),
        (
            RequestMetrics {
-                success_count: 99,
-                failure_count: 1,
+                success_count: 95,
+                incomplete_count: 5,
                ..RequestMetrics::default()
            },
            HealthStatus::Stable,
-            Some(99.0),
+            Some(95.0),
        ),
    ];

@@ -224,6 +239,92 @@ async fn health_timeline_should_match_legacy_status_precedence_and_thresholds()
    }
 }

+#[tokio::test]
+async fn health_views_should_include_incomplete_and_keep_final_outcomes_separate() {
+    let now = Utc::now();
+    let current_slot = quarter_hour_start(now);
+    let store = Arc::new(FixtureObservabilityStore::new(observation_range(now)));
+    let services = observability_services(store.clone()).await;
+    let fixtures = [
+        (162, 0, 2, 0, 0, 98.780_487_804_878_05),
+        (297, 0, 2, 5, 0, 99.331_103_678_929_76),
+        (467, 1, 5, 0, 0, 98.731_501_057_082_45),
+        (95, 2, 3, 4, 1, 95.0),
+        (100, 0, 0, 0, 0, 100.0),
+    ];
+
+    for (index, (success, failed, incomplete, cancelled, caller_error, expected_percent)) in
+        fixtures.into_iter().enumerate()
+    {
+        let range = observation_range(
+            now + Duration::seconds(i64::try_from(index).expect("fixture index fits i64") * 2),
+        );
+        let metrics = RequestMetrics {
+            request_count: success + failed + incomplete + cancelled + caller_error,
+            success_count: success,
+            failure_count: failed + caller_error,
+            incomplete_count: incomplete,
+            cancelled_count: cancelled,
+            caller_error_count: caller_error,
+            ..RequestMetrics::default()
+        };
+        store.replace_trend(vec![health_metric_point(current_slot, metrics.clone())]);
+        store.replace_overview(UsageOverview {
+            analytics: Default::default(),
+            range,
+            requests: metrics,
+            // 中间尝试失败不会增加最终失败请求数
+            attempts: AttemptMetrics {
+                failure_count: 2,
+                ..AttemptMetrics::default()
+            },
+            providers: Vec::new(),
+        });
+
+        let dashboard = services
+            .observability()
+            .dashboard_summary(range, TrendKind::Usage)
+            .await
+            .expect("dashboard summary");
+        let timeline = dashboard.health_timeline;
+        let point = timeline
+            .points
+            .iter()
+            .find(|point| point.bucket_start == current_slot)
+            .expect("current health slot");
+        assert_eq!(point.status, HealthStatus::Stable);
+        assert_eq!(point.failed_requests, failed);
+        assert_eq!(point.incomplete_requests, incomplete);
+        assert_eq!(point.cancelled_requests, cancelled);
+        assert_eq!(point.caller_error_requests, caller_error);
+        for reliability in [timeline.reliability_percent, point.reliability_percent] {
+            assert!((reliability.expect("health reliability") - expected_percent).abs() < 1e-10);
+        }
+        for success_rate in [
+            dashboard.trend.summary.success_rate,
+            dashboard.trend.points[0].success_rate,
+        ] {
+            assert!(
+                (success_rate.expect("trend success rate") * 100.0 - expected_percent).abs()
+                    < 1e-10
+            );
+        }
+
+        let insights = services
+            .observability()
+            .usage_insights(range, UsageFilter::default())
+            .await
+            .expect("usage insights");
+        assert_eq!(insights.health.failed_requests, failed);
+        assert_eq!(insights.health.incomplete_requests, incomplete);
+        assert!((insights.health.success_rate * 100.0 - expected_percent).abs() < 1e-10);
+        assert!(
+            (insights.health.points[0].error_rate * 100.0 - (100.0 - expected_percent)).abs()
+                < 1e-10
+        );
+    }
+}
+
 #[tokio::test]
 async fn dashboard_summary_should_project_rebuildable_runtime_slots() {
    let now = Utc::now();
@@ -300,7 +401,7 @@ async fn dashboard_summary_should_observe_current_accounts_for_a_historical_rang
 }

 #[tokio::test]
-async fn dashboard_summary_should_coalesce_concurrent_requests_in_one_short_window() {
+async fn dashboard_summary_should_keep_distinct_exact_ranges_in_one_short_window() {
    let end_bucket = Utc::now().timestamp().div_euclid(2) * 2;
    let first_end = DateTime::from_timestamp(end_bucket, 100_000_000).expect("first end");
    let second_end = DateTime::from_timestamp(end_bucket, 900_000_000).expect("second end");
@@ -330,7 +431,7 @@ async fn dashboard_summary_should_coalesce_concurrent_requests_in_one_short_wind

    first.expect("first dashboard summary");
    second.expect("second dashboard summary");
-    assert_eq!(store.dashboard_summary_calls(), 1);
+    assert_eq!(store.dashboard_summary_calls(), 2);
 }

 #[tokio::test]
@@ -403,6 +504,7 @@ async fn observability_services_should_calculate_usage_insights_and_diagnostic_s
        ..RequestMetrics::default()
    };
    store.replace_overview(UsageOverview {
+        analytics: Default::default(),
        range,
        requests: metrics.clone(),
        attempts: AttemptMetrics {
@@ -431,23 +533,13 @@ async fn observability_services_should_calculate_usage_insights_and_diagnostic_s
                .expect("bucket USD cost"),
        }],
    }]);
-    store.replace_calculated_billing_facts(vec![UsageCalculatedBillingFact {
-        breakdown: None,
+    store.replace_projected_costs(vec![UsageProjectedCostPoint {
        bucket_start: quarter_hour_start(now),
-        provider_kind: "openai".to_owned(),
-        upstream_model_id: "gpt-5.5".to_owned(),
-        service_tier: None,
-        input_tokens: Some(800),
-        output_tokens: Some(200),
-        cached_tokens: Some(0),
-        cache_write_tokens: Some(0),
-        total: CurrencyCost {
-            currency: "USD".to_owned(),
-            amount: gateway_admin::model::observability::DecimalAmount::from_str("1.25")
-                .expect("calculated total"),
-        },
+        standard_amount: Some("1".parse().expect("standard cost")),
+        no_cache_amount: Some("1.25".parse().expect("no-cache cost")),
    }]);
    store.replace_diagnostics(DiagnosticsObservation {
+        analytics: Default::default(),
        total_request_count: 4,
        items: vec![diagnostic("openai", 3), diagnostic("xai", 1)],
    });
@@ -543,6 +635,7 @@ async fn diagnostics_should_preserve_request_order_when_a_small_sample_fails() {
    failure.success_count = 0;
    failure.failure_count = 1;
    store.replace_diagnostics(DiagnosticsObservation {
+        analytics: Default::default(),
        total_request_count: 101,
        items: vec![success, failure],
    });
@@ -566,6 +659,7 @@ async fn diagnostics_should_use_the_total_before_truncating_groups() {
    let range = observation_range(Utc::now());
    let store = Arc::new(FixtureObservabilityStore::new(range));
    store.replace_diagnostics(DiagnosticsObservation {
+        analytics: Default::default(),
        total_request_count: 200,
        items: (0..100)
            .map(|index| diagnostic(&format!("model-{index}"), 1))
@@ -591,6 +685,7 @@ async fn diagnostics_should_count_each_retried_request_once() {
    item.retry_count = 6;
    item.retried_request_count = 2;
    store.replace_diagnostics(DiagnosticsObservation {
+        analytics: Default::default(),
        total_request_count: 8,
        items: vec![item],
    });
@@ -691,26 +786,16 @@ async fn usage_records_should_enrich_provider_reported_totals_when_pricing_match
 }

 #[tokio::test]
-async fn usage_insights_should_reject_partial_costs_when_billing_stream_fails() {
+async fn usage_insights_should_reject_partial_costs_when_insights_fail() {
    let now = Utc::now();
    let range = observation_range(now);
    let store = Arc::new(FixtureObservabilityStore::new(range));
-    store.replace_calculated_billing_facts(vec![UsageCalculatedBillingFact {
-        breakdown: None,
+    store.replace_projected_costs(vec![UsageProjectedCostPoint {
        bucket_start: quarter_hour_start(now),
-        provider_kind: "openai".to_owned(),
-        upstream_model_id: "gpt-5.5".to_owned(),
-        service_tier: None,
-        input_tokens: Some(800),
-        output_tokens: Some(200),
-        cached_tokens: Some(0),
-        cache_write_tokens: Some(0),
-        total: CurrencyCost {
-            currency: "USD".to_owned(),
-            amount: "1.25".parse().expect("cost"),
-        },
+        standard_amount: Some("1".parse().expect("standard cost")),
+        no_cache_amount: Some("1.25".parse().expect("no-cache cost")),
    }]);
-    store.billing_stream_fails.store(true, Ordering::SeqCst);
+    store.insights_fail.store(true, Ordering::SeqCst);
    let services = observability_services_with_calculated_billing(store).await;
    assert!(
        services
@@ -741,9 +826,9 @@ async fn dashboard_should_preserve_provider_plan_names() {
            success_count: 0,
            input_tokens: None,
            output_tokens: None,
-            cached_tokens: None,
-            cache_write_tokens: None,
-            reasoning_tokens: None,
+            cached_input_tokens: None,
+            cache_write_input_tokens: None,
+            reasoning_output_tokens: None,
            image_input_tokens: None,
            image_output_tokens: None,
            image_request_count: 0,
@@ -783,8 +868,9 @@ async fn dashboard_should_preserve_provider_plan_names() {
 struct FixtureObservabilityStore {
    trend: Mutex<Vec<RequestMetricPoint>>,
    overview: Mutex<UsageOverview>,
-    calculated_billing_facts: Mutex<Vec<UsageCalculatedBillingFact>>,
-    billing_stream_fails: AtomicBool,
+    projected_costs: Mutex<Vec<UsageProjectedCostPoint>>,
+    insights_fail: AtomicBool,
+    summary_fail: AtomicBool,
    diagnostics: Mutex<DiagnosticsObservation>,
    runtime_slots: Mutex<Option<DashboardRuntimeSlots>>,
    summary_observed_at: Mutex<Option<DateTime<Utc>>>,
@@ -794,6 +880,7 @@ struct FixtureObservabilityStore {
    account_usage: Mutex<Vec<DashboardAccountUsage>>,
    dashboard_delay: Mutex<StdDuration>,
    dashboard_summary_calls: AtomicUsize,
+    usage_summary_filters: Mutex<Vec<UsageFilter>>,
 }

 impl FixtureObservabilityStore {
@@ -801,13 +888,15 @@ impl FixtureObservabilityStore {
        Self {
            trend: Mutex::new(Vec::new()),
            overview: Mutex::new(UsageOverview {
+                analytics: Default::default(),
                range,
                requests: RequestMetrics::default(),
                attempts: AttemptMetrics::default(),
                providers: Vec::new(),
            }),
-            calculated_billing_facts: Mutex::new(Vec::new()),
-            billing_stream_fails: AtomicBool::new(false),
+            projected_costs: Mutex::new(Vec::new()),
+            insights_fail: AtomicBool::new(false),
+            summary_fail: AtomicBool::new(false),
            diagnostics: Mutex::new(DiagnosticsObservation::default()),
            runtime_slots: Mutex::new(None),
            summary_observed_at: Mutex::new(None),
@@ -817,6 +906,7 @@ impl FixtureObservabilityStore {
            account_usage: Mutex::new(Vec::new()),
            dashboard_delay: Mutex::new(StdDuration::ZERO),
            dashboard_summary_calls: AtomicUsize::new(0),
+            usage_summary_filters: Mutex::new(Vec::new()),
        }
    }

@@ -836,11 +926,8 @@ impl FixtureObservabilityStore {
        *self.overview.lock().expect("overview") = overview;
    }

-    fn replace_calculated_billing_facts(&self, facts: Vec<UsageCalculatedBillingFact>) {
-        *self
-            .calculated_billing_facts
-            .lock()
-            .expect("calculated billing facts") = facts;
+    fn replace_projected_costs(&self, facts: Vec<UsageProjectedCostPoint>) {
+        *self.projected_costs.lock().expect("projected costs") = facts;
    }

    fn replace_diagnostics(&self, diagnostics: DiagnosticsObservation) {
@@ -858,6 +945,18 @@ impl FixtureObservabilityStore {

 #[async_trait]
 impl ObservabilityStore for FixtureObservabilityStore {
+    async fn diagnostic_errors(
+        &self,
+        _target: &gateway_admin::model::diagnostics::DiagnosticTarget,
+        _limit: u16,
+    ) -> AdminStoreResult<Vec<gateway_admin::model::observability::OpsError>> {
+        Err(super::unavailable("diagnostic errors"))
+    }
+
+    fn query_timeout(&self) -> std::time::Duration {
+        std::time::Duration::from_secs(10)
+    }
+
    async fn dashboard_summary(
        &self,
        query: DashboardQuery,
@@ -874,6 +973,7 @@ impl ObservabilityStore for FixtureObservabilityStore {
            tokio::time::sleep(dashboard_delay).await;
        }
        Ok(DashboardObservation {
+            analytics: self.overview.lock().expect("overview").analytics.clone(),
            range: query.range,
            totals: Default::default(),
            provider_accounts: AccountPoolMetrics::default(),
@@ -902,25 +1002,29 @@ impl ObservabilityStore for FixtureObservabilityStore {
        Ok(self.trend.lock().expect("trend").clone())
    }

