chore(release): v3.26.2

Co-authored-by: Codex <noreply@openai.com>

backend/Cargo.lock

@@ -1681,6 +1681,7 @@ dependencies = [
  "gateway-core",
  "heck",
  "hex",
+ "hkdf",
  "prettyplease",
  "quote",
  "rand_core 0.6.4",

backend/crates/gateway-admin/Cargo.toml

@@ -21,6 +21,7 @@ futures = "0.3.32"
 gateway-core = { path = "../gateway-core" }
 heck = "0.5.0"
 hex = "0.4.3"
+hkdf = "0.13.0"
 rand_core = { version = "0.6.4", features = ["getrandom"] }
 serde = { version = "1.0.228", features = ["derive"] }
 serde_json = { version = "1.0.150", features = ["arbitrary_precision", "preserve_order"] }

backend/crates/gateway-admin/src/lib.rs

@@ -405,9 +405,7 @@ async fn initialize_inner(
     let registry = providers;
 
     let auth = Arc::new(DefaultAuthService::new(
-        config.default_username,
-        config.session_ttl_minutes,
-        config.session_absolute_ttl_minutes,
+        &config,
         client_config.session_ttl_minutes,
         store.auth(),
         client_key_verifier.clone(),

backend/crates/gateway-admin/src/model/auth.rs

@@ -76,18 +76,23 @@ impl std::fmt::Debug for LoginCommand {
     }
 }
 
-/// 登录成功后返回的会话事实
+/// 登录或刷新后仅向当前浏览器交付的会话凭据
 #[derive(Clone, PartialEq, Eq)]
-pub struct LoginResult {
+pub struct SessionGrant {
     pub session_id: String,
+    pub refresh_token: Option<String>,
     pub session: AuthSession,
 }
 
-impl std::fmt::Debug for LoginResult {
+impl std::fmt::Debug for SessionGrant {
     fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         formatter
-            .debug_struct("LoginResult")
+            .debug_struct("SessionGrant")
             .field("session_id", &"[REDACTED]")
+            .field(
+                "refresh_token",
+                &self.refresh_token.as_ref().map(|_| "[REDACTED]"),
+            )
             .field("session", &self.session)
             .finish()
     }
@@ -138,12 +143,41 @@ impl std::fmt::Debug for ChangePassword {
     }
 }
 
-/// 会话有效期与管理员续期上限；没有上限字段的旧会话保持固定有效期
+/// 访问有效期与逻辑会话；没有续期凭据的会话保持固定期限
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct AuthSession {
     pub subject: SessionSubject,
     pub expires_at: DateTime<Utc>,
     pub absolute_expires_at: Option<DateTime<Utc>>,
+    pub renewal: Option<SessionRenewal>,
+}
+
+/// 长效登录的凭据摘要与续期窗口；访问到期不删除整段登录
+#[derive(Debug, Clone, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct SessionRenewal {
+    pub expires_at: DateTime<Utc>,
+    pub access_digest: [u8; 32],
+    pub refresh_digest: [u8; 32],
+    pub previous: Option<SessionRefreshReplay>,
+}
+
+/// 仅保存上一代摘要及派生盐；响应丢失时须持有上一代凭据才能重建同一响应
+#[derive(Debug, Clone, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct SessionRefreshReplay {
+    pub digest: [u8; 32],
+    pub salt: [u8; 32],
+    pub expires_at: DateTime<Utc>,
+}
+
+impl AuthSession {
+    #[must_use]
+    pub fn retained_until(&self) -> DateTime<Utc> {
+        self.renewal
+            .as_ref()
+            .map_or(self.expires_at, |renewal| renewal.expires_at)
+    }
 }
 
 /// 安全审计事件类型

backend/crates/gateway-admin/src/ports/store.rs

@@ -294,12 +294,12 @@ pub trait AuthStore: Send + Sync {
 
     async fn store_session(&self, session_id: &str, session: &AuthSession) -> AdminStoreResult<()>;
 
-    /// 只延长仍存在且匹配的会话；并发续期返回当前值，已退出或过期时不重建
-    async fn renew_session(
+    /// 原子替换或撤销仍匹配的会话并返回当前值；过期或退出后不重新创建
+    async fn compare_exchange_session(
         &self,
         session_id: &str,
         expected: &AuthSession,
-        expires_at: chrono::DateTime<chrono::Utc>,
+        replacement: Option<&AuthSession>,
     ) -> AdminStoreResult<Option<AuthSession>>;
 
     async fn delete_session(&self, session_id: &str) -> AdminStoreResult<Option<AuthSession>>;