-    fn usage_calculated_billing_facts(
+    async fn analytics_cache_generation(&self) -> AdminStoreResult<u64> {
+        Ok(self.overview.lock().expect("overview").analytics.generation)
+    }
+
+    async fn usage_insights_observation(
        &self,
        _: TimeRange,
        _: UsageFilter,
        granularity: Granularity,
-    ) -> gateway_admin::ports::store::UsageCalculatedBillingStream<'_> {
+    ) -> AdminStoreResult<UsageInsightsObservation> {
        self.usage_granularities.lock().unwrap().push(granularity);
-        let facts = self
-            .calculated_billing_facts
-            .lock()
-            .expect("calculated billing facts")
-            .clone();
-        let error = self
-            .billing_stream_fails
-            .load(Ordering::SeqCst)
-            .then(|| Err(super::unavailable("billing stream failed")));
-        Box::pin(futures::stream::iter(
-            facts.into_iter().map(Ok).chain(error),
-        ))
+        if self.insights_fail.load(Ordering::SeqCst) {
+            return Err(super::unavailable("projection read failed"));
+        }
+        Ok(UsageInsightsObservation {
+            overview: self.overview.lock().expect("overview").clone(),
+            trend: self.trend.lock().expect("trend").clone(),
+            costs: self
+                .projected_costs
+                .lock()
+                .expect("projected costs")
+                .clone(),
+        })
    }

    async fn list_usage_records(&self, query: UsageQuery) -> AdminStoreResult<UsagePage> {
@@ -938,8 +1042,26 @@ impl ObservabilityStore for FixtureObservabilityStore {
        Err(super::unavailable("usage detail"))
    }

-    async fn usage_summary(&self, _: TimeRange, _: UsageFilter) -> AdminStoreResult<UsageOverview> {
-        Ok(self.overview.lock().expect("overview").clone())
+    async fn usage_summary(
+        &self,
+        range: TimeRange,
+        filter: UsageFilter,
+    ) -> AdminStoreResult<UsageOverview> {
+        self.usage_summary_filters
+            .lock()
+            .expect("summary filters")
+            .push(filter);
+        let delay = *self.dashboard_delay.lock().expect("query delay");
+        if !delay.is_zero() {
+            tokio::time::sleep(delay).await;
+        }
+        if self.summary_fail.load(Ordering::SeqCst) {
+            return Err(super::unavailable("projection summary failed"));
+        }
+        Ok(UsageOverview {
+            range,
+            ..self.overview.lock().expect("overview").clone()
+        })
    }

    async fn usage_diagnostics(
@@ -988,12 +1110,12 @@ impl SettingsStore for FixtureSettingsStore {
            rotation_strategy: RotationStrategy::Smart,
            updated_at: Utc::now(),
            values: gateway_admin::model::settings::RuntimeSettingsValues {
+                codex_privacy_policy: Default::default(),
                request_location_enabled: false,
                request_location: Default::default(),
                refresh_margin_seconds: 300,
                refresh_concurrency: 2,
                max_concurrent_per_account: self.max_concurrent_per_account,
-                request_interval_ms: 0,
                max_waiting_per_key: 0,
                max_waiting_per_account: 0,
                concurrency_wait_timeout_seconds: 30,
@@ -1080,6 +1202,7 @@ fn observation_range(end: DateTime<Utc>) -> TimeRange {

 fn usage_query(now: DateTime<Utc>) -> UsageQuery {
    UsageQuery {
+        status: Default::default(),
        range: observation_range(now),
        filter: UsageFilter::default(),
        current_page: 1,
@@ -1094,6 +1217,7 @@ fn total_record(
    now: DateTime<Utc>,
 ) -> UsageListRecord {
    UsageListRecord {
+        outcome: gateway_admin::model::observability::RequestOutcome::Succeeded,
        client_api_key_name: Some("Production".to_owned()),
        id: id.to_owned(),
        endpoint: "/v1/responses".to_owned(),
@@ -1113,9 +1237,9 @@ fn total_record(
        service_tier: None,
        input_tokens: Some(800),
        output_tokens: Some(200),
-        cached_tokens: Some(0),
-        cache_write_tokens: Some(0),
-        reasoning_tokens: Some(0),
+        cached_input_tokens: Some(0),
+        cache_write_input_tokens: Some(0),
+        reasoning_output_tokens: Some(0),
        image_input_tokens: None,
        image_output_tokens: None,
        total_tokens: Some(1_000),
@@ -1228,9 +1352,204 @@ async fn admin_selects_dashboard_defaults_and_matching_usage_buckets_at_range_bo
            .usage_insights(range, UsageFilter::default())
            .await
            .unwrap();
-        assert_eq!(
-            *store.usage_granularities.lock().unwrap(),
-            vec![expected, expected]
+        assert_eq!(*store.usage_granularities.lock().unwrap(), vec![expected]);
+    }
+}
+
+#[tokio::test]
+async fn usage_summary_cache_should_coalesce_identical_queries_and_invalidate_deleted_generation() {
+    let range = observation_range(Utc::now());
+    let store = Arc::new(FixtureObservabilityStore::new(range));
+    store.set_dashboard_delay(StdDuration::from_millis(20));
+    let services = observability_services(store.clone()).await;
+    let service = services.observability();
+    let filter = UsageFilter {
+        client_api_key_ref: Some("deleted-key".to_owned()),
+        ..Default::default()
+    };
+    let (first, second) = tokio::join!(
+        service.usage_summary(range, filter.clone()),
+        service.usage_summary(range, filter.clone()),
+    );
+    first.expect("first summary");
+    second.expect("coalesced summary");
+    assert_eq!(store.usage_summary_filters.lock().unwrap().len(), 1);
+    {
+        let mut overview = store.overview.lock().unwrap();
+        overview.analytics.generation = 1;
+        overview.requests.request_count = 7;
+    }
+    let refreshed = service
+        .usage_summary(range, filter)
+        .await
+        .expect("generation refresh");
+    assert_eq!(refreshed.overview.analytics.generation, 1);
+    assert_eq!(refreshed.overview.requests.request_count, 7);
+    assert_eq!(store.usage_summary_filters.lock().unwrap().len(), 2);
+}
+
+#[tokio::test(start_paused = true)]
+async fn usage_summary_cache_should_coalesce_when_generation_advances_during_the_first_load() {
+    let range = observation_range(Utc::now());
+    let store = Arc::new(FixtureObservabilityStore::new(range));
+    store.set_dashboard_delay(StdDuration::from_millis(20));
+    let services = observability_services(store.clone()).await;
+    let service = services.observability();
+    let (first, second, ()) = tokio::join!(
+        service.usage_summary(range, UsageFilter::default()),
+        service.usage_summary(range, UsageFilter::default()),
+        async {
+            tokio::time::sleep(StdDuration::from_millis(5)).await;
+            store.overview.lock().unwrap().analytics.generation = 1;
+        },
+    );
+    assert_eq!(
+        first.expect("first summary").overview.analytics.generation,
+        1
+    );
+    assert_eq!(
+        second
+            .expect("coalesced summary")
+            .overview
+            .analytics
+            .generation,
+        1
+    );
+    assert_eq!(store.usage_summary_filters.lock().unwrap().len(), 1);
+}
+
+#[tokio::test]
+async fn usage_summary_cache_should_isolate_key_identity_and_filters() {
+    let range = observation_range(Utc::now());
+    let store = Arc::new(FixtureObservabilityStore::new(range));
+    let services = observability_services(store.clone()).await;
+    let service = services.observability();
+    for (key, model) in [
+        ("key-a", None),
+        ("key-a", None),
+        ("key-b", None),
+        ("key-a", Some("model-a")),
+    ] {
+        service
+            .usage_summary(
+                range,
+                UsageFilter {
+                    client_api_key_ref: Some(key.to_owned()),
+                    model: model.map(str::to_owned),
+                    ..Default::default()
+                },
+            )
+            .await
+            .expect("isolated summary");
+    }
+    let calls = store.usage_summary_filters.lock().unwrap();
+    assert_eq!(calls.len(), 3);
+    assert_eq!(calls[0].client_api_key_ref.as_deref(), Some("key-a"));
+    assert_eq!(calls[1].client_api_key_ref.as_deref(), Some("key-b"));
+    assert_eq!(calls[2].model.as_deref(), Some("model-a"));
+}
+
+#[tokio::test(start_paused = true)]
+async fn usage_summary_cache_should_bound_waiting_after_failed_refresh_and_allow_recovery() {
+    let range = observation_range(Utc::now());
+    let store = Arc::new(FixtureObservabilityStore::new(range));
+    store.set_dashboard_delay(store.query_timeout().mul_f64(0.7));
+    store.summary_fail.store(true, Ordering::SeqCst);
+    let services = observability_services(store.clone()).await;
+    let service = services.observability();
+    let started = tokio::time::Instant::now();
+    let (first, second, third, fourth) = tokio::join!(
+        service.usage_summary(range, UsageFilter::default()),
+        service.usage_summary(range, UsageFilter::default()),
+        service.usage_summary(range, UsageFilter::default()),
+        service.usage_summary(range, UsageFilter::default()),
+    );
+    assert!(first.is_err() && second.is_err() && third.is_err() && fourth.is_err());
+    assert!(
+        started.elapsed() <= store.query_timeout(),
+        "同键失败不能使后续请求逐个等待完整数据库超时: {:?}",
+        started.elapsed()
+    );
+
+    store.summary_fail.store(false, Ordering::SeqCst);
+    store.set_dashboard_delay(StdDuration::ZERO);
+    service
+        .usage_summary(range, UsageFilter::default())
+        .await
+        .expect("cancelled cache refresh releases its slot for recovery");
+}
+
+#[tokio::test(start_paused = true)]
+async fn insights_cache_should_bound_stale_lifetime_without_renewing_failed_refreshes() {
+    let range = observation_range(Utc::now());
+    let store = Arc::new(FixtureObservabilityStore::new(range));
+    {
+        let mut overview = store.overview.lock().unwrap();
+        overview.analytics.state = AnalyticsState::Ready;
+        overview.analytics.generated_at = Utc::now();
+        overview.analytics.lag_seconds = 7;
+        overview.requests.request_count = 19;
+    }
+    let services = observability_services(store.clone()).await;
+    let service = services.observability();
+    service
+        .usage_insights(range, UsageFilter::default())
+        .await
+        .unwrap();
+    store.insights_fail.store(true, Ordering::SeqCst);
+    tokio::time::advance(StdDuration::from_secs(16)).await;
+    let stale = service
+        .usage_insights(range, UsageFilter::default())
+        .await
+        .unwrap();
+    assert_eq!(stale.analytics.state, AnalyticsState::Stale);
+    assert!(stale.analytics.lag_seconds >= 7);
+    assert_eq!(stale.health.total_requests, 19);
+    tokio::time::advance(StdDuration::from_secs(45)).await;
+    assert!(
+        service
+            .usage_insights(range, UsageFilter::default())
+            .await
+            .is_err()
+    );
+}
+
+#[tokio::test(start_paused = true)]
+async fn insights_cache_should_reject_deleted_building_and_old_generation_times() {
+    for reason in ["deleted", "building", "generated-too-long-ago"] {
+        let range = observation_range(Utc::now());
+        let store = Arc::new(FixtureObservabilityStore::new(range));
+        {
+            let mut overview = store.overview.lock().unwrap();
+            overview.analytics.state = if reason == "building" {
+                AnalyticsState::Building
+            } else {
+                AnalyticsState::Ready
+            };
+            overview.analytics.generated_at = Utc::now()
+                - Duration::seconds(if reason == "generated-too-long-ago" {
+                    61
+                } else {
+                    0
+                });
+        }
+        let services = observability_services(store.clone()).await;
+        let service = services.observability();
+        service
+            .usage_insights(range, UsageFilter::default())
+            .await
+            .unwrap();
+        store.insights_fail.store(true, Ordering::SeqCst);
+        if reason == "deleted" {
+            store.overview.lock().unwrap().analytics.generation += 1;
+        }
+        tokio::time::advance(StdDuration::from_secs(16)).await;
+        assert!(
+            service
+                .usage_insights(range, UsageFilter::default())
+                .await
+                .is_err(),
+            "{reason}"
        );
    }
 }
@@ -534,6 +534,7 @@ fn preview_fixture() -> Fixture {
 fn source_proxy() -> ProxyRecord {
    let now = chrono::Utc::now();
    ProxyRecord {
+        enabled: true,
        auto_location: false,
        detected_location: None,
        location: None,
@@ -608,6 +609,38 @@ async fn saved_source_proxy_is_resolved_for_queries_and_frozen_into_verified_sou
    );
 }

+#[tokio::test]
+async fn disabled_source_proxy_rejects_queries_and_downloads_before_network_access() {
+    let mut fixture = preview_fixture();
+    fixture.binding.get_mut().unwrap().outbound_proxy_id = Some("source-proxy".into());
+    let mut proxy = source_proxy();
+    proxy.enabled = false;
+    *fixture.proxy.get_mut().unwrap() = Some(proxy);
+    let fixture = Arc::new(fixture);
+    assert_eq!(
+        fixture
+            .service()
+            .check_update("test.example", &[])
+            .await
+            .unwrap_err()
+            .kind(),
+        AdminErrorKind::Invalid
+    );
+    let mut request = preview_request();
+    request.outbound_proxy_id = Some("source-proxy".into());
+    assert_eq!(
+        fixture
+            .service()
+            .verify_remote(request)
+            .await
+            .unwrap_err()
+            .kind(),
+        AdminErrorKind::Invalid
+    );
+    assert!(fixture.egresses.lock().unwrap().is_empty());
+    assert_eq!(*fixture.downloads.lock().unwrap(), 0);
+}
+
 #[tokio::test]
 async fn proxy_revision_change_during_download_rejects_the_verified_candidate() {
    let mut fixture = preview_fixture();
@@ -1,5 +1,7 @@
 //! 插件管理用例的测试入口与共用端口替身

+mod usage_data;
+
 use async_trait::async_trait;
 use gateway_admin::model::plugins::distribution::{
    DownloadedPlugin, GithubReleaseQuery, PluginRelease, RemotePluginLocation, SourceCredential,
@@ -0,0 +1,24 @@
+//! 通用用量端口的插件管理测试夹具，非本测试调用路径禁止访问
+use super::TestPluginPorts;
+use gateway_admin::{model::usage_data::*, ports::usage_data::*};
+#[async_trait::async_trait]
+impl UsageDataStore for TestPluginPorts {
+    async fn get_record(&self, _: GetUsageRecord) -> UsageDataResult<UsageRecord> {
+        unreachable!("unexpected usage call")
+    }
+    async fn list_records(&self, _: ListUsageRecords) -> UsageDataResult<UsageRecordPage> {
+        unreachable!("unexpected usage call")
+    }
+    async fn write_records(&self, _: StoredUsageWrite) -> UsageDataResult<UsageWriteResult> {
+        unreachable!("unexpected usage call")
+    }
+    async fn list_aggregates(&self, _: ListUsageAggregates) -> UsageDataResult<UsageAggregatePage> {
+        unreachable!("unexpected usage call")
+    }
+    async fn write_aggregates(
+        &self,
+        _: StoredAggregateWrite,
+    ) -> UsageDataResult<UsageAggregateWriteResult> {
+        unreachable!("unexpected usage call")
+    }
+}
@@ -126,6 +126,7 @@ async fn authorization_uses_selected_proxy_regardless_of_probe_status() {
                .accounts(FakeAccountStore::new(kind, events.clone()))
                .proxies(Arc::new(TestProxies {
                    record: Some(ProxyRecord {
+                        enabled: true,
                        auto_location: false,
                        detected_location: None,
                        location: None,
@@ -57,6 +57,7 @@ impl VisitMut for WireTypes {
            let last = path.path.segments.last().unwrap().clone();
            *ty = match last.ident.to_string().as_str() {
                "DateTime" | "Tz" | "TokenPrice" | "AdminApiKey" => parse_quote!(String),
+                "Value" => parse_quote!(serde_json::Value),
                "OpaqueProviderData" => parse_quote!(serde_json::Map<String, serde_json::Value>),
                _ => Type::Path(syn::TypePath {
                    attrs: std::mem::take(&mut path.attrs),
@@ -79,6 +80,11 @@ fn contract_type(mut item: Item, name: &str) -> Item {
                    | "ReplaceRuntimeSettings"
                    | "AdminApiKeyMutation"
                    | "RegeneratedAdminApiKey"
+                    | "CodexPrivacyPolicy"
+                    | "PrivacyRule"
+                    | "PrivacyStep"
+                    | "PrivacyPreviewRequest"
+                    | "PrivacyPreviewResult"
            );
            (
                &mut item.attrs,
@@ -107,6 +113,13 @@ fn contract_type(mut item: Item, name: &str) -> Item {
            field.vis = parse_quote!(pub);
        }
    }
+    if let Item::Enum(item) = &mut item {
+        for variant in &mut item.variants {
+            variant
+                .attrs
+                .retain(|attr| !attr.path().is_ident("default"));
+        }
+    }
    WireTypes.visit_item_mut(&mut item);
    item
 }
@@ -117,6 +130,20 @@ fn sdk_settings_contract_matches_host_declarations() {
    let mut types = Vec::new();
    let mut replacement_fields = Vec::new();
    for (path, names) in [
+        (
+            "../gateway-core/src/settings/privacy.rs",
+            &[
+                "CodexPrivacyPolicy",
+                "PrivacyFailureMode",
+                "PrivacyScope",
+                "PrivacyAction",
+                "PrivacyRule",
+                "PrivacyStep",
+                "PrivacyRuleOutcome",
+                "PrivacyPreviewRequest",
+                "PrivacyPreviewResult",
+            ][..],
+        ),
        (
            "src/model/settings.rs",
            &[
@@ -100,6 +100,51 @@ async fn client_profile_preview_rejects_unknown_provider_before_loading_settings
    assert_eq!(error.kind(), AdminErrorKind::Invalid);
 }

+#[tokio::test]
+async fn pricing_accepts_ultrafast_for_openai_but_rejects_it_for_xai() {
+    for provider in ["openai", "xai"] {
+        let store = Arc::new(PricingSettingsStore::default());
+        let services = super::AdminHarness::new()
+            .settings(store.clone())
+            .provider(super::test_provider(provider))
+            .build()
+            .await;
+        let context = MutationContext {
+            actor: gateway_admin::model::MutationActor::System,
+            request_id: "request-ultrafast-pricing".to_owned(),
+        };
+        for band in ["ultrafast", "long_ultrafast"] {
+            let pricing = serde_json::from_value(serde_json::json!({
+                "multiplierBps": 10000,
+                "bands": {
+                    "standard": {"input":"2", "output":"10", "cacheRead":"0.1", "cacheWrite":"2.5"},
+                    (band): {"input":"12", "output":"60", "cacheRead":"0.6", "cacheWrite":"15"}
+                }
+            }))
+            .expect("Ultrafast override");
+            let update = UpdatePricing {
+                provider: provider.to_owned(),
+                models: vec!["example-model".to_owned()],
+                change: PricingChange::Replace(pricing),
+            };
+            let result = services
+                .settings()
+                .update_pricing(&context, update.clone())
+                .await;
+            if provider == "openai" {
+                result.expect("OpenAI accepts Ultrafast overrides");
+                assert_eq!(store.updated.lock().unwrap().as_ref(), Some(&update));
+            } else {
+                assert_eq!(
+                    result.expect_err("xAI rejects Ultrafast").kind(),
+                    AdminErrorKind::Invalid
+                );
+                assert!(store.updated.lock().unwrap().is_none());
+            }
+        }
+    }
+}
+
 #[tokio::test]
 async fn pricing_accepts_native_provider_and_rejects_unknown_sync_provider() {
    let store = Arc::new(PricingSettingsStore::default());
@@ -280,12 +325,12 @@ async fn settings_should_reject_zero_refresh_margin_before_store_call() {
                model_mappings: Default::default(),
                rotation_strategy: RotationStrategy::Smart,
                values: gateway_admin::model::settings::RuntimeSettingsValues {
+                    codex_privacy_policy: Default::default(),
                    request_location_enabled: false,
                    request_location: Default::default(),
                    refresh_margin_seconds: 0,
                    refresh_concurrency: 1,
                    max_concurrent_per_account: 1,
-                    request_interval_ms: 0,
                    max_waiting_per_key: 0,
                    max_waiting_per_account: 0,
                    concurrency_wait_timeout_seconds: 30,
@@ -0,0 +1,119 @@
+//! 用量服务的 wire 精度、可信主体和独立 SDK 合同校验
+use gateway_admin::model::usage_data::*;
+use serde_json::json;
+#[test]
+fn counters_preserve_integer_precision_and_reject_json_numbers() {
+    assert_eq!(
+        serde_json::from_value::<UsageCount>(json!(u64::MAX.to_string()))
+            .unwrap()
+            .get(),
+        u64::MAX
+    );
+    assert_eq!(
+        serde_json::from_value::<UsageDelta>(json!(i64::MIN.to_string()))
+            .unwrap()
+            .get(),
+        i64::MIN
+    );
+    for value in [json!(1), json!("1.5"), json!("+1")] {
+        assert!(serde_json::from_value::<UsageCount>(value.clone()).is_err());
+        assert!(serde_json::from_value::<UsageDelta>(value).is_err());
+    }
+}
+#[tokio::test]
+async fn usage_mutations_require_trusted_actor_and_old_workflow_operations_are_absent() {
+    let admin = super::AdminHarness::new().build().await;
+    let registry = admin.public_services();
+    let denied = registry
+        .call("usage.records.write", json!({"changes":[]}))
+        .await
+        .unwrap_err();
+    assert!(denied.message.contains("trusted caller"));
+    assert!(
+        registry
+            .call(
+                "usage.records.write",
+                json!({"changes":[],"actor":{"kind":"system"}})
+            )
+            .await
+            .is_err()
+    );
+    let ops = registry
+        .operations()
+        .filter(|op| op.starts_with("usage.") || *op == "pricing.evaluate")
+        .collect::<std::collections::BTreeSet<_>>();
+    assert_eq!(
+        ops,
+        std::collections::BTreeSet::from([
+            "usage.records.get",
+            "usage.records.list",
+            "usage.records.write",
+            "usage.aggregates.list",
+            "usage.aggregates.write",
+            "pricing.evaluate"
+        ])
+    );
+}
+#[test]
+fn sdk_wire_types_match_host_contracts() {
+    use quote::ToTokens as _;
+    let root = std::path::Path::new(env!("CARGO_MANIFEST_DIR"));
+    let items = |path: std::path::PathBuf| {
+        syn::parse_file(&std::fs::read_to_string(path).unwrap())
+            .unwrap()
+            .items
+            .into_iter()
+            .filter(|item| {
+                matches!(
+                    item,
+                    syn::Item::Struct(_)
+                        | syn::Item::Enum(_)
+                        | syn::Item::Impl(_)
+                        | syn::Item::Type(_)
+                )
+            })
+            .map(|item| item.into_token_stream().to_string())
+            .collect::<Vec<_>>()
+    };
+    for name in [
+        "value.rs",
+        "record.rs",
+        "query.rs",
+        "aggregate.rs",
+        "pricing.rs",
+        "error.rs",
+    ] {
+        assert_eq!(
+            items(root.join("src/model/usage_data").join(name)),
+            items(
+                root.join("../gateway-plugin/sdk/src/call/services/usage")
+                    .join(name)
+            ),
+            "{name}"
+        );
+    }
+}
+
+#[tokio::test]
+async fn batch_and_wire_limits_fail_before_reaching_storage() {
+    let admin = super::AdminHarness::new().build().await;
+    let registry = admin.public_services();
+    let changes = (0..501)
+        .map(|i| json!({"kind":"delete","id":format!("item_{i}")}))
+        .collect::<Vec<_>>();
+    let too_many = gateway_admin::public_service::scope_actor(
+        UsageActor::System,
+        registry.call("usage.records.write", json!({"changes":changes})),
+    )
+    .await
+    .unwrap_err();
+    assert_eq!(too_many.kind, "capacity_exceeded");
+    let oversized = registry
+        .call(
+            "usage.records.get",
+            json!({"id":"x".repeat(USAGE_DATA_MAX_REQUEST_BYTES)}),
+        )
+        .await
+        .unwrap_err();
+    assert_eq!(oversized.kind, "capacity_exceeded");
+}
@@ -25,6 +25,7 @@ gateway-admin = { path = "../gateway-admin" }
 gateway-core = { path = "../gateway-core" }
 gateway-protocol = { path = "../gateway-protocol" }
 headers = "0.4.1"
+regex = "1.13.1"
 secrecy = "0.10"
 serde = { version = "1.0.228", features = ["derive"] }
 serde_json = { version = "1.0.150", features = ["arbitrary_precision", "preserve_order"] }
@@ -32,7 +33,7 @@ sha2 = "0.11.0"
 thiserror = "2.0.18"
 tokio = { version = "1.52.3", default-features = false, features = ["macros", "rt", "sync", "time"] }
 tower = { version = "0.5.3", features = ["util"] }
-tower-http = { version = "0.7.0", features = ["cors", "fs", "request-id", "timeout", "trace"] }
+tower-http = { version = "0.7.0", features = ["compression-gzip", "cors", "fs", "request-id", "timeout", "trace"] }
 tracing = "0.1.44"
 url = "2.5.8"
 uuid = { version = "1.23.3", features = ["v7"] }
@@ -91,9 +91,15 @@ impl ListAccountGroupsQuery {
    }
 }