backend/crates/gateway-admin/src/use_case/auth/mod.rs

@@ -0,0 +1,139 @@
+//! 控制面认证端口、会话策略与访问和续期共用的身份校验
+
+use std::{net::IpAddr, sync::Arc};
+
+use async_trait::async_trait;
+use base64::{Engine as _, engine::general_purpose::URL_SAFE_NO_PAD};
+use chrono::{Duration, Utc};
+use gateway_core::engine::execution::ClientKeyVerifier;
+use sha2::{Digest as _, Sha256};
+
+use super::map_store_error;
+use crate::{
+    model::{
+        AdminError,
+        auth::{
+            AuthSession, ChangePassword, LoginCommand, LoginError, SessionGrant, SessionSubject,
+        },
+    },
+    ports::store::AuthStore,
+};
+
+mod service;
+mod session;
+
+/// 所有控制面接口消费同一个会话服务，权限由服务端身份决定
+#[async_trait]
+pub trait AuthService: Send + Sync {
+    async fn change_password(
+        &self,
+        session_id: Option<&str>,
+        command: ChangePassword,
+        source_ip: IpAddr,
+    ) -> Result<(), AdminError>;
+    async fn ensure_default_admin(&self, password: &str) -> Result<bool, AdminError>;
+    async fn session(&self, session_id: Option<&str>) -> Result<Option<AuthSession>, AdminError>;
+    async fn renew_session(
+        &self,
+        refresh_token: Option<&str>,
+        access_token: Option<&str>,
+    ) -> Result<Option<SessionGrant>, AdminError>;
+    async fn resolve_admin_user_id(
+        &self,
+        session_id: Option<&str>,
+    ) -> Result<Option<String>, AdminError>;
+    async fn verify_admin_api_key(&self, key: &str) -> Result<bool, AdminError>;
+    async fn login(
+        &self,
+        command: LoginCommand,
+        source_ip: IpAddr,
+        previous_session_id: Option<&str>,
+    ) -> Result<SessionGrant, LoginError>;
+    async fn logout(&self, session_id: &str) -> Result<(), AdminError>;
+}
+
+const MAX_SESSION_TTL_MINUTES: i64 = 366 * 24 * 60;
+
+pub(crate) struct DefaultAuthService {
+    default_admin_user_id: String,
+    admin_access_ttl: Duration,
+    admin_session_ttl: Duration,
+    admin_session_absolute_ttl: Duration,
+    key_session_ttl: Duration,
+    store: Arc<dyn AuthStore>,
+    verifier: Arc<dyn ClientKeyVerifier>,
+}
+
+impl DefaultAuthService {
+    #[must_use]
+    pub(crate) fn new(
+        config: &crate::AdminConfig,
+        key_session_ttl_minutes: u64,
+        store: Arc<dyn AuthStore>,
+        verifier: Arc<dyn ClientKeyVerifier>,
+    ) -> Self {
+        let admin_session_ttl = session_ttl(config.session_ttl_minutes);
+        Self {
+            default_admin_user_id: config.default_username.clone(),
+            // 访问凭据最多有效 24 小时，较短的不活动期限也要留出续期窗口
+            admin_access_ttl: Duration::hours(24).min(admin_session_ttl / 4),
+            admin_session_ttl,
+            admin_session_absolute_ttl: session_ttl(config.session_absolute_ttl_minutes),
+            key_session_ttl: session_ttl(key_session_ttl_minutes),
+            store,
+            verifier,
+        }
+    }
+
+    async fn load_live_session(&self, id: &str) -> Result<Option<AuthSession>, AdminError> {
+        let Some(session) = self
+            .store
+            .load_session(id)
+            .await
+            .map_err(|error| map_store_error(error, "authentication session"))?
+        else {
+            return Ok(None);
+        };
+        if session.retained_until() <= Utc::now()
+            || session
+                .absolute_expires_at
+                .is_some_and(|expiry| expiry <= Utc::now())
+        {
+            return Ok(None);
+        }
+        let valid = match &session.subject {
+            SessionSubject::Admin {
+                admin_user_id,
+                credential_fingerprint,
+            } => self
+                .store
+                .load_password_hash(admin_user_id)
+                .await
+                .map_err(|error| map_store_error(error, "administrator session"))?
+                .is_some_and(|hash| password_fingerprint(&hash) == *credential_fingerprint),
+            SessionSubject::Key { client_key_id } => self
+                .store
+                .client_key_enabled(client_key_id)
+                .await
+                .map_err(|error| map_store_error(error, "session key"))?,
+        };
+        if !valid {
+            let _ = self.store.delete_session(id).await;
+            return Ok(None);
+        }
+        Ok(Some(session))
+    }
+}
+
+fn session_ttl(minutes: u64) -> Duration {
+    Duration::minutes(
+        i64::try_from(minutes)
+            .unwrap_or(MAX_SESSION_TTL_MINUTES)
+            .clamp(1, MAX_SESSION_TTL_MINUTES),
+    )
+}
+
+// 指纹只绑定已加盐的密码哈希，不把密码或原始哈希复制到 Redis 会话
+fn password_fingerprint(password_hash: &str) -> String {
+    URL_SAFE_NO_PAD.encode(Sha256::digest(password_hash.as_bytes()))
+}

backend/crates/gateway-admin/src/use_case/auth/service.rs

@@ -1,93 +1,35 @@
-//! 控制面登录、会话恢复与身份校验的唯一 owner
+//! 管理员和 Key 的登录、退出、密码策略与会话访问
 
-use std::{net::IpAddr, sync::Arc, time::Duration as StdDuration};
+use std::{net::IpAddr, time::Duration as StdDuration};
 
 use argon2::{Argon2, PasswordHash, PasswordHasher, PasswordVerifier};
 use async_trait::async_trait;
 use base64::{Engine as _, engine::general_purpose::URL_SAFE_NO_PAD};
-use chrono::{Duration, Utc};
-use gateway_core::engine::execution::ClientKeyVerifier;
+use chrono::Utc;
 use rand_core::{OsRng, RngCore as _};
-use sha2::{Digest, Sha256};
 use subtle::ConstantTimeEq as _;
 use uuid::Uuid;
 
+use super::{
+    AuthService, DefaultAuthService, password_fingerprint,
+    session::{self, Credential, storage_id},
+};
 use crate::{
     model::{
         AdminError, AdminErrorKind,
         auth::{
             AdminAuditEvent, AuditActorKind, AuthSession, ChangePassword, LoginCommand, LoginError,
-            LoginResult, SessionSubject,
+            SessionGrant, SessionSubject,
         },
     },
-    ports::store::AuthStore,
+    use_case::map_store_error,
 };
 
-use super::map_store_error;
-
-/// 所有控制面接口消费同一个会话服务，权限由服务端身份决定
-#[async_trait]
-pub trait AuthService: Send + Sync {
-    async fn change_password(
-        &self,
-        session_id: Option<&str>,
-        command: ChangePassword,
-        source_ip: IpAddr,
-    ) -> Result<(), AdminError>;
-    async fn ensure_default_admin(&self, password: &str) -> Result<bool, AdminError>;
-    async fn session(&self, session_id: Option<&str>) -> Result<Option<AuthSession>, AdminError>;
-    async fn renew_session(
-        &self,
-        session_id: Option<&str>,
-    ) -> Result<Option<AuthSession>, AdminError>;
-    async fn resolve_admin_user_id(
-        &self,
-        session_id: Option<&str>,
-    ) -> Result<Option<String>, AdminError>;
-    async fn verify_admin_api_key(&self, key: &str) -> Result<bool, AdminError>;
-    async fn login(
-        &self,
-        command: LoginCommand,
-        source_ip: IpAddr,
-        previous_session_id: Option<&str>,
-    ) -> Result<LoginResult, LoginError>;
-    async fn logout(&self, session_id: &str) -> Result<(), AdminError>;
-}
-
-const MAX_SESSION_TTL_MINUTES: i64 = 366 * 24 * 60;
 const LOGIN_WINDOW: StdDuration = StdDuration::from_secs(60);
 const LOGIN_ATTEMPTS_PER_SOURCE: u32 = 10;
 const LOGIN_ATTEMPTS_GLOBAL: u32 = 200;
 
-pub(crate) struct DefaultAuthService {
-    default_admin_user_id: String,
-    admin_session_ttl: Duration,
-    admin_session_absolute_ttl: Duration,
-    key_session_ttl: Duration,
-    store: Arc<dyn AuthStore>,
-    verifier: Arc<dyn ClientKeyVerifier>,
-}
-
 impl DefaultAuthService {
-    #[must_use]
-    pub(crate) fn new(
-        default_admin_user_id: impl Into<String>,
-        admin_session_ttl_minutes: u64,
-        admin_session_absolute_ttl_minutes: u64,
-        key_session_ttl_minutes: u64,
-        store: Arc<dyn AuthStore>,
-        verifier: Arc<dyn ClientKeyVerifier>,
-    ) -> Self {
-        Self {
-            default_admin_user_id: default_admin_user_id.into(),
-            admin_session_ttl: session_ttl(admin_session_ttl_minutes),
-            admin_session_absolute_ttl: session_ttl(admin_session_absolute_ttl_minutes),
-            key_session_ttl: session_ttl(key_session_ttl_minutes),
-            store,
-            verifier,
-        }
-    }
-
     fn auth_audit(&self, action: &str, admin_user_id: &str) -> AdminAuditEvent {
         AdminAuditEvent {
             id: format!("audit_{}", Uuid::now_v7().simple()),
@@ -228,50 +170,23 @@ impl AuthService for DefaultAuthService {
     }
 