+const fn default_allow_image_generation() -> bool {
+    true
+}
+
 #[derive(Debug, Clone, Deserialize)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
 struct CreateAccountGroupRequest {
+    #[serde(default = "default_allow_image_generation")]
+    allow_image_generation: bool,
    #[serde(default)]
    fast_mode: FastMode,
    name: String,
@@ -104,6 +110,7 @@ struct CreateAccountGroupRequest {
 #[derive(Debug, Clone, Deserialize)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
 struct UpdateAccountGroupRequest {
+    allow_image_generation: Option<bool>,
    fast_mode: Option<FastMode>,
    id: String,
    name: String,
@@ -120,6 +127,7 @@ struct AccountGroupIdRequest {
 #[derive(Debug, Clone, Serialize)]
 #[serde(rename_all = "camelCase")]
 struct AccountGroupView {
+    allow_image_generation: bool,
    fast_mode: FastMode,
    id: String,
    name: String,
@@ -167,6 +175,7 @@ impl From<(AccountGroupRecord, crate::time::TimePresenter)> for AccountGroupView
            name: record.name,
            description: record.description,
            fast_mode: record.fast_mode,
+            allow_image_generation: record.allow_image_generation,
            color: record.color.as_str().to_owned(),
            enabled: record.enabled,
            member_count: record.member_count,
@@ -362,6 +371,7 @@ where
            .create(
                &auth.context().mutation_context(),
                CreateAccountGroup {
+                    allow_image_generation: request.allow_image_generation,
                    name: request.name,
                    description: request.description,
                    fast_mode: request.fast_mode,
@@ -390,6 +400,7 @@ where
            .update(
                &auth.context().mutation_context(),
                UpdateAccountGroup {
+                    allow_image_generation: request.allow_image_generation,
                    id: group_id(request.id)?,
                    name: request.name,
                    description: request.description,
@@ -308,8 +308,8 @@ pub(super) fn quota_local_usage(usage: &AccountUsage, time: crate::time::TimePre
        "inputTokensDisplay": display_optional_tokens(usage.input_tokens),
        "outputTokens": usage.output_tokens.unwrap_or_default(),
        "outputTokensDisplay": display_optional_tokens(usage.output_tokens),
-        "cachedTokens": usage.cached_tokens.unwrap_or_default(),
-        "cachedTokensDisplay": display_optional_tokens(usage.cached_tokens),
+        "cachedInputTokens": usage.cached_input_tokens.unwrap_or_default(),
+        "cachedInputTokensDisplay": display_optional_tokens(usage.cached_input_tokens),
        "imageInputTokens": usage.image_input_tokens.unwrap_or_default(),
        "imageInputTokensDisplay": display_optional_tokens(usage.image_input_tokens),
        "imageOutputTokens": usage.image_output_tokens.unwrap_or_default(),
@@ -355,10 +355,10 @@ pub(super) fn account_usage_view(
        input_tokens_display: display_optional_tokens(usage.input_tokens),
        output_tokens: usage.output_tokens,
        output_tokens_display: display_optional_tokens(usage.output_tokens),
-        cached_tokens: usage.cached_tokens,
-        cached_tokens_display: display_optional_tokens(usage.cached_tokens),
-        reasoning_tokens: usage.reasoning_tokens,
-        reasoning_tokens_display: display_optional_tokens(usage.reasoning_tokens),
+        cached_input_tokens: usage.cached_input_tokens,
+        cached_input_tokens_display: display_optional_tokens(usage.cached_input_tokens),
+        reasoning_output_tokens: usage.reasoning_output_tokens,
+        reasoning_output_tokens_display: display_optional_tokens(usage.reasoning_output_tokens),
        image_input_tokens: usage.image_input_tokens,
        image_input_tokens_display: display_optional_tokens(usage.image_input_tokens),
        image_output_tokens: usage.image_output_tokens,
@@ -369,10 +369,8 @@ pub(super) fn account_usage_view(
        image_request_failed_count_display: format_number(usage.image_request_failed_count),
        total_tokens: usage.total_tokens,
        total_tokens_display: display_optional_tokens(usage.total_tokens),
-        created_tokens: usage.cache_write_tokens,
-        created_tokens_display: display_optional_tokens(usage.cache_write_tokens),
-        read_tokens: usage.cached_tokens,
-        read_tokens_display: display_optional_tokens(usage.cached_tokens),
+        cache_write_input_tokens: usage.cache_write_input_tokens,
+        cache_write_input_tokens_display: display_optional_tokens(usage.cache_write_input_tokens),
        last_used_at: usage.last_used_at.map(|value| time.rfc3339(&value)),
        last_used_at_full_display: usage.last_used_at.map(|value| time.datetime(&value)),
        last_used_at_display: usage
@@ -429,8 +427,8 @@ pub(super) fn account_model_usage_view(
        input_tokens_display: display_optional_tokens(usage.input_tokens),
        output_tokens: usage.output_tokens,
        output_tokens_display: display_optional_tokens(usage.output_tokens),
-        cached_tokens: usage.cached_tokens,
-        cached_tokens_display: display_optional_tokens(usage.cached_tokens),
+        cached_input_tokens: usage.cached_input_tokens,
+        cached_input_tokens_display: display_optional_tokens(usage.cached_input_tokens),
        image_input_tokens: usage.image_input_tokens,
        image_input_tokens_display: display_optional_tokens(usage.image_input_tokens),
        image_output_tokens: usage.image_output_tokens,
@@ -478,10 +476,10 @@ pub(super) fn empty_account_usage() -> AccountUsageView {
        input_tokens_display: "—".to_owned(),
        output_tokens: None,
        output_tokens_display: "—".to_owned(),
-        cached_tokens: None,
-        cached_tokens_display: "—".to_owned(),
-        reasoning_tokens: None,
-        reasoning_tokens_display: "—".to_owned(),
+        cached_input_tokens: None,
+        cached_input_tokens_display: "—".to_owned(),
+        reasoning_output_tokens: None,
+        reasoning_output_tokens_display: "—".to_owned(),
        image_input_tokens: None,
        image_input_tokens_display: "—".to_owned(),
        image_output_tokens: None,
@@ -492,10 +490,8 @@ pub(super) fn empty_account_usage() -> AccountUsageView {
        image_request_failed_count_display: "—".to_owned(),
        total_tokens: None,
        total_tokens_display: "—".to_owned(),
-        created_tokens: None,
-        created_tokens_display: "—".to_owned(),
-        read_tokens: None,
-        read_tokens_display: "—".to_owned(),
+        cache_write_input_tokens: None,
+        cache_write_input_tokens_display: "—".to_owned(),
        last_used_at: None,
        last_used_at_full_display: None,
        last_used_at_display: "—".to_owned(),
@@ -435,10 +435,10 @@ pub struct AccountUsageView {
    pub input_tokens_display: String,
    pub output_tokens: Option<u64>,
    pub output_tokens_display: String,
-    pub cached_tokens: Option<u64>,
-    pub cached_tokens_display: String,
-    pub reasoning_tokens: Option<u64>,
-    pub reasoning_tokens_display: String,
+    pub cached_input_tokens: Option<u64>,
+    pub cached_input_tokens_display: String,
+    pub reasoning_output_tokens: Option<u64>,
+    pub reasoning_output_tokens_display: String,
    pub image_input_tokens: Option<u64>,
    pub image_input_tokens_display: String,
    pub image_output_tokens: Option<u64>,
@@ -449,10 +449,8 @@ pub struct AccountUsageView {
    pub image_request_failed_count_display: String,
    pub total_tokens: Option<u64>,
    pub total_tokens_display: String,
-    pub created_tokens: Option<u64>,
-    pub created_tokens_display: String,
-    pub read_tokens: Option<u64>,
-    pub read_tokens_display: String,
+    pub cache_write_input_tokens: Option<u64>,
+    pub cache_write_input_tokens_display: String,
    pub last_used_at: Option<String>,
    pub last_used_at_display: String,
    pub last_used_at_full_display: Option<String>,
@@ -477,8 +475,8 @@ pub struct ModelUsageView {
    pub input_tokens_display: String,
    pub output_tokens: Option<u64>,
    pub output_tokens_display: String,
-    pub cached_tokens: Option<u64>,
-    pub cached_tokens_display: String,
+    pub cached_input_tokens: Option<u64>,
+    pub cached_input_tokens_display: String,
    pub image_input_tokens: Option<u64>,
    pub image_input_tokens_display: String,
    pub image_output_tokens: Option<u64>,
@@ -0,0 +1,25 @@
+//! 管理端普通 JSON 响应的压缩范围与大小门槛
+
+use http::{Response, header};
+use http_body::Body;
+use tower_http::compression::predicate::Predicate;
+
+#[derive(Clone, Copy)]
+pub(super) struct AdminJson;
+
+impl Predicate for AdminJson {
+    fn should_compress<B: Body>(&self, response: &Response<B>) -> bool {
+        // 只处理长度已知的 JSON，不为判断门槛收集流式正文
+        response
+            .body()
+            .size_hint()
+            .exact()
+            .is_some_and(|size| size >= 1024)
+            && response
+                .headers()
+                .get(header::CONTENT_TYPE)
+                .and_then(|value| value.to_str().ok())
+                .and_then(|value| value.split(';').next())
+                .is_some_and(|value| value.trim().eq_ignore_ascii_case("application/json"))
+    }
+}
@@ -9,12 +9,14 @@ use axum::{
    response::Response,
    routing::any,
 };
+use tower_http::compression::{CompressionLayer, CompressionLevel};

 pub mod account_groups;
 pub mod accounts;
 pub mod auth;
 pub mod backups;
 pub mod client_keys;
+mod compression;
 pub(crate) mod diagnostics;
 mod extract;
 pub mod observability;
@@ -54,6 +56,12 @@ where
        .method_not_allowed_fallback(method_not_allowed)
        .route("/api/admin", any(admin_not_found))
        .route("/api/admin/{*path}", any(admin_not_found))
+        .layer(
+            CompressionLayer::new()
+                .quality(CompressionLevel::Fastest)
+                .compress_when(compression::AdminJson),
+        )
+        .merge(plugins::public_router().method_not_allowed_fallback(method_not_allowed))
        .layer(middleware::map_response(no_store))
 }