     async fn session(&self, session_id: Option<&str>) -> Result<Option<AuthSession>, AdminError> {
-        let Some(session_id) = session_id.filter(|value| !value.is_empty()) else {
+        let Some(raw) = session_id.filter(|value| !value.is_empty()) else {
             return Ok(None);
         };
-        let Some(session) = self
-            .store
-            .load_session(session_id)
-            .await
-            .map_err(|error| map_store_error(error, "authentication session"))?
-        else {
+        let Some(session) = self.load_live_session(storage_id(raw)).await? else {
             return Ok(None);
         };
-        if session.expires_at <= Utc::now()
-            || session
-                .absolute_expires_at
-                .is_some_and(|expiry| expiry <= Utc::now())
-        {
-            // Redis 的 TTL 负责过期清理，避免旧读取删除另一个请求刚续期的会话
+        if session.expires_at <= Utc::now() {
             return Ok(None);
         }
-        if let SessionSubject::Admin {
-            admin_user_id,
-            credential_fingerprint,
-        } = &session.subject
-        {
-            let password_hash = self
-                .store
-                .load_password_hash(admin_user_id)
-                .await
-                .map_err(|error| map_store_error(error, "administrator session"))?;
-            if password_hash
-                .is_none_or(|hash| password_fingerprint(&hash) != *credential_fingerprint)
-            {
-                let _ = self.store.delete_session(session_id).await;
+        if let Some(renewal) = &session.renewal {
+            let Some(credential) = Credential::parse(raw).filter(|value| !value.refresh) else {
+                return Ok(None);
+            };
+            if !credential.owns(renewal) {
                 return Ok(None);
             }
-        }
-        if let SessionSubject::Key { client_key_id } = &session.subject
-            && !self
-                .store
-                .client_key_enabled(client_key_id)
-                .await
-                .map_err(|error| map_store_error(error, "session key"))?
-        {
-            let _ = self.store.delete_session(session_id).await;
+        } else if Credential::parse(raw).is_some() {
             return Ok(None);
         }
         Ok(Some(session))
@@ -279,33 +194,25 @@ impl AuthService for DefaultAuthService {
 
     async fn renew_session(
         &self,
-        session_id: Option<&str>,
-    ) -> Result<Option<AuthSession>, AdminError> {
-        let Some(session_id) = session_id else {
-            return Ok(None);
-        };
-        let Some(session) = self.session(Some(session_id)).await? else {
-            return Ok(None);
-        };
-        // Key 与升级前的会话保留原有期限，不能凭续期获得新的最长登录窗口
-        let Some(absolute) = session
-            .absolute_expires_at
-            .filter(|_| matches!(session.subject, SessionSubject::Admin { .. }))
-        else {
-            return Ok(Some(session));
-        };
-        let now = Utc::now();
-        let expires_at = (now + self.admin_session_ttl).min(absolute);
-        let interval = (self.admin_session_ttl / 4).min(Duration::minutes(1));
-        if expires_at <= session.expires_at
-            || session.expires_at - now > self.admin_session_ttl - interval
-        {
-            return Ok(Some(session));
+        refresh_token: Option<&str>,
+        access_token: Option<&str>,
+    ) -> Result<Option<SessionGrant>, AdminError> {
+        if let Some(refresh) = refresh_token {
+            return self.refresh(refresh).await;
         }
-        self.store
-            .renew_session(session_id, &session, expires_at)
-            .await
-            .map_err(|error| map_store_error(error, "authentication session renewal"))
+        // Key 与升级前的单凭据仅返回仍有效的原会话，不授予新的续期能力
+        let Some(session) = self
+            .session(access_token)
+            .await?
+            .filter(|session| session.renewal.is_none())
+        else {
+            return Ok(None);
+        };
+        Ok(Some(SessionGrant {
+            session_id: access_token.unwrap_or_default().to_owned(),
+            refresh_token: None,
+            session,
+        }))
     }
 
     async fn resolve_admin_user_id(
@@ -346,7 +253,7 @@ impl AuthService for DefaultAuthService {
         command: LoginCommand,
         source_ip: IpAddr,
         previous_session_id: Option<&str>,
-    ) -> Result<LoginResult, LoginError> {
+    ) -> Result<SessionGrant, LoginError> {
         if let Some(retry_after) = self
             .store
             .consume_login_attempt(
@@ -370,14 +277,31 @@ impl AuthService for DefaultAuthService {
         let now = Utc::now();
         let absolute_expires_at = matches!(subject, SessionSubject::Admin { .. })
             .then_some(now + self.admin_session_absolute_ttl);
-        let session = AuthSession {
-            subject,
-            expires_at: (now + ttl).min(absolute_expires_at.unwrap_or(now + ttl)),
-            absolute_expires_at,
+        let refresh_expiry = (now + ttl).min(absolute_expires_at.unwrap_or(now + ttl));
+        let grant = if let Some(absolute) = absolute_expires_at {
+            session::issue(
+                subject,
+                (now + self.admin_access_ttl).min(refresh_expiry),
+                refresh_expiry,
+                absolute,
+            )
+            .map_err(|_| LoginError::Unavailable)?
+        } else {
+            SessionGrant {
+                session_id: random_session_token(),
+                refresh_token: None,
+                session: AuthSession {
+                    subject,
+                    expires_at: refresh_expiry,
+                    absolute_expires_at: None,
+                    renewal: None,
+                },
+            }
         };
-        let session_id = random_session_token();
+        let session_id = storage_id(&grant.session_id);
+        let session = &grant.session;
         self.store
-            .store_session(&session_id, &session)
+            .store_session(session_id, session)
             .await
             .map_err(|_| LoginError::Unavailable)?;
         if let SessionSubject::Admin { admin_user_id, .. } = &session.subject
@@ -387,26 +311,39 @@ impl AuthService for DefaultAuthService {
                 .await
                 .is_err()
         {
-            let _ = self.store.delete_session(&session_id).await;
+            let _ = self.store.delete_session(session_id).await;
             return Err(LoginError::Unavailable);
         }
         // 新身份验证成功后才撤销旧会话；撤销失败时不向浏览器提交新会话
         if let Some(previous) = previous_session_id.filter(|value| !value.is_empty())
             && self.logout(previous).await.is_err()
         {
-            let _ = self.store.delete_session(&session_id).await;
+            let _ = self.store.delete_session(session_id).await;
             return Err(LoginError::Unavailable);
         }
-        Ok(LoginResult {
-            session_id,
-            session,
-        })
+        Ok(grant)
     }
 
     async fn logout(&self, session_id: &str) -> Result<(), AdminError> {
+        let id = storage_id(session_id);
+        let Some(stored) = self
+            .store
+            .load_session(id)
+            .await
+            .map_err(|error| map_store_error(error, "authentication session"))?
+        else {
+            return Ok(());
+        };
+        if let Some(renewal) = &stored.renewal {
+            if !Credential::parse(session_id).is_some_and(|credential| credential.owns(renewal)) {
+                return Ok(());
+            }
+        } else if Credential::parse(session_id).is_some() {
+            return Ok(());
+        }
         let session = self
             .store
-            .delete_session(session_id)
+            .delete_session(id)
             .await
             .map_err(|error| map_store_error(error, "authentication session"))?;
         if let Some(AuthSession {
@@ -423,14 +360,6 @@ impl AuthService for DefaultAuthService {
     }
 }
 