@@ -0,0 +1,136 @@
+//! 诊断文件的 HTTP 下载与受控数据投影，普通详情响应不携带时间线
+
+use axum::{extract::State, http::header, response::IntoResponse};
+use gateway_admin::model::{
+    diagnostics::{DiagnosticBundle, DiagnosticTarget},
+    observability::OpsError,
+};
+use serde::Deserialize;
+use serde_json::{Value, json};
+
+use super::{
+    AdminAuth, AdminError, AdminQuery, map_service_error, ops_error_view, usage_detail_view,
+};
+use crate::{auth::SessionState, time::TimePresenter};
+
+mod privacy;
+
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub(super) struct ExportQuery {
+    request_id: Option<String>,
+    error_id: Option<String>,
+}
+
+pub(super) async fn download<S>(
+    _auth: AdminAuth,
+    State(state): State<S>,
+    AdminQuery(query): AdminQuery<ExportQuery>,
+) -> Result<impl IntoResponse, AdminError>
+where
+    S: SessionState + Send + Sync,
+{
+    let target = match (query.request_id, query.error_id) {
+        (Some(id), None) => DiagnosticTarget::Request(id),
+        (None, Some(id)) => DiagnosticTarget::Operation(id),
+        _ => {
+            return Err(map_service_error(
+                gateway_admin::model::AdminError::invalid("请指定一个请求 ID 或错误记录 ID"),
+            ));
+        }
+    };
+    let bundle = state
+        .admin_services()
+        .observability()
+        .export_diagnostics(target)
+        .await
+        .map_err(map_service_error)?;
+    let time = TimePresenter::new(state.admin_services().timezone());
+    let document = privacy::redact(document(bundle, time));
+    let body = serde_json::to_vec_pretty(&document).map_err(|_| {
+        map_service_error(gateway_admin::model::AdminError::internal(
+            "诊断文件生成失败",
+        ))
+    })?;
+    Ok((
+        [
+            (header::CONTENT_TYPE, "application/json; charset=utf-8"),
+            (
+                header::CONTENT_DISPOSITION,
+                "attachment; filename=diagnostics.json",
+            ),
+            (header::CACHE_CONTROL, "private, no-store"),
+            (header::X_CONTENT_TYPE_OPTIONS, "nosniff"),
+        ],
+        body,
+    ))
+}
+
+fn document(bundle: DiagnosticBundle, time: TimePresenter) -> Value {
+    let target = match &bundle.target {
+        DiagnosticTarget::Request(id) => json!({"requestId": id}),
+        DiagnosticTarget::Operation(id) => json!({"errorId": id}),
+    };
+    let requests = bundle.requests.into_iter().map(|record| {
+        let evidence = record.detail.map(|mut detail| {
+            let trace = detail.trace.take();
+            let related = std::mem::take(&mut detail.related_requests);
+            let configuration = json!({
+                "revision": detail.request.config_revision,
+                "routingScope": detail.request.routing_scope,
+                "routingGroupIds": detail.request.routing_group_refs,
+                "deadlineAt": detail.request.deadline_at,
+            });
+            // 页面 DTO 没有展示的尝试原因与等待事实仍属于导出证据
+            let attempt_details = detail.attempts.iter().map(|attempt| json!({
+                "id": attempt.id, "attemptIndex": attempt.attempt_index,
+                "component": attempt.component, "operation": attempt.operation,
+                "message": attempt.message, "retryAfterMs": attempt.retry_after_ms,
+            })).collect::<Vec<_>>();
+            json!({
+                "detail": usage_detail_view(detail, time), "trace": trace,
+                "relatedRequests": related, "incidentConfiguration": configuration,
+                "attemptDetails": attempt_details,
+            })
+        });
+        json!({
+            "requestId": record.request_id,
+            "evidence": evidence,
+            "errors": record.errors.into_iter().map(|error| export_error(error, time)).collect::<Vec<_>>(),
+        })
+    }).collect::<Vec<_>>();
+    json!({
+        "schemaVersion": 5,
+        "source": "gateway.diagnostics",
+        "exportPolicy": "support_credentials_redacted",
+        "target": target,
+        "collectedAt": bundle.collected_at,
+        "environment": {
+            "scope": "export_time", "observedAt": bundle.collected_at,
+            "gateway": bundle.environment.map(|version| json!({
+                "version": version.version, "gitSha": version.git_sha,
+                "buildTime": version.build_time, "deploymentMode": version.deployment_mode,
+            })),
+        },
+        "error": bundle.error.map(|error| export_error(error, time)),
+        "requests": requests,
+        "availability": {"gaps": bundle.gaps.into_iter().map(|gap| json!({"section": gap.section, "reason": gap.reason})).collect::<Vec<_>>()},
+        "omitted": ["credentials_and_authentication", "account_contact_details", "uncollected_wire_payloads", "unrelated_requests_and_system_secrets"],
+        "notes": [
+            "诊断包包含错误原因链、上游错误与业务上下文，用于故障分析",
+            "认证字段、账号联系信息与可识别的内嵌凭据已脱敏，任意业务内容不属于自动识别范围",
+            "environment 为导出时环境，incidentConfiguration 与 request.routed 为事发配置事实，当前版本不能代替事发版本",
+            "缺失、截断、淘汰与读取失败见 availability.gaps，没有记录不表示没有发生",
+            "attempts 为异步 best-effort 投影，firstTokenMs 为空不证明没有输出",
+            "未采集的请求正文、过期记录、上游内部状态与退出前未落盘信息无法由导出补回"
+        ],
+    })
+}
+
+// 复用错误字段投影，原始详情直接进入脱敏遍历，避免先为页面缩进再解析一遍
+fn export_error(mut error: OpsError, time: TimePresenter) -> Value {
+    let details = error.error_details.take();
+    let mut value = json!(ops_error_view(error, time));
+    value["errorDetails"] = json!(details);
+    value
+}
@@ -0,0 +1,220 @@
+//! 诊断文件按认证与观测合同移除敏感字段，保留错误事实并明确导出截断
+
+use regex::Regex;
+use serde::Serialize;
+use serde_json::{Value, json};
+use std::sync::LazyLock;
+
+const REDACTED: &str = "<redacted>";
+const MAX_TEXT: usize = 256 * 1024;
+static INLINE: LazyLock<Vec<(Regex, &str)>> = LazyLock::new(|| {
+    [
+        (r"(?i)\b((?:set-cookie|cookie2?|(?:proxy-)?authorization|x-api-key|x-oai-is(?:-update)?|x-oai-attestation)\s*:\s*)[^\r\n]+", "${1}<redacted>"),
+        (r#"(?i)\b(Bearer|Basic)\s+[^\s"'<>;,]+"#, "${1} <redacted>"),
+        // 官方 TokenData 的 access_token / id_token 为 JWT，不按猜测的令牌前缀过滤普通文本
+        (r"\beyJ[\w-]+\.[\w-]+\.[\w-]+\b", "<redacted>"),
+        (r"(?i)([a-z][a-z0-9+.-]*://)[^\s/@]+@", "${1}<redacted>@"),
+        (r#"(?i)\b((?:(?:personal[_-]?)?access[_-]?token|refresh[_-]?token|id[_-]?token|(?:(?:openai|x)[_-]?)?api[_-]?key|(?:current[_-]?|new[_-]?)?password|authorization|proxy[_-]?authorization|x[_-]?oai[_-]?(?:is(?:[_-]?update)?|attestation))["']?\s*[=:]\s*)("[^"\r\n]*"|'[^'\r\n]*'|[^\s&,;]+)"#, "${1}<redacted>"),
+    ].into_iter().map(|(pattern, replacement)| (Regex::new(pattern).expect("static credential pattern"), replacement)).collect()
+});
+
+#[derive(Default, Serialize)]
+#[serde(rename_all = "camelCase")]
+struct Report {
+    credential_fields: usize,
+    personal_fields: usize,
+    inline_credentials: usize,
+    truncated_values: usize,
+}
+
+struct Redactor {
+    report: Report,
+    bytes: usize,
+    nodes: usize,
+}
+
+pub(super) fn redact(mut value: Value) -> Value {
+    let mut redactor = Redactor {
+        report: Report::default(),
+        bytes: 8 * 1024 * 1024,
+        nodes: 100_000,
+    };
+    // 先处理有界文件信息，正文耗尽预算也不能删除 schema、目标或既有缺口
+    let mut error = value["error"].take();
+    let mut requests = value["requests"].take();
+    redactor.visit(&mut value, 0);
+    redactor.visit(&mut error, 0);
+    redactor.visit(&mut requests, 0);
+    value["error"] = error;
+    value["requests"] = requests;
+    if redactor.report.truncated_values > 0 {
+        // 缺口清单可能也触及预算，顶层统计始终保留以免截断变成静默丢失
+        value["exportTruncated"] = json!(true);
+        if !value["availability"]["gaps"].is_array() {
+            value["availability"] = json!({"gaps": []});
+        }
+        value["availability"]["gaps"]
+            .as_array_mut()
+            .expect("gap array")
+            .push(json!({
+                "section": "export", "reason": "export_size_limit",
+            }));
+    }
+    value["redaction"] = json!(redactor.report);
+    value
+}
+
+fn normalized(key: &str) -> String {
+    key.chars()
+        .filter(|character| !matches!(character, '_' | '-'))
+        .flat_map(char::to_lowercase)
+        .collect()
+}
+
+// OAuth 字段来自 Provider credential schema 与官方 Codex TokenData；API Key 来自
+// CodexCprApiKeyExportAccount / AuthDotJson；密码来自管理登录合同，头部来自传输身份合同
+// 不用 token、secret、credential 等泛称推断敏感性，避免删除业务错误上下文
+fn secret(key: &str) -> bool {
+    matches!(
+        key,
+        "accesstoken"
+            | "personalaccesstoken"
+            | "refreshtoken"
+            | "idtoken"
+            | "apikey"
+            | "openaiapikey"
+            | "password"
+            | "currentpassword"
+            | "newpassword"
+            | "authorization"
+            | "proxyauthorization"
+            | "xapikey"
+            | "cookie"
+            | "cookie2"
+            | "setcookie"
+            | "xoaiis"
+            | "xoaiisupdate"
+            | "xoaiattestation"
+    )
+}
+
+impl Redactor {
+    fn omitted(&mut self) -> Value {
+        self.report.truncated_values += 1;
+        json!({"omitted": "export_size_limit"})
+    }
+
+    fn text(&mut self, text: &str) -> String {
+        let mut result = text.to_owned();
+        for (pattern, replacement) in INLINE.iter() {
+            self.report.inline_credentials += pattern.find_iter(&result).count();
+            result = pattern.replace_all(&result, *replacement).into_owned();
+        }
+        result
+    }
+
+    fn visit(&mut self, value: &mut Value, depth: usize) {
+        if self.nodes == 0 || self.bytes == 0 || depth > 32 {
+            *value = self.omitted();
+            return;
+        }
+        self.nodes -= 1;
+        // 预算同时计入缩进和容器分隔符，避免深层 JSON 的下载体积显著超过正文预算
+        self.bytes = self.bytes.saturating_sub(24 + depth * 4);
+        match value {
+            Value::String(text) => {
+                if text.trim_start().starts_with('{') || text.trim_start().starts_with('[') {
+                    if text.len() > MAX_TEXT {
+                        *value = self.omitted();
+                        return;
+                    }
+                    if let Ok(parsed) = serde_json::from_str::<Value>(text) {
+                        *value = parsed;
+                        self.visit(value, depth + 1);
+                        return;
+                    }
+                }
+                let cleaned = self.text(text);
+                let limit = MAX_TEXT.min(self.bytes / 2);
+                if cleaned.len() > limit {
+                    let boundary = cleaned.floor_char_boundary(limit);
+                    *value = json!({"text": &cleaned[..boundary], "omittedBytes": cleaned.len() - boundary});
+                    self.report.truncated_values += 1;
+                } else {
+                    *text = cleaned;
+                }
+                self.bytes = self.bytes.saturating_sub(value.to_string().len());
+            }
+            Value::Array(items) => {
+                // 头部也可能以二元组承载，不能只识别对象字段名
+                if items.len() == 2
+                    && items[0]
+                        .as_str()
+                        .is_some_and(|name| secret(&normalized(name)))
+                {
+                    items[1] = json!(REDACTED);
+                    self.report.credential_fields += 1;
+                }
+                let original_len = items.len();
+                let mut kept = 0;
+                for item in items.iter_mut().take(4096) {
+                    if self.nodes == 0 || self.bytes == 0 {
+                        break;
+                    }
+                    self.visit(item, depth + 1);
+                    kept += 1;
+                }
+                if kept < original_len {
+                    items.truncate(kept);
+                    items.push(json!({"omittedItems": original_len - kept}));
+                    self.report.truncated_values += 1;
+                }
+            }
+            Value::Object(object) => {
+                if object
+                    .get("name")
+                    .and_then(Value::as_str)
+                    .is_some_and(|name| secret(&normalized(name)))
+                    && object.contains_key("value")
+                {
+                    object.insert("value".to_owned(), json!(REDACTED));
+                    self.report.credential_fields += 1;
+                }
+                let fields = std::mem::take(object);
+                let total = fields.len();
+                for (key, mut item) in fields {
+                    if object.len() >= 4096 || self.nodes == 0 || self.bytes == 0 {
+                        break;
+                    }
+                    let normalized = normalized(&key);
+                    if secret(&normalized) {
+                        item = json!(REDACTED);
+                        self.report.credential_fields += 1;
+                    } else if matches!(
+                        normalized.as_str(),
+                        "email"
+                            | "accountemail"
+                            | "clientip"
+                            | "accountname"
+                            | "accountnotes"
+                            | "credentialname"
+                            | "clientapikeyname"
+                            | "accountlabel"
+                    ) {
+                        item = json!(REDACTED);
+                        self.report.personal_fields += 1;
+                    } else {
+                        self.visit(&mut item, depth + 1);
+                    }
+                    self.bytes = self.bytes.saturating_sub(key.len());
+                    object.insert(self.text(&key), item);
+                }
+                if object.len() < total {
+                    object.insert("_omittedFields".to_owned(), json!(total - object.len()));
+                    self.report.truncated_values += 1;
+                }
+            }
+            _ => {}
+        }
+    }
+}
@@ -16,6 +16,7 @@ use super::{
    wire::map_admin_service_error,
 };

+mod export;
 mod presenter;
 mod query;
 mod routes;
@@ -1,6 +1,7 @@
 //! 观测领域事实到管理页面的展示投影

 use super::*;
+use gateway_core::metering::Usage;

 pub(crate) fn display_duration(value: Option<u64>) -> String {
    let Some(value) = value.and_then(|value| i64::try_from(value).ok()) else {
@@ -58,9 +59,9 @@ pub(crate) fn request_metrics_view(metrics: &domain::RequestMetrics) -> RequestM
        caller_error_count: metrics.caller_error_count,
        input_tokens: metrics.input_tokens,
        output_tokens: metrics.output_tokens,
-        cached_tokens: metrics.cached_tokens,
-        cache_write_tokens: metrics.cache_write_tokens,
-        reasoning_tokens: metrics.reasoning_tokens,
+        cached_input_tokens: metrics.cached_input_tokens,
+        cache_write_input_tokens: metrics.cache_write_input_tokens,
+        reasoning_output_tokens: metrics.reasoning_output_tokens,
        total_tokens: metrics.total_tokens,
    }
 }
@@ -100,74 +101,63 @@ pub(crate) fn attempt_metrics_view(metrics: &domain::AttemptMetrics) -> AttemptM
 }

 pub(crate) fn token_details(record: &domain::UsageRecord) -> TokenDetailsView {
-    TokenDetailsView {
+    token_details_view(&Usage {
        input_tokens: record.input_tokens,
        output_tokens: record.output_tokens,
-        cached_tokens: record.cached_tokens,
-        cache_write_tokens: record.cache_write_tokens,
-        reasoning_tokens: record.reasoning_tokens,
+        cached_input_tokens: record.cached_input_tokens,
+        cache_write_input_tokens: record.cache_write_input_tokens,
+        reasoning_output_tokens: record.reasoning_output_tokens,
        image_input_tokens: record.image_input_tokens,
        image_output_tokens: record.image_output_tokens,
        total_tokens: record.total_tokens,
-        input_tokens_display: record
-            .input_tokens
-            .map_or_else(|| "-".to_owned(), format_number),
-        output_tokens_display: record
-            .output_tokens
-            .map_or_else(|| "-".to_owned(), format_number),
-        cached_tokens_display: record
-            .cached_tokens
-            .map_or_else(|| "-".to_owned(), format_compact_number),
-        cache_write_tokens_display: record
-            .cache_write_tokens
-            .map_or_else(|| "-".to_owned(), format_compact_number),
-        reasoning_tokens_display: record
-            .reasoning_tokens
-            .map_or_else(|| "-".to_owned(), format_number),
-        image_input_tokens_display: record
-            .image_input_tokens
-            .map_or_else(|| "-".to_owned(), format_number),
-        image_output_tokens_display: record
-            .image_output_tokens
-            .map_or_else(|| "-".to_owned(), format_number),
-        total_tokens_display: record
-            .total_tokens
-            .map_or_else(|| "-".to_owned(), format_number),
-    }
+    })
 }