-fn session_ttl(minutes: u64) -> Duration {
-    Duration::minutes(
-        i64::try_from(minutes)
-            .unwrap_or(MAX_SESSION_TTL_MINUTES)
-            .clamp(1, MAX_SESSION_TTL_MINUTES),
-    )
-}
-
 fn validate_new_password(password: &str) -> Result<(), AdminError> {
     if password.trim().chars().count() < 12
         || password.len() > 1024
@@ -470,8 +399,3 @@ fn valid_admin_api_key_shape(value: &str) -> bool {
         && value.starts_with("admin-")
         && value[6..].bytes().all(|byte| byte.is_ascii_hexdigit())
 }
-
-// 指纹只绑定已加盐的密码哈希，不把密码或原始哈希复制到 Redis 会话
-fn password_fingerprint(password_hash: &str) -> String {
-    URL_SAFE_NO_PAD.encode(Sha256::digest(password_hash.as_bytes()))
-}

backend/crates/gateway-admin/src/use_case/auth/session.rs

@@ -0,0 +1,214 @@
+//! 双凭据会话的签发、摘要校验与短窗口重试，不持久化可直接使用的凭据
+
+use base64::{Engine as _, engine::general_purpose::URL_SAFE_NO_PAD};
+use chrono::{DateTime, Duration, Utc};
+use rand_core::{OsRng, RngCore as _};
+use sha2::{Digest as _, Sha256};
+use subtle::ConstantTimeEq as _;
+
+use super::DefaultAuthService;
+use crate::{
+    model::{
+        AdminError, AdminErrorKind,
+        auth::{AuthSession, SessionGrant, SessionRefreshReplay, SessionRenewal, SessionSubject},
+    },
+    use_case::map_store_error,
+};
+
+const REPLAY_WINDOW: Duration = Duration::seconds(30);
+
+pub(super) struct Credential<'a> {
+    pub id: &'a str,
+    pub secret: &'a str,
+    pub refresh: bool,
+}
+
+impl<'a> Credential<'a> {
+    pub fn parse(value: &'a str) -> Option<Self> {
+        let mut parts = value.split('.');
+        let refresh = match parts.next()? {
+            "a2" => false,
+            "r2" => true,
+            _ => return None,
+        };
+        let id = parts.next()?;
+        let secret = parts.next()?;
+        if parts.next().is_some() || !valid_secret(id) || !valid_secret(secret) {
+            return None;
+        }
+        Some(Self {
+            id,
+            secret,
+            refresh,
+        })
+    }
+
+    pub fn digest(&self) -> [u8; 32] {
+        digest(self.secret)
+    }
+
+    pub fn owns(&self, renewal: &SessionRenewal) -> bool {
+        if self.refresh {
+            matches_digest(&renewal.refresh_digest, &self.digest())
+                || renewal
+                    .previous
+                    .as_ref()
+                    .is_some_and(|previous| matches_digest(&previous.digest, &self.digest()))
+        } else {
+            matches_digest(&renewal.access_digest, &self.digest())
+        }
+    }
+}
+
+fn valid_secret(value: &str) -> bool {
+    value.len() == 43
+        && URL_SAFE_NO_PAD
+            .decode(value)
+            .is_ok_and(|bytes| bytes.len() == 32)
+}
+
+pub(super) fn storage_id(value: &str) -> &str {
+    Credential::parse(value).map_or(value, |credential| credential.id)
+}
+
+fn matches_digest(left: &[u8; 32], right: &[u8; 32]) -> bool {
+    bool::from(left.ct_eq(right))
+}
+
+fn digest(secret: &str) -> [u8; 32] {
+    Sha256::digest(secret.as_bytes()).into()
+}
+
+fn random_bytes() -> [u8; 32] {
+    let mut bytes = [0; 32];
+    OsRng.fill_bytes(&mut bytes);
+    bytes
+}
+
+// 使用标准 HKDF 的独立用途标签；只有盐和摘要留在 Store，重试仍须持有原始凭据
+fn derive(secret: &str, salt: Option<&[u8]>, purpose: &[u8]) -> Result<String, AdminError> {
+    let mut output = [0; 32];
+    hkdf::Hkdf::<Sha256>::new(salt, secret.as_bytes())
+        .expand(purpose, &mut output)
+        .map_err(|_| AdminError::internal("会话凭据派生失败"))?;
+    Ok(URL_SAFE_NO_PAD.encode(output))
+}
+
+fn access_secret(refresh: &str) -> Result<String, AdminError> {
+    derive(refresh, None, b"cpr-session-v2/access")
+}
+
+pub(super) fn issue(
+    subject: SessionSubject,
+    access_expiry: DateTime<Utc>,
+    refresh_expiry: DateTime<Utc>,
+    absolute: DateTime<Utc>,
+) -> Result<SessionGrant, AdminError> {
+    let id = URL_SAFE_NO_PAD.encode(random_bytes());
+    let secret = URL_SAFE_NO_PAD.encode(random_bytes());
+    let session = AuthSession {
+        subject,
+        expires_at: access_expiry,
+        absolute_expires_at: Some(absolute),
+        renewal: Some(SessionRenewal {
+            expires_at: refresh_expiry,
+            access_digest: digest(&access_secret(&secret)?),
+            refresh_digest: digest(&secret),
+            previous: None,
+        }),
+    };
+    grant(&id, &secret, session)
+}
+
+fn grant(id: &str, refresh: &str, session: AuthSession) -> Result<SessionGrant, AdminError> {
+    Ok(SessionGrant {
+        session_id: format!("a2.{id}.{}", access_secret(refresh)?),
+        refresh_token: Some(format!("r2.{id}.{refresh}")),
+        session,
+    })
+}
+
+impl DefaultAuthService {
+    pub(super) async fn refresh(&self, raw: &str) -> Result<Option<SessionGrant>, AdminError> {
+        let Some(credential) = Credential::parse(raw).filter(|value| value.refresh) else {
+            return Ok(None);
+        };
+        let mut current = self.load_live_session(credential.id).await?;
+        // CAS 冲突只重新解释同一请求的凭据，不对并发退出进行补建
+        for _ in 0..3 {
+            let Some(session) = current else {
+                return Ok(None);
+            };
+            let Some(renewal) = &session.renewal else {
+                return Ok(None);
+            };
+            let now = Utc::now();
+            if session.retained_until() <= now
+                || session.absolute_expires_at.is_none_or(|limit| limit <= now)
+            {
+                return Ok(None);
+            }
+            if matches_digest(&renewal.refresh_digest, &credential.digest()) {
+                // 其他标签页已经刷新或客户端重试时复用当前代，避免 Cookie 响应相互覆盖
+                if session.expires_at > now {
+                    return grant(credential.id, credential.secret, session).map(Some);
+                }
+                let absolute = session
+                    .absolute_expires_at
+                    .ok_or_else(|| AdminError::internal("缺少会话最长有效期"))?;
+                let salt = random_bytes();
+                let next_secret =
+                    derive(credential.secret, Some(&salt), b"cpr-session-v2/refresh")?;
+                let refresh_expiry = (now + self.admin_session_ttl).min(absolute);
+                let access_expiry = (now + self.admin_access_ttl).min(refresh_expiry);
+                let replacement = AuthSession {
+                    expires_at: access_expiry,
+                    renewal: Some(SessionRenewal {
+                        expires_at: refresh_expiry,
+                        access_digest: digest(&access_secret(&next_secret)?),
+                        refresh_digest: digest(&next_secret),
+                        previous: Some(SessionRefreshReplay {
+                            digest: credential.digest(),
+                            salt,
+                            expires_at: (now + REPLAY_WINDOW).min(access_expiry),
+                        }),
+                    }),
+                    ..session.clone()
+                };
+                current = self
+                    .store
+                    .compare_exchange_session(credential.id, &session, Some(&replacement))
+                    .await
+                    .map_err(|error| map_store_error(error, "authentication session rotation"))?;
+                if current.as_ref() == Some(&replacement) {
+                    return grant(credential.id, &next_secret, replacement).map(Some);
+                }
+            } else if let Some(previous) = renewal
+                .previous
+                .as_ref()
+                .filter(|previous| matches_digest(&previous.digest, &credential.digest()))
+            {
+                if previous.expires_at > now {
+                    let secret = derive(
+                        credential.secret,
+                        Some(&previous.salt),
+                        b"cpr-session-v2/refresh",
+                    )?;
+                    return grant(credential.id, &secret, session).map(Some);
+                }
+                // 已知上一代在重试窗口外再次使用，原子撤销整个会话
+                current = self
+                    .store
+                    .compare_exchange_session(credential.id, &session, None)
+                    .await
+                    .map_err(|error| map_store_error(error, "authentication session revocation"))?;
+            } else {
+                return Ok(None);
+            }
+        }
+        Err(AdminError::new(
+            AdminErrorKind::Unavailable,
+            "会话正在变更，请重试",
+        ))
+    }
+}