 pub(crate) fn usage_list_token_details(record: &domain::UsageListRecord) -> TokenDetailsView {
-    TokenDetailsView {
+    token_details_view(&Usage {
        input_tokens: record.input_tokens,
        output_tokens: record.output_tokens,
-        cached_tokens: record.cached_tokens,
-        cache_write_tokens: record.cache_write_tokens,
-        reasoning_tokens: record.reasoning_tokens,
+        cached_input_tokens: record.cached_input_tokens,
+        cache_write_input_tokens: record.cache_write_input_tokens,
+        reasoning_output_tokens: record.reasoning_output_tokens,
        image_input_tokens: record.image_input_tokens,
        image_output_tokens: record.image_output_tokens,
        total_tokens: record.total_tokens,
-        input_tokens_display: record
+    })
+}
+
+fn token_details_view(usage: &Usage) -> TokenDetailsView {
+    TokenDetailsView {
+        input_tokens: usage.input_tokens,
+        output_tokens: usage.output_tokens,
+        cached_input_tokens: usage.cached_input_tokens,
+        cache_write_input_tokens: usage.cache_write_input_tokens,
+        reasoning_output_tokens: usage.reasoning_output_tokens,
+        image_input_tokens: usage.image_input_tokens,
+        image_output_tokens: usage.image_output_tokens,
+        total_tokens: usage.total_tokens,
+        input_tokens_display: usage
            .input_tokens
            .map_or_else(|| "-".to_owned(), format_number),
-        output_tokens_display: record
+        output_tokens_display: usage
            .output_tokens
            .map_or_else(|| "-".to_owned(), format_number),
-        cached_tokens_display: record
-            .cached_tokens
+        cached_input_tokens_display: usage
+            .cached_input_tokens
            .map_or_else(|| "-".to_owned(), format_compact_number),
-        cache_write_tokens_display: record
-            .cache_write_tokens
+        cache_write_input_tokens_display: usage
+            .cache_write_input_tokens
            .map_or_else(|| "-".to_owned(), format_compact_number),
-        reasoning_tokens_display: record
-            .reasoning_tokens
+        reasoning_output_tokens_display: usage
+            .reasoning_output_tokens
            .map_or_else(|| "-".to_owned(), format_number),
-        image_input_tokens_display: record
+        image_input_tokens_display: usage
            .image_input_tokens
            .map_or_else(|| "-".to_owned(), format_number),
-        image_output_tokens_display: record
+        image_output_tokens_display: usage
            .image_output_tokens
            .map_or_else(|| "-".to_owned(), format_number),
-        total_tokens_display: record
+        total_tokens_display: usage
            .total_tokens
            .map_or_else(|| "-".to_owned(), format_number),
    }
@@ -272,6 +262,7 @@ pub(crate) fn usage_list_record_view(
        .clone()
        .or_else(|| record.requested_model_id.clone());
    UsageListRecordView {
+        logical_outcome: record.outcome.as_str().to_owned(),
        client_api_key_name: record.client_api_key_name,
        id: record.id,
        provider: record.provider_kind,
@@ -430,9 +421,9 @@ pub(crate) fn usage_record_view(
        latency_ms: record.latency_ms,
        input_tokens: record.input_tokens,
        output_tokens: record.output_tokens,
-        cached_tokens: record.cached_tokens,
-        cache_write_tokens: record.cache_write_tokens,
-        reasoning_tokens: record.reasoning_tokens,
+        cached_input_tokens: record.cached_input_tokens,
+        cache_write_input_tokens: record.cache_write_input_tokens,
+        reasoning_output_tokens: record.reasoning_output_tokens,
        image_input_tokens: record.image_input_tokens,
        image_output_tokens: record.image_output_tokens,
        message,
@@ -526,7 +517,7 @@ pub(crate) fn usage_attempt_view(attempt: domain::UsageAttempt) -> UsageAttemptV
        estimated_cost_currency: attempt.cost_currency,
        input_tokens: attempt.input_tokens,
        output_tokens: attempt.output_tokens,
-        cached_tokens: attempt.cached_tokens,
+        cached_input_tokens: attempt.cached_input_tokens,
        total_tokens: attempt.total_tokens,
        first_token_ms: None,
        latency_ms: attempt.latency_ms,
@@ -545,8 +536,6 @@ pub(crate) fn usage_detail_view(
    time: crate::time::TimePresenter,
 ) -> UsageRecordDetailView {
    UsageRecordDetailView {
-        trace: detail.trace,
-        related_requests: detail.related_requests,
        request: usage_record_view(detail.request, time),
        attempts: detail
            .attempts
@@ -626,7 +615,7 @@ pub(crate) fn ops_error_view(
        subagent_kind: error.subagent_kind,
        compact: error.compact,
        message: error.message,
-        error_details: error.error_details,
+        error_details: error.error_details.map(error_details_view),
        metadata: OpsErrorMetadataView {
            source: error.source,
            component: error.component,
@@ -650,6 +639,20 @@ pub(crate) fn ops_error_view(
    }
 }

+// 受控错误正文保持原文语义，嵌套 JSON 只在展示投影中展开缩进
+fn error_details_view(raw: String) -> String {
+    let Ok(mut value) = serde_json::from_str::<Value>(&raw) else {
+        return raw;
+    };
+    if let Some(upstream) = value.get_mut("upstream")
+        && let Some(text) = upstream.as_str()
+        && let Ok(parsed) = serde_json::from_str::<Value>(text)
+    {
+        *upstream = parsed;
+    }
+    serde_json::to_string_pretty(&value).unwrap_or(raw)
+}
+
 pub(crate) fn ops_page_view(
    page: domain::OpsErrorPage,
    time: crate::time::TimePresenter,
@@ -683,8 +686,8 @@ pub(crate) fn trend_point_view(
        input_tokens_value: point.metrics.input_tokens,
        output_tokens: format_compact_number(point.metrics.output_tokens),
        output_tokens_value: point.metrics.output_tokens,
-        cached_tokens: format_compact_number(point.metrics.cached_tokens),
-        cached_tokens_value: point.metrics.cached_tokens,
+        cached_input_tokens: format_compact_number(point.metrics.cached_input_tokens),
+        cached_input_tokens_value: point.metrics.cached_input_tokens,
        cache_hit_rate_value: point.cached_token_rate,
        tokens_value: point.metrics.total_tokens,
        errors: format_compact_number(point.service_failure_count),
@@ -749,7 +752,7 @@ pub(crate) fn trend_summary_view(
            },
            TrendSummaryView {
                label: "缓存".to_owned(),
-                value: format_compact_number(summary.cached_tokens),
+                value: format_compact_number(summary.cached_input_tokens),
                ratio: None,
            },
        ],
@@ -800,6 +803,7 @@ pub(crate) fn trend_view(
    time: crate::time::TimePresenter,
 ) -> TrendData {
    TrendData {
+        analytics: analytics_view(trend.analytics, time),
        kind,
        summary: trend_summary_view(kind, &trend.summary),
        points: trend
@@ -913,6 +917,7 @@ pub(crate) fn dashboard_view(
        rotation_strategy,
    } = result;
    let domain::DashboardObservation {
+        analytics,
        runtime_slots: _,
        range,
        totals,
@@ -982,6 +987,7 @@ pub(crate) fn dashboard_view(
        .saturating_sub(provider_accounts.normal);

    DashboardDataView {
+        analytics: analytics_view(analytics, time),
        as_of: range.end,
        as_of_display: time.datetime(&range.end),
        cards: DashboardCardsView {
@@ -1013,7 +1019,7 @@ pub(crate) fn dashboard_view(
                today_hit_rate_value: today.observed_cached_token_rate,
                yesterday_hit_rate_value: yesterday.observed_cached_token_rate,
                total_hit_rate: display_rate(total_cached_token_rate),
-                total_cached_tokens: format_compact_number(totals.cached_tokens),
+                total_cached_input_tokens: format_compact_number(totals.cached_input_tokens),
                average_first_token_latency_ms: display_duration(average_first_token_latency_ms),
            },
        },
@@ -1046,14 +1052,18 @@ pub(crate) fn dashboard_view(
    }
 }

-pub(crate) fn usage_summary_view(summary: domain::UsageSummary) -> UsageSummaryView {
+pub(crate) fn usage_summary_view(
+    summary: domain::UsageSummary,
+    time: crate::time::TimePresenter,
+) -> UsageSummaryView {
    let overview = summary.overview;
    UsageSummaryView {
+        analytics: analytics_view(overview.analytics, time),
        total_requests: format_compact_number(overview.requests.request_count),
        input_tokens: format_compact_number(overview.requests.input_tokens),
        output_tokens: format_compact_number(overview.requests.output_tokens),
-        cached_tokens: format_compact_number(overview.requests.cached_tokens),
-        cache_write_tokens: format_compact_number(overview.requests.cache_write_tokens),
+        cached_input_tokens: format_compact_number(overview.requests.cached_input_tokens),
+        cache_write_input_tokens: format_compact_number(overview.requests.cache_write_input_tokens),
        total_tokens: format_compact_number(overview.requests.total_tokens),
        average_latency_ms: display_duration(summary.average_latency_ms),
        logical_requests: request_metrics_view(&overview.requests),
@@ -1139,7 +1149,7 @@ pub(crate) fn usage_insights_view(
            label: time.label(point.bucket_start, "%m-%d %H:%M"),
            input_tokens: point.input_tokens,
            output_tokens: point.output_tokens,
-            cached_tokens: point.cached_tokens,
+            cached_input_tokens: point.cached_input_tokens,
            total_tokens: point.total_tokens,
            estimated_cost: point.estimated_cost.as_ref().map(ToString::to_string),
            standard_cost: point.standard_cost.as_ref().map(ToString::to_string),
@@ -1150,6 +1160,7 @@ pub(crate) fn usage_insights_view(
        })
        .collect();
    UsageInsightsOverviewView {
+        analytics: analytics_view(insights.analytics, time),
        granularity: granularity_name(insights.granularity).to_owned(),
        health: OverviewHealthView {
            total_requests: insights.health.total_requests,
@@ -1270,7 +1281,7 @@ pub(crate) fn usage_insights_view(
            cache_hit_request_rate: insights.cost.cache_hit_request_rate,
            input_tokens: insights.cost.input_tokens,
            output_tokens: insights.cost.output_tokens,
-            cached_tokens: insights.cost.cached_tokens,
+            cached_input_tokens: insights.cost.cached_input_tokens,
            total_tokens: insights.cost.total_tokens,
            points: cost_points,
            costs: cost_views(&insights.cost.costs),
@@ -1302,8 +1313,10 @@ pub(crate) fn granularity_name(granularity: domain::Granularity) -> &'static str
 pub(crate) fn diagnostics_view(
    result: domain::DiagnosticsResult,
    dimension: DiagnosticDimension,
+    time: crate::time::TimePresenter,
 ) -> DiagnosticsView {
    DiagnosticsView {
+        analytics: analytics_view(result.analytics, time),
        dimension: dimension.display_name().to_owned(),
        items: result
            .items
@@ -1356,3 +1369,22 @@ pub(crate) fn map_wire_error(error: WireValidationError) -> AdminError {
 pub(crate) fn map_service_error(error: gateway_admin::model::AdminError) -> AdminError {
    map_admin_service_error(error)
 }
+
+pub(crate) fn analytics_view(
+    metadata: domain::AnalyticsMetadata,
+    time: crate::time::TimePresenter,
+) -> AnalyticsView {
+    AnalyticsView {
+        coverage_start: metadata.coverage_start,
+        coverage_start_display: metadata.coverage_start.map(|value| time.datetime(&value)),
+        coverage_end: metadata.coverage_end,
+        coverage_end_display: metadata.coverage_end.map(|value| time.datetime(&value)),
+        generated_at: metadata.generated_at,
+        generated_at_display: time.datetime(&metadata.generated_at),
+        lag_seconds: metadata.lag_seconds,
+        state: metadata.state.as_str().to_owned(),
+        percentiles_approximate: metadata.percentiles_approximate,
+        schema_version: metadata.schema_version,
+        histogram_version: metadata.histogram_version,
+    }
+}
@@ -29,6 +29,7 @@ impl DashboardQuery {
 #[derive(Clone, Default, Deserialize)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
 pub struct UsageQuery {
+    pub status: Option<String>,
    pub current_page: Option<u32>,
    pub page_size: Option<u16>,
    pub kind: Option<String>,
@@ -84,7 +85,6 @@ pub struct DiagnosticsQuery {
    pub provider: Option<String>,
    pub model: Option<String>,
    pub status_code: Option<i64>,
-    pub search: Option<String>,
 }

 impl DiagnosticsQuery {
@@ -314,6 +314,15 @@ pub(crate) fn usage_filter(query: &UsageQuery) -> Result<domain::UsageFilter, Wi
    })
 }