backend/crates/gateway-admin/tests/backup/support.rs

@@ -725,11 +725,11 @@ impl AuthStore for FakeAuthStore {
     ) -> AdminStoreResult<()> {
         Ok(())
     }
-    async fn renew_session(
+    async fn compare_exchange_session(
         &self,
         _: &str,
         _: &gateway_admin::model::auth::AuthSession,
-        _: chrono::DateTime<chrono::Utc>,
+        _: Option<&gateway_admin::model::auth::AuthSession>,
     ) -> AdminStoreResult<Option<gateway_admin::model::auth::AuthSession>> {
         Ok(None)
     }

backend/crates/gateway-admin/tests/use_case/auth/mod.rs

@@ -1,4 +1,4 @@
-//! 验证管理员认证、密码变更、会话绑定与限流行为
+//! 验证管理员认证、密码变更与限流，提供会话轮换的内存存储辅助
 
 use std::{collections::BTreeMap, sync::Mutex};
 
@@ -69,6 +69,7 @@ async fn password_change_obeys_rate_limit_and_rejects_unbound_legacy_sessions()
                 admin_user_id: "admin".into(),
                 credential_fingerprint: String::new(),
             },
+            renewal: None,
             absolute_expires_at: None,
             expires_at: Utc::now() + TimeDelta::hours(1),
         },
@@ -138,19 +139,24 @@ impl AuthStore for MemoryAuthStore {
         Ok(())
     }
 
-    async fn renew_session(
+    async fn compare_exchange_session(
         &self,
         session_id: &str,
         expected: &AuthSession,
-        expires_at: chrono::DateTime<chrono::Utc>,
+        replacement: Option<&AuthSession>,
     ) -> AdminStoreResult<Option<AuthSession>> {
         let mut sessions = self.sessions.lock().unwrap();
         if let Some(session) = sessions.get_mut(session_id) {
-            if session.expires_at <= chrono::Utc::now() {
+            if session.retained_until() <= chrono::Utc::now() {
                 return Ok(None);
             }
             if session == expected {
-                session.expires_at = expires_at;
+                if let Some(replacement) = replacement {
+                    *session = replacement.clone();
+                } else {
+                    sessions.remove(session_id);
+                    return Ok(None);
+                }
             }
             return Ok(Some(session.clone()));
         }
@@ -190,8 +196,13 @@ impl AuthStore for MemoryAuthStore {
 #[tokio::test]
 async fn successful_login_should_create_expiring_session_and_audit() {
     let store = std::sync::Arc::new(MemoryAuthStore::default());
-    let services = super::AdminHarness::new().auth(store.clone()).build().await;
+    let services = super::AdminHarness::new()
+        .session_ttl_minutes(7 * 24 * 60)
+        .auth(store.clone())
+        .build()
+        .await;
 
+    let before = Utc::now();
     let result = services
         .auth()
         .login(
@@ -205,6 +216,17 @@ async fn successful_login_should_create_expiring_session_and_audit() {
         .await
         .expect("login");
 
+    let after = Utc::now();
+    for (expiry, ttl) in [
+        (result.session.expires_at, TimeDelta::hours(24)),
+        (result.session.retained_until(), TimeDelta::days(7)),
+        (
+            result.session.absolute_expires_at.unwrap(),
+            TimeDelta::days(30),
+        ),
+    ] {
+        assert!((before + ttl..=after + ttl).contains(&expiry));
+    }
     assert!(
         services
             .auth()
@@ -293,6 +315,7 @@ async fn expired_sessions_are_rejected_and_store_outages_are_not_treated_as_logo
                 credential_fingerprint: String::new(),
                 admin_user_id: "admin".to_owned(),
             },
+            renewal: None,
             absolute_expires_at: None,
             expires_at: Utc::now() - TimeDelta::seconds(1),
         },
@@ -362,7 +385,7 @@ async fn failed_rotation_discards_the_new_session_and_leaves_the_old_session_ret
         .await
         .unwrap();
     assert!(!format!("{original:?}").contains(&original.session_id));
-    *store.reject_delete.lock().unwrap() = Some(original.session_id.clone());
+    *store.reject_delete.lock().unwrap() = Some(stored_id(&original.session_id).to_owned());
     assert_eq!(
         services
             .auth()
@@ -391,109 +414,23 @@ async fn failed_rotation_discards_the_new_session_and_leaves_the_old_session_ret
     assert!(store.sessions.lock().unwrap().is_empty());
 }
 