+pub(crate) fn analytics_filter(
+    query: &UsageQuery,
+) -> Result<domain::UsageFilter, WireValidationError> {
+    if query.search.is_some() {
+        return Err(WireValidationError::new("search"));
+    }
+    usage_filter(query)
+}
+
 pub(crate) fn usage_command(
    query: &UsageQuery,
    timezone: gateway_core::time::DeploymentTimeZone,
@@ -322,6 +331,12 @@ pub(crate) fn usage_command(
    let page_size_value =
        DomainPageSize::new(page_size).map_err(|_| WireValidationError::new("pageSize"))?;
    Ok(domain::UsageQuery {
+        status: match query.status.as_deref() {
+            None | Some("success") => domain::UsageRecordStatus::Success,
+            Some("error") => domain::UsageRecordStatus::Error,
+            Some("all") => domain::UsageRecordStatus::All,
+            Some(_) => return Err(WireValidationError::new("status")),
+        },
        range: usage_range(
            query.start_time.as_deref(),
            query.end_time.as_deref(),
@@ -29,6 +29,10 @@ where
            get(usage_insights_diagnostics::<S>),
        )
        .route("/api/admin/operations/errors", get(ops_errors::<S>))
+        .route(
+            "/api/admin/diagnostics/export",
+            get(super::export::download::<S>),
+        )
 }

 pub(crate) async fn dashboard_summary<S>(
@@ -151,7 +155,7 @@ where
        state.admin_services().timezone(),
    )
    .map_err(map_wire_error)?;
-    let filter = usage_filter(&query).map_err(map_wire_error)?;
+    let filter = analytics_filter(&query).map_err(map_wire_error)?;
    let result = state
        .admin_services()
        .observability()
@@ -160,7 +164,10 @@ where
        .map_err(map_service_error)?;
    Ok(AdminResponse::new(
        StatusCode::OK,
-        AdminEnvelope::ok(usage_summary_view(result)),
+        AdminEnvelope::ok(usage_summary_view(
+            result,
+            crate::time::TimePresenter::new(state.admin_services().timezone()),
+        )),
    ))
 }

@@ -181,7 +188,7 @@ where
        state.admin_services().timezone(),
    )
    .map_err(map_wire_error)?;
-    let filter = usage_filter(&query).map_err(map_wire_error)?;
+    let filter = analytics_filter(&query).map_err(map_wire_error)?;
    let result = state
        .admin_services()
        .observability()
@@ -215,7 +222,6 @@ where
        provider_kind: non_empty(query.provider),
        model: non_empty(query.model),
        status_code: parse_status(query.status_code).map_err(map_wire_error)?,
-        search: non_empty(query.search),
        ..domain::UsageFilter::default()
    };
    let result = state
@@ -226,7 +232,11 @@ where
        .map_err(map_service_error)?;
    Ok(AdminResponse::new(
        StatusCode::OK,
-        AdminEnvelope::ok(diagnostics_view(result, dimension)),
+        AdminEnvelope::ok(diagnostics_view(
+            result,
+            dimension,
+            crate::time::TimePresenter::new(state.admin_services().timezone()),
+        )),
    ))
 }

@@ -18,17 +18,17 @@ pub struct PageData<T> {
 pub struct TokenDetailsView {
    pub input_tokens: Option<u64>,
    pub output_tokens: Option<u64>,
-    pub cached_tokens: Option<u64>,
-    pub cache_write_tokens: Option<u64>,
-    pub reasoning_tokens: Option<u64>,
+    pub cached_input_tokens: Option<u64>,
+    pub cache_write_input_tokens: Option<u64>,
+    pub reasoning_output_tokens: Option<u64>,
    pub image_input_tokens: Option<u64>,
    pub image_output_tokens: Option<u64>,
    pub total_tokens: Option<u64>,
    pub input_tokens_display: String,
    pub output_tokens_display: String,
-    pub cached_tokens_display: String,
-    pub cache_write_tokens_display: String,
-    pub reasoning_tokens_display: String,
+    pub cached_input_tokens_display: String,
+    pub cache_write_input_tokens_display: String,
+    pub reasoning_output_tokens_display: String,
    pub image_input_tokens_display: String,
    pub image_output_tokens_display: String,
    pub total_tokens_display: String,
@@ -86,6 +86,7 @@ pub struct ImageBillingView {
 #[derive(Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct UsageListRecordView {
+    pub logical_outcome: String,
    pub client_api_key_name: Option<String>,
    pub id: String,
    pub provider: Option<String>,
@@ -162,9 +163,9 @@ pub struct UsageRecordView {
    pub latency_ms: Option<u64>,
    pub input_tokens: Option<u64>,
    pub output_tokens: Option<u64>,
-    pub cached_tokens: Option<u64>,
-    pub cache_write_tokens: Option<u64>,
-    pub reasoning_tokens: Option<u64>,
+    pub cached_input_tokens: Option<u64>,
+    pub cache_write_input_tokens: Option<u64>,
+    pub reasoning_output_tokens: Option<u64>,
    pub image_input_tokens: Option<u64>,
    pub image_output_tokens: Option<u64>,
    pub message: String,
@@ -258,7 +259,7 @@ pub struct UsageAttemptView {
    pub estimated_cost_currency: Option<String>,
    pub input_tokens: Option<u64>,
    pub output_tokens: Option<u64>,
-    pub cached_tokens: Option<u64>,
+    pub cached_input_tokens: Option<u64>,
    pub total_tokens: Option<u64>,
    pub first_token_ms: Option<u64>,
    pub latency_ms: Option<u64>,
@@ -275,8 +276,6 @@ pub struct UsageAttemptView {
 #[derive(Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct UsageRecordDetailView {
-    pub trace: Option<serde_json::Value>,
-    pub related_requests: Vec<serde_json::Value>,
    #[serde(flatten)]
    pub request: UsageRecordView,
    pub attempts: Vec<UsageAttemptView>,
@@ -288,6 +287,7 @@ pub struct UsageRecordDetailView {
 #[derive(Debug, Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct TrendData {
+    pub analytics: AnalyticsView,
    pub kind: TrendKind,
    pub points: Vec<TrendPointView>,
    pub summary: Vec<TrendSummaryView>,
@@ -306,8 +306,8 @@ pub struct TrendPointView {
    pub input_tokens_value: u64,
    pub output_tokens: String,
    pub output_tokens_value: u64,
-    pub cached_tokens: String,
-    pub cached_tokens_value: u64,
+    pub cached_input_tokens: String,
+    pub cached_input_tokens_value: u64,
    pub cache_hit_rate_value: f64,
    pub tokens_value: u64,
    pub errors: String,
@@ -388,7 +388,7 @@ pub struct DashboardCacheCardView {
    pub today_hit_rate_value: Option<f64>,
    pub yesterday_hit_rate_value: Option<f64>,
    pub total_hit_rate: String,
-    pub total_cached_tokens: String,
+    pub total_cached_input_tokens: String,
    pub average_first_token_latency_ms: String,
 }

@@ -446,9 +446,9 @@ pub struct RequestMetricsView {
    pub caller_error_count: u64,
    pub input_tokens: u64,
    pub output_tokens: u64,
-    pub cached_tokens: u64,
-    pub cache_write_tokens: u64,
-    pub reasoning_tokens: u64,
+    pub cached_input_tokens: u64,
+    pub cache_write_input_tokens: u64,
+    pub reasoning_output_tokens: u64,
    pub total_tokens: u64,
 }

@@ -575,6 +575,7 @@ impl From<domain::DesktopReleaseStatus> for DashboardDesktopReleaseStatusView {
 #[derive(Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct DashboardDataView {
+    pub analytics: AnalyticsView,
    pub as_of: DateTime<Utc>,
    pub as_of_display: String,
    pub cards: DashboardCardsView,
@@ -592,11 +593,12 @@ pub struct DashboardDataView {
 #[derive(Debug, Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct UsageSummaryView {
+    pub analytics: AnalyticsView,
    pub total_requests: String,
    pub input_tokens: String,
    pub output_tokens: String,
-    pub cached_tokens: String,
-    pub cache_write_tokens: String,
+    pub cached_input_tokens: String,
+    pub cache_write_input_tokens: String,
    pub total_tokens: String,
    pub average_latency_ms: String,
    pub logical_requests: RequestMetricsView,
@@ -693,7 +695,7 @@ pub struct OverviewCostPointView {
    pub label: String,
    pub input_tokens: u64,
    pub output_tokens: u64,
-    pub cached_tokens: u64,
+    pub cached_input_tokens: u64,
    pub total_tokens: u64,
    pub estimated_cost: Option<String>,
    pub standard_cost: Option<String>,
@@ -719,7 +721,7 @@ pub struct OverviewCostView {
    pub cache_hit_request_rate: Option<f64>,
    pub input_tokens: u64,
    pub output_tokens: u64,
-    pub cached_tokens: u64,
+    pub cached_input_tokens: u64,
    pub total_tokens: u64,
    pub points: Vec<OverviewCostPointView>,
    pub costs: Vec<CostView>,
@@ -741,6 +743,7 @@ pub struct ProviderOverviewView {
 #[derive(Debug, Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct UsageInsightsOverviewView {
+    pub analytics: AnalyticsView,
    pub granularity: String,
    pub health: OverviewHealthView,
    pub performance: OverviewPerformanceView,
@@ -778,6 +781,7 @@ pub struct DiagnosticItemView {
 #[derive(Debug, Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct DiagnosticsView {
+    pub analytics: AnalyticsView,
    pub dimension: String,
    pub items: Vec<DiagnosticItemView>,
 }
@@ -852,3 +856,20 @@ pub struct OpsErrorMetadataView {
    pub recovery_retry_delay_ms: Option<u64>,
    pub recovery_total_latency_ms: Option<u64>,
 }
+
+/// 统计覆盖、新鲜度与近似口径，时间文案使用部署时区
+#[derive(Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct AnalyticsView {
+    pub coverage_start: Option<DateTime<Utc>>,
+    pub coverage_start_display: Option<String>,
+    pub coverage_end: Option<DateTime<Utc>>,
+    pub coverage_end_display: Option<String>,
+    pub generated_at: DateTime<Utc>,
+    pub generated_at_display: String,
+    pub lag_seconds: u64,
+    pub state: String,
+    pub percentiles_approximate: bool,
+    pub schema_version: u32,
+    pub histogram_version: u32,
+}
@@ -53,8 +53,19 @@ pub(super) fn router<S: SessionState + Clone + Send + Sync + 'static>() -> Route
        .route("/api/admin/plugins/extensions/{instance_id}/{artifact_sha256}/{revision}/callback-tickets", post(start_callback::<S>))
        .route("/api/admin/plugins/extensions/{instance_id}/{artifact_sha256}/{revision}/api/{*path}", any(handle::<S>))
        .route("/api/admin/plugins/extensions/{instance_id}/{artifact_sha256}/{revision}/resources/{*path}", get(resource::<S>))
-        .route("/plugins/resources/{instance_id}/{artifact_sha256}/{revision}/{*path}", get(public_resource::<S>))
-        .route("/plugins/callbacks/{instance_id}/{artifact_sha256}/{revision}/{*path}", get(callback::<S>))
+}
+
+pub(in crate::admin) fn public_router<S: SessionState + Clone + Send + Sync + 'static>() -> Router<S>
+{
+    Router::new()
+        .route(
+            "/plugins/resources/{instance_id}/{artifact_sha256}/{revision}/{*path}",
+            get(public_resource::<S>),
+        )
+        .route(
+            "/plugins/callbacks/{instance_id}/{artifact_sha256}/{revision}/{*path}",
+            get(callback::<S>),
+        )
 }

 pub(in crate::admin) fn model_router() -> Router<crate::ApiState> {
@@ -5,7 +5,7 @@ mod distribution;
 mod instances;
 mod management;

-pub(super) use management::model_router;
+pub(super) use management::{model_router, public_router};

 #[derive(serde::Deserialize)]
 #[serde(deny_unknown_fields)]
@@ -60,6 +60,7 @@ struct CreateRequest {
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
 struct UpdateRequest {
+    enabled: Option<bool>,
    auto_location: Option<bool>,
    #[serde(default, deserialize_with = "deserialize_location_update")]
    location: Option<Option<gateway_core::account::RequestLocation>>,
@@ -145,6 +146,7 @@ struct ProxyAccountView {
 #[derive(Serialize)]
 #[serde(rename_all = "camelCase")]
 struct ProxyView {
+    enabled: bool,
    auto_location: bool,
    detected_location: Option<gateway_admin::model::proxies::DetectedProxyLocation>,
    location: Option<gateway_core::account::RequestLocation>,
@@ -168,6 +170,7 @@ impl From<(ProxyRecord, crate::time::TimePresenter)> for ProxyView {
        let endpoint = record.proxy.endpoint();
        Self {
            auto_location: record.auto_location,
+            enabled: record.enabled,
            detected_location: record.detected_location,
            location: record.location,
            id: record.id,
@@ -419,6 +422,7 @@ where
        .proxies()
        .update(
            UpdateProxy {
+                enabled: request.enabled,
                auto_location: request.auto_location,
                test: None,
                location: request.location,
@@ -36,12 +36,12 @@ pub type ProviderRequestProfileUpdates =
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct RuntimeSettingsFields {
+    pub codex_privacy_policy: gateway_core::settings::privacy::CodexPrivacyPolicy,
    pub request_location_enabled: bool,
    pub request_location: gateway_core::account::RequestLocation,
    pub refresh_margin_seconds: u64,
    pub refresh_concurrency: u64,
    pub max_concurrent_per_account: u64,
-    pub request_interval_ms: u64,
    pub max_waiting_per_key: u32,
    pub max_waiting_per_account: u32,
    pub concurrency_wait_timeout_seconds: u32,
@@ -283,6 +283,10 @@ where
            "/api/admin/settings/client-profiles/{provider}/preview",
            post(preview_client_profile::<S>),
        )
+        .route(
+            "/api/admin/settings/privacy/preview",
+            post(preview_privacy::<S>),
+        )
        .route("/api/admin/settings/update", post(update_settings::<S>))
        .route(
            "/api/admin/settings/client-downloads/codex-desktop/windows",
@@ -719,6 +723,7 @@ impl RuntimeSettingsFields {
        self,
    ) -> Result<gateway_admin::model::settings::RuntimeSettingsValues, WireValidationError> {
        let values = gateway_admin::model::settings::RuntimeSettingsValues {
+            codex_privacy_policy: self.codex_privacy_policy,
            request_location_enabled: self.request_location_enabled,
            request_location: self
                .request_location
@@ -729,7 +734,6 @@ impl RuntimeSettingsFields {
                .map_err(|_| WireValidationError::new("settingsRefreshConcurrencyOverflow"))?,
            max_concurrent_per_account: u32::try_from(self.max_concurrent_per_account)
                .map_err(|_| WireValidationError::new("settingsMaxConcurrencyOverflow"))?,
-            request_interval_ms: self.request_interval_ms,
            max_waiting_per_key: self.max_waiting_per_key,
            max_waiting_per_account: self.max_waiting_per_account,
            concurrency_wait_timeout_seconds: self.concurrency_wait_timeout_seconds,
@@ -767,12 +771,12 @@ impl RuntimeSettingsFields {
 impl From<gateway_admin::model::settings::RuntimeSettingsValues> for RuntimeSettingsFields {
    fn from(settings: gateway_admin::model::settings::RuntimeSettingsValues) -> Self {
        crate::admin::settings::RuntimeSettingsFields {
+            codex_privacy_policy: settings.codex_privacy_policy,
            request_location_enabled: settings.request_location_enabled,
            request_location: settings.request_location,
            refresh_margin_seconds: settings.refresh_margin_seconds,
            refresh_concurrency: u64::from(settings.refresh_concurrency),
            max_concurrent_per_account: u64::from(settings.max_concurrent_per_account),
-            request_interval_ms: settings.request_interval_ms,
            max_waiting_per_key: settings.max_waiting_per_key,
            max_waiting_per_account: settings.max_waiting_per_account,
            concurrency_wait_timeout_seconds: settings.concurrency_wait_timeout_seconds,
@@ -828,7 +832,6 @@ fn settings_validation_error(field: &'static str) -> WireValidationError {
        "ops_event_retention_days" => "opsEventRetentionDays",
        "refresh_concurrency" => "refreshConcurrency",
        "refresh_margin_seconds" => "refreshMarginSeconds",
-        "request_interval_ms" => "requestIntervalMs",
        "request_location" => "requestLocation",
        "request_location_enabled" => "requestLocationEnabled",
        "responses_max_decompressed_body_bytes" => "responsesMaxDecompressedBodyBytes",
@@ -837,3 +840,23 @@ fn settings_validation_error(field: &'static str) -> WireValidationError {
        _ => "settings",
    })
 }
+
+async fn preview_privacy<S>(
+    State(state): State<S>,
+    _auth: AdminAuth,
+    AdminJson(request): AdminJson<gateway_core::settings::privacy::PrivacyPreviewRequest>,
+) -> Result<impl IntoResponse, AdminError>
+where
+    S: SessionState + Send + Sync,
+{
+    let result = state
+        .admin_services()
+        .settings()
+        .preview_privacy_policy(request)
+        .await
+        .map_err(map_service_error)?;
+    Ok(AdminResponse::new(
+        StatusCode::OK,
+        AdminEnvelope::ok(result),
+    ))
+}
@@ -114,7 +114,6 @@ struct SystemUpdateDetailView {
    notes: Option<String>,
    cached: bool,
    update_supported: bool,
-    restart_confirmation_supported: bool,
    unsupported_reason: Option<String>,
    warning: Option<String>,
 }
@@ -134,7 +133,6 @@ impl From<SystemUpdateDetail> for SystemUpdateDetailView {
            notes: detail.notes,
            cached: detail.cached,
            update_supported: detail.update_supported,
-            restart_confirmation_supported: true,
            unsupported_reason: detail.unsupported_reason,
            warning: detail.warning,
        }
@@ -138,7 +138,9 @@ where
        .login(
            payload.into(),
            peer.ip(),
-            session_cookie::value(&headers).as_deref(),
+            session_cookie::refresh_value(&headers)
+                .or_else(|| session_cookie::value(&headers))
+                .as_deref(),
        )
        .await
        .map_err(map_login_error)?;
@@ -149,8 +151,7 @@ where
        )
        .into_response(),
        &headers,
-        &result.session_id,
-        &result.session,
+        &result,
    )
 }

@@ -177,16 +178,18 @@ async fn refresh_session<S>(
 where
    S: SessionState + Send + Sync,
 {
-    let session_id = session_cookie::value(&headers);
-    let session = state
+    let grant = state
        .admin_services()
        .auth()
-        .renew_session(session_id.as_deref())
+        .renew_session(
+            session_cookie::refresh_value(&headers).as_deref(),
+            session_cookie::value(&headers).as_deref(),
+        )
        .await
        .map_err(map_admin_service_error)?;
-    let response = session_response(session.as_ref());
-    if let (Some(session_id), Some(session)) = (session_id, session) {
-        return set_session_cookie(response, &headers, &session_id, &session);
+    let response = session_response(grant.as_ref().map(|grant| &grant.session));
+    if let Some(grant) = grant {
+        return set_session_cookie(response, &headers, &grant);
    }
    // 失效响应不清 Cookie，避免晚到的请求覆盖另一个标签页刚建立的会话
    Ok(response)
@@ -206,32 +209,72 @@ fn session_response(session: Option<&AuthSession>) -> Response {
 fn set_session_cookie(
    mut response: Response,
    headers: &HeaderMap,
-    session_id: &str,
-    session: &AuthSession,
+    grant: &gateway_admin::model::auth::SessionGrant,
 ) -> Result<Response, AdminError> {
-    let max_age = session
-        .expires_at
-        .signed_duration_since(chrono::Utc::now())
-        .num_seconds()
-        .max(1);
-    let expires = session.expires_at.format("%a, %d %b %Y %H:%M:%S GMT");
-    let cookie = format!(
-        "{}={session_id}; {}; Max-Age={max_age}; Expires={expires}",
+    append_cookie(
+        &mut response,
+        headers,
        session_cookie::NAME,
-        session_cookie::attributes(headers)
-    );
-    response.headers_mut().insert(
-        header::SET_COOKIE,
-        HeaderValue::from_str(&cookie).map_err(|_| AdminError::internal())?,
-    );
+        &grant.session_id,
+        Some(grant.session.expires_at),
+    )?;
+    append_cookie(
+        &mut response,
+        headers,
+        session_cookie::REFRESH_NAME,
+        grant.refresh_token.as_deref().unwrap_or_default(),
+        grant
+            .session
+            .renewal
+            .as_ref()
+            .map(|renewal| renewal.expires_at),
+    )?;
    Ok(response)
 }

+fn append_cookie(
+    response: &mut Response,
+    headers: &HeaderMap,
+    name: &str,
+    value: &str,
+    expires_at: Option<chrono::DateTime<chrono::Utc>>,
+) -> Result<(), AdminError> {
+    let attributes = session_cookie::attributes(headers);
+    let path = if name == session_cookie::REFRESH_NAME {
+        "/api/auth"
+    } else {
+        "/"
+    };
+    let lifetime = expires_at.map_or_else(
+        || "Max-Age=0".to_owned(),
+        |expiry| {
+            format!(
+                "Max-Age={}; Expires={}",
+                expiry
+                    .signed_duration_since(chrono::Utc::now())
+                    .num_seconds()
+                    .max(1),
+                expiry.format("%a, %d %b %Y %H:%M:%S GMT")
+            )
+        },
+    );
+    response.headers_mut().append(
+        header::SET_COOKIE,
+        HeaderValue::from_str(&format!(
+            "{name}={value}; Path={path}; {attributes}; {lifetime}"
+        ))
+        .map_err(|_| AdminError::internal())?,
+    );
+    Ok(())
+}
+
 async fn logout<S>(State(state): State<S>, headers: HeaderMap) -> Result<Response, AdminError>
 where
    S: SessionState + Send + Sync,
 {
-    if let Some(session_id) = session_cookie::value(&headers) {
+    if let Some(session_id) =
+        session_cookie::refresh_value(&headers).or_else(|| session_cookie::value(&headers))
+    {
        state
            .admin_services()
            .auth()
@@ -285,15 +328,9 @@ fn clear_session_cookie(
    mut response: Response,
    headers: &HeaderMap,
 ) -> Result<Response, AdminError> {
-    let cookie = format!(
-        "{}=; {}; Max-Age=0",
-        session_cookie::NAME,
-        session_cookie::attributes(headers)
-    );
-    response.headers_mut().insert(
-        header::SET_COOKIE,
-        HeaderValue::from_str(&cookie).map_err(|_| AdminError::internal())?,
-    );
+    for name in [session_cookie::NAME, session_cookie::REFRESH_NAME] {
+        append_cookie(&mut response, headers, name, "", None)?;
+    }
    Ok(response)
 }

@@ -49,6 +49,7 @@ pub(super) fn config(secret: ClientKeySecret) -> ConfigView {
 #[derive(Serialize)]
 #[serde(rename_all = "camelCase")]
 pub(super) struct OverviewView {
+    analytics: crate::admin::observability::AnalyticsView,
    as_of: DateTime<Utc>,
    as_of_display: String,
    start_time: DateTime<Utc>,
@@ -82,9 +83,9 @@ struct MetricsView {
    requests: u64,
    input_tokens: u64,
    output_tokens: u64,
-    cached_tokens: u64,
-    cache_write_tokens: u64,
-    reasoning_tokens: u64,
+    cached_input_tokens: u64,
+    cache_write_input_tokens: u64,
+    reasoning_output_tokens: u64,
    total_tokens: u64,
    cost_usd: Option<String>,
    cost_incomplete: bool,
@@ -95,9 +96,9 @@ fn metrics(value: &RequestMetrics, costs: &[CurrencyCost], coverage: &CostCovera
        requests: value.request_count,
        input_tokens: value.input_tokens,
        output_tokens: value.output_tokens,
-        cached_tokens: value.cached_tokens,
-        cache_write_tokens: value.cache_write_tokens,
-        reasoning_tokens: value.reasoning_tokens,
+        cached_input_tokens: value.cached_input_tokens,
+        cache_write_input_tokens: value.cache_write_input_tokens,
+        reasoning_output_tokens: value.reasoning_output_tokens,
        total_tokens: value.total_tokens,
        cost_usd: costs
            .iter()
@@ -121,6 +122,10 @@ struct TrendPointView {
 pub(super) fn overview(value: KeyUsageOverview, time: crate::time::TimePresenter) -> OverviewView {
    let key = value.key;
    OverviewView {
+        analytics: crate::admin::observability::analytics_view(
+            value.overview.analytics.clone(),
+            time,
+        ),
        as_of: value.overview.range.end,
        as_of_display: time.time(&value.overview.range.end),
        start_time: value.overview.range.start,
@@ -17,9 +17,10 @@ use axum::{
    http::{HeaderName, HeaderValue, Request, StatusCode},
    response::{IntoResponse as _, Response},
 };
-use gateway_core::engine::middleware::FrozenMiddlewarePlan;
 use gateway_core::engine::middleware::http as contract;
 use gateway_core::engine::middleware::http::Settings;
+use gateway_core::engine::middleware::{FrozenMiddlewarePlan, MiddlewareError};
+use gateway_core::error::GatewayErrorKind;
 use gateway_core::lifecycle::CancellationToken;
 use gateway_core::middleware::compose;
 use http_body::{Body as HttpBody, Frame, SizeHint};
@@ -228,6 +229,8 @@ async fn handle(
            Ok(response.map(|body| body.map_err(|error| Box::new(error) as _).boxed_unsync()))
        })
    });
+    let request_id = context.request_id.clone();
+    let call_id = context.call_id.clone();
    let result = match plan {
        Some(plan) => plan.handle_http(context, request, next).await,
        None => next.run(request).await,
@@ -251,12 +254,28 @@ async fn handle(
                    tokio::select! {
                        biased;
                        () = cancellation.cancelled() => {},
-                        _ = task => {},
+                        result = task => {
+                            if let Err(contract::upgrade::SessionError::Failed { kind, plugin_instance_id }) = result {
+                                tracing::warn!(
+                                    event = "middleware.session.failed",
+                                    request_id,
+                                    call_id,
+                                    plugin_instance_id,
+                                    kind,
+                                    "升级后的中间件会话失败"
+                                );
+                            }
+                        },
                    }
                });
            }
            response.map(|body| Body::new(ResponseBody::new(body, guard)))
        }
+        Err(MiddlewareError::Gateway(error))
+            if error.kind() == GatewayErrorKind::MiddlewareCapacityUnavailable =>
+        {
+            crate::openai::error::gateway_error_response(&error)
+        }
        Err(error) => {
            let status = if error.is_rejected() {
                StatusCode::FORBIDDEN
--- a/Show More
+++ b/Show More