-#[tokio::test]
-async fn renewal_is_throttled_and_capped_by_the_original_absolute_expiry() {
-    let store = std::sync::Arc::new(MemoryAuthStore::default());
-    let services = super::AdminHarness::new()
-        .auth(store.clone())
-        .session_ttl_minutes(60)
-        .build()
-        .await;
-    let auth = services.auth();
-    let login = auth
-        .login(
-            LoginCommand::Admin {
-                username: None,
-                password: "strong-test-password".into(),
-            },
-            std::net::Ipv4Addr::LOCALHOST.into(),
-            None,
-        )
-        .await
-        .unwrap();
-    assert_eq!(
-        auth.renew_session(Some(&login.session_id)).await.unwrap(),
-        Some(login.session.clone())
-    );
-    let limit = Utc::now() + TimeDelta::minutes(30);
-    {
-        let mut sessions = store.sessions.lock().unwrap();
-        let session = sessions.get_mut(&login.session_id).unwrap();
-        session.expires_at = Utc::now() + TimeDelta::minutes(1);
-        session.absolute_expires_at = Some(limit);
-    }
-    let renewed = auth
-        .renew_session(Some(&login.session_id))
-        .await
-        .unwrap()
-        .unwrap();
-    assert_eq!(renewed.expires_at, limit);
-    assert_eq!(renewed.absolute_expires_at, Some(limit));
-    assert_eq!(
-        auth.renew_session(Some(&login.session_id)).await.unwrap(),
-        Some(renewed)
-    );
+fn stored_id(token: &str) -> &str {
+    token.split('.').nth(1).unwrap_or(token)
 }
 
-#[tokio::test]
-async fn renewal_never_revives_expired_revoked_or_legacy_sessions() {
-    let store = std::sync::Arc::new(MemoryAuthStore::default());
-    let services = super::AdminHarness::new().auth(store.clone()).build().await;
-    let auth = services.auth();
-    let login = auth
-        .login(
-            LoginCommand::Admin {
-                username: None,
-                password: "strong-test-password".into(),
-            },
-            std::net::Ipv4Addr::LOCALHOST.into(),
-            None,
-        )
-        .await
-        .unwrap();
-    let mut session = login.session.clone();
-    session.absolute_expires_at = None;
-    session.expires_at = Utc::now() + TimeDelta::seconds(30);
-    store
-        .sessions
-        .lock()
-        .unwrap()
-        .insert(login.session_id.clone(), session.clone());
-    assert_eq!(
-        auth.renew_session(Some(&login.session_id)).await.unwrap(),
-        Some(session.clone())
-    );
-    session.expires_at = Utc::now() - TimeDelta::seconds(1);
-    store
-        .sessions
-        .lock()
-        .unwrap()
-        .insert(login.session_id.clone(), session);
-    assert!(
-        auth.renew_session(Some(&login.session_id))
-            .await
-            .unwrap()
-            .is_none()
-    );
-    let mut session = login.session;
-    session.absolute_expires_at = Some(Utc::now() - TimeDelta::seconds(1));
-    store
-        .sessions
-        .lock()
-        .unwrap()
-        .insert(login.session_id.clone(), session);
-    assert!(
-        auth.renew_session(Some(&login.session_id))
-            .await
-            .unwrap()
-            .is_none()
-    );
-    auth.logout(&login.session_id).await.unwrap();
-    assert!(
-        auth.renew_session(Some(&login.session_id))
-            .await
-            .unwrap()
-            .is_none()
-    );
-    assert!(store.sessions.lock().unwrap().is_empty());
+async fn admin_login(
+    auth: &dyn gateway_admin::AuthService,
+) -> gateway_admin::model::auth::SessionGrant {
+    auth.login(
+        LoginCommand::Admin {
+            username: None,
+            password: "strong-test-password".into(),
+        },
+        std::net::Ipv4Addr::LOCALHOST.into(),
+        None,
+    )
+    .await
+    .unwrap()
 }
+
+mod session;

backend/crates/gateway-admin/tests/use_case/auth/session.rs

@@ -0,0 +1,268 @@
+//! 验证双凭据续期、响应重试、并发撤销与固定期限边界
+
+use super::super::AdminHarness;
+use super::{MemoryAuthStore, admin_login, stored_id};
+use chrono::{TimeDelta, Utc};
+use gateway_admin::model::auth::AuthSession;
+
+#[tokio::test]
+async fn expired_access_is_restored_by_refresh_and_duplicate_refresh_replays_the_same_grant() {
+    let store = std::sync::Arc::new(MemoryAuthStore::default());
+    let services = AdminHarness::new().auth(store.clone()).build().await;
+    let auth = services.auth();
+    let login = admin_login(auth).await;
+    let refresh = login.refresh_token.as_deref().unwrap();
+    assert!(auth.session(Some(refresh)).await.unwrap().is_none());
+    assert!(
+        auth.renew_session(Some(&login.session_id), None)
+            .await
+            .unwrap()
+            .is_none()
+    );
+    assert!(
+        auth.renew_session(None, Some(&login.session_id))
+            .await
+            .unwrap()
+            .is_none()
+    );
+    assert_eq!(
+        auth.renew_session(Some(refresh), None).await.unwrap(),
+        Some(login.clone())
+    );
+    store
+        .sessions
+        .lock()
+        .unwrap()
+        .get_mut(stored_id(&login.session_id))
+        .unwrap()
+        .expires_at = Utc::now() - TimeDelta::seconds(1);
+    assert!(
+        auth.session(Some(&login.session_id))
+            .await
+            .unwrap()
+            .is_none()
+    );
+    let (first, concurrent) = tokio::join!(
+        auth.renew_session(Some(refresh), None),
+        auth.renew_session(Some(refresh), None)
+    );
+    let first = first.unwrap().unwrap();
+    assert_eq!(concurrent.unwrap().as_ref(), Some(&first));
+    assert_ne!(first.session_id, login.session_id);
+    assert_ne!(first.refresh_token, login.refresh_token);
+    assert_eq!(
+        first.session.absolute_expires_at,
+        login.session.absolute_expires_at
+    );
+    assert!(
+        auth.session(Some(&first.session_id))
+            .await
+            .unwrap()
+            .is_some()
+    );
+    assert_eq!(
+        auth.renew_session(first.refresh_token.as_deref(), None)
+            .await
+            .unwrap(),
+        Some(first.clone())
+    );
+    assert_eq!(
+        auth.renew_session(Some(refresh), None).await.unwrap(),
+        Some(first.clone())
+    );
+    let persisted = format!("{:?}", store.sessions.lock().unwrap());
+    for token in [
+        &first.session_id,
+        first.refresh_token.as_ref().unwrap(),
+        &login.session_id,
+        login.refresh_token.as_ref().unwrap(),
+    ] {
+        assert!(!persisted.contains(token));
+        assert!(!persisted.contains(token.rsplit('.').next().unwrap()));
+    }
+}
+
+#[tokio::test]
+async fn late_refresh_reuse_revokes_the_family_but_unknown_secrets_do_not() {
+    let store = std::sync::Arc::new(MemoryAuthStore::default());
+    let services = AdminHarness::new().auth(store.clone()).build().await;
+    let auth = services.auth();
+    let login = admin_login(auth).await;
+    store
+        .sessions
+        .lock()
+        .unwrap()
+        .get_mut(stored_id(&login.session_id))
+        .unwrap()
+        .expires_at = Utc::now() - TimeDelta::seconds(1);
+    let next = auth
+        .renew_session(login.refresh_token.as_deref(), None)
+        .await
+        .unwrap()
+        .unwrap();
+    let unknown = format!("r2.{}.{}", stored_id(&login.session_id), "A".repeat(43));
+    assert!(
+        auth.renew_session(Some(&unknown), None)
+            .await
+            .unwrap()
+            .is_none()
+    );
+    auth.logout(&unknown).await.unwrap();
+    auth.logout(stored_id(&login.session_id)).await.unwrap();
+    assert!(
+        auth.session(Some(&next.session_id))
+            .await
+            .unwrap()
+            .is_some()
+    );
+    store
+        .sessions
+        .lock()
+        .unwrap()
+        .get_mut(stored_id(&login.session_id))
+        .unwrap()
+        .renewal
+        .as_mut()
+        .unwrap()
+        .previous
+        .as_mut()
+        .unwrap()
+        .expires_at = Utc::now() - TimeDelta::seconds(1);
+    assert!(
+        auth.renew_session(login.refresh_token.as_deref(), None)
+            .await
+            .unwrap()
+            .is_none()
+    );
+    assert!(
+        auth.session(Some(&next.session_id))
+            .await
+            .unwrap()
+            .is_none()
+    );
+    assert!(
+        auth.renew_session(next.refresh_token.as_deref(), None)
+            .await
+            .unwrap()
+            .is_none()
+    );
+}
+
+#[tokio::test]
+async fn refresh_respects_idle_and_absolute_expiry_and_logout_after_access_expiry() {
+    let store = std::sync::Arc::new(MemoryAuthStore::default());
+    let services = AdminHarness::new().auth(store.clone()).build().await;
+    let auth = services.auth();
+    for absolute in [false, true] {
+        let login = admin_login(auth).await;
+        {
+            let mut sessions = store.sessions.lock().unwrap();
+            let session = sessions.get_mut(stored_id(&login.session_id)).unwrap();
+            if absolute {
+                session.absolute_expires_at = Some(Utc::now() - TimeDelta::seconds(1));
+            } else {
+                session.renewal.as_mut().unwrap().expires_at = Utc::now() - TimeDelta::seconds(1);
+            }
+        }
+        assert!(
+            auth.renew_session(login.refresh_token.as_deref(), None)
+                .await
+                .unwrap()
+                .is_none()
+        );
+        assert!(
+            auth.session(Some(&login.session_id))
+                .await
+                .unwrap()
+                .is_none()
+        );
+    }
+    let login = admin_login(auth).await;
+    store
+        .sessions
+        .lock()
+        .unwrap()
+        .get_mut(stored_id(&login.session_id))
+        .unwrap()
+        .expires_at = Utc::now() - TimeDelta::seconds(1);
+    auth.logout(login.refresh_token.as_deref().unwrap())
+        .await
+        .unwrap();
+    assert!(
+        auth.renew_session(login.refresh_token.as_deref(), None)
+            .await
+            .unwrap()
+            .is_none()
+    );
+}
+
+#[tokio::test]
+async fn refreshed_expiry_is_capped_and_store_outages_preserve_the_session() {
+    let store = std::sync::Arc::new(MemoryAuthStore::default());
+    let services = AdminHarness::new().auth(store.clone()).build().await;
+    let auth = services.auth();
+    let login = admin_login(auth).await;
+    let limit = Utc::now() + TimeDelta::minutes(1);
+    {
+        let mut sessions = store.sessions.lock().unwrap();
+        let session = sessions.get_mut(stored_id(&login.session_id)).unwrap();
+        session.absolute_expires_at = Some(limit);
+        session.expires_at = Utc::now() - TimeDelta::seconds(1);
+    }
+    store
+        .unavailable
+        .store(true, std::sync::atomic::Ordering::SeqCst);
+    assert!(
+        auth.renew_session(login.refresh_token.as_deref(), None)
+            .await
+            .is_err()
+    );
+    store
+        .unavailable
+        .store(false, std::sync::atomic::Ordering::SeqCst);
+    let refreshed = auth
+        .renew_session(login.refresh_token.as_deref(), None)
+        .await
+        .unwrap()
+        .unwrap();
+    assert_eq!(refreshed.session.expires_at, limit);
+    assert_eq!(refreshed.session.retained_until(), limit);
+    assert_eq!(refreshed.session.absolute_expires_at, Some(limit));
+}
+
+#[tokio::test]
+async fn fixed_sessions_cannot_acquire_refresh_credentials() {
+    let store = std::sync::Arc::new(MemoryAuthStore::default());
+    let services = AdminHarness::new().auth(store.clone()).build().await;
+    let auth = services.auth();
+    let login = admin_login(auth).await;
+    let fixed = AuthSession {
+        renewal: None,
+        ..login.session
+    };
+    store
+        .sessions
+        .lock()
+        .unwrap()
+        .insert("fixed".into(), fixed.clone());
+    let grant = auth
+        .renew_session(None, Some("fixed"))
+        .await
+        .unwrap()
+        .unwrap();
+    assert_eq!(grant.session, fixed);
+    assert!(grant.refresh_token.is_none());
+    store
+        .sessions
+        .lock()
+        .unwrap()
+        .get_mut("fixed")
+        .unwrap()
+        .expires_at = Utc::now() - TimeDelta::seconds(1);
+    assert!(
+        auth.renew_session(None, Some("fixed"))
+            .await
+            .unwrap()
+            .is_none()
+    );
+}

backend/crates/gateway-admin/tests/use_case/auth_key.rs

@@ -285,19 +285,24 @@ impl AuthStore for MemoryKeyAuthStore {
         Ok(())
     }
 
-    async fn renew_session(
+    async fn compare_exchange_session(
         &self,
         session_id: &str,
         expected: &AuthSession,
-        expires_at: chrono::DateTime<chrono::Utc>,
+        replacement: Option<&AuthSession>,
     ) -> AdminStoreResult<Option<AuthSession>> {
         let mut sessions = self.sessions.lock().unwrap();
         if let Some(session) = sessions.get_mut(session_id) {
-            if session.expires_at <= chrono::Utc::now() {
+            if session.retained_until() <= chrono::Utc::now() {
                 return Ok(None);
             }
             if session == expected {
-                session.expires_at = expires_at;
+                if let Some(replacement) = replacement {
+                    *session = replacement.clone();
+                } else {
+                    sessions.remove(session_id);
+                    return Ok(None);
+                }
             }
             return Ok(Some(session.clone()));
         }

backend/crates/gateway-admin/tests/use_case/mod.rs

@@ -369,11 +369,11 @@ impl AuthStore for BootstrapAuthStore {
         Err(unavailable("admin session"))
     }
 
-    async fn renew_session(
+    async fn compare_exchange_session(
         &self,
         _: &str,
         _: &gateway_admin::model::auth::AuthSession,
-        _: chrono::DateTime<chrono::Utc>,
+        _: Option<&gateway_admin::model::auth::AuthSession>,
     ) -> AdminStoreResult<Option<gateway_admin::model::auth::AuthSession>> {
         Ok(None)
     }

backend/crates/gateway-api/src/auth.rs

@@ -138,7 +138,9 @@ where
         .login(
             payload.into(),
             peer.ip(),
-            session_cookie::value(&headers).as_deref(),
+            session_cookie::refresh_value(&headers)
+                .or_else(|| session_cookie::value(&headers))
+                .as_deref(),
         )
         .await
         .map_err(map_login_error)?;
@@ -149,8 +151,7 @@ where
         )
         .into_response(),
         &headers,
-        &result.session_id,
-        &result.session,
+        &result,
     )
 }
 
@@ -177,16 +178,18 @@ async fn refresh_session<S>(
 where
     S: SessionState + Send + Sync,
 {
-    let session_id = session_cookie::value(&headers);
-    let session = state
+    let grant = state
         .admin_services()
         .auth()
-        .renew_session(session_id.as_deref())
+        .renew_session(
+            session_cookie::refresh_value(&headers).as_deref(),
+            session_cookie::value(&headers).as_deref(),
+        )
         .await
         .map_err(map_admin_service_error)?;
-    let response = session_response(session.as_ref());
-    if let (Some(session_id), Some(session)) = (session_id, session) {
-        return set_session_cookie(response, &headers, &session_id, &session);
+    let response = session_response(grant.as_ref().map(|grant| &grant.session));
+    if let Some(grant) = grant {
+        return set_session_cookie(response, &headers, &grant);
     }
     // 失效响应不清 Cookie，避免晚到的请求覆盖另一个标签页刚建立的会话
     Ok(response)
@@ -206,32 +209,72 @@ fn session_response(session: Option<&AuthSession>) -> Response {
 fn set_session_cookie(
     mut response: Response,
     headers: &HeaderMap,
-    session_id: &str,
-    session: &AuthSession,
+    grant: &gateway_admin::model::auth::SessionGrant,
 ) -> Result<Response, AdminError> {
-    let max_age = session
-        .expires_at
-        .signed_duration_since(chrono::Utc::now())
-        .num_seconds()
-        .max(1);
-    let expires = session.expires_at.format("%a, %d %b %Y %H:%M:%S GMT");
-    let cookie = format!(
-        "{}={session_id}; {}; Max-Age={max_age}; Expires={expires}",
+    append_cookie(
+        &mut response,
+        headers,
         session_cookie::NAME,
-        session_cookie::attributes(headers)
-    );
-    response.headers_mut().insert(
-        header::SET_COOKIE,
-        HeaderValue::from_str(&cookie).map_err(|_| AdminError::internal())?,
-    );
+        &grant.session_id,
+        Some(grant.session.expires_at),
+    )?;
+    append_cookie(
+        &mut response,
+        headers,
+        session_cookie::REFRESH_NAME,
+        grant.refresh_token.as_deref().unwrap_or_default(),
+        grant
+            .session
+            .renewal
+            .as_ref()
+            .map(|renewal| renewal.expires_at),
+    )?;
     Ok(response)
 }
 
+fn append_cookie(
+    response: &mut Response,
+    headers: &HeaderMap,
+    name: &str,
+    value: &str,
+    expires_at: Option<chrono::DateTime<chrono::Utc>>,
+) -> Result<(), AdminError> {
+    let attributes = session_cookie::attributes(headers);
+    let path = if name == session_cookie::REFRESH_NAME {
+        "/api/auth"
+    } else {
+        "/"
+    };
+    let lifetime = expires_at.map_or_else(
+        || "Max-Age=0".to_owned(),
+        |expiry| {
+            format!(
+                "Max-Age={}; Expires={}",
+                expiry
+                    .signed_duration_since(chrono::Utc::now())
+                    .num_seconds()
+                    .max(1),
+                expiry.format("%a, %d %b %Y %H:%M:%S GMT")
+            )
+        },
+    );
+    response.headers_mut().append(
+        header::SET_COOKIE,
+        HeaderValue::from_str(&format!(
+            "{name}={value}; Path={path}; {attributes}; {lifetime}"
+        ))
+        .map_err(|_| AdminError::internal())?,
+    );
+    Ok(())
+}
+
 async fn logout<S>(State(state): State<S>, headers: HeaderMap) -> Result<Response, AdminError>
 where
     S: SessionState + Send + Sync,
 {
-    if let Some(session_id) = session_cookie::value(&headers) {
+    if let Some(session_id) =
+        session_cookie::refresh_value(&headers).or_else(|| session_cookie::value(&headers))
+    {
         state
             .admin_services()
             .auth()
@@ -285,15 +328,9 @@ fn clear_session_cookie(
     mut response: Response,
     headers: &HeaderMap,
 ) -> Result<Response, AdminError> {
-    let cookie = format!(
-        "{}=; {}; Max-Age=0",
-        session_cookie::NAME,
-        session_cookie::attributes(headers)
-    );
-    response.headers_mut().insert(
-        header::SET_COOKIE,
-        HeaderValue::from_str(&cookie).map_err(|_| AdminError::internal())?,
-    );
+    for name in [session_cookie::NAME, session_cookie::REFRESH_NAME] {
+        append_cookie(&mut response, headers, name, "", None)?;
+    }
     Ok(response)
 }
 

backend/crates/gateway-api/src/session_cookie.rs

@@ -4,6 +4,7 @@ use axum::http::{HeaderMap, header::ORIGIN};
 use url::Url;
 
 pub(crate) const NAME: &str = "cpr_session";
+pub(crate) const REFRESH_NAME: &str = "cpr_refresh";
 
 pub(crate) fn attributes(headers: &HeaderMap) -> &'static str {
     // HTTPS 反代回源 HTTP 不改变浏览器 Origin
@@ -19,16 +20,24 @@ pub(crate) fn attributes(headers: &HeaderMap) -> &'static str {
                 })
             });
     if http_origin {
-        "Path=/; HttpOnly; SameSite=Lax"
+        "HttpOnly; SameSite=Lax"
     } else {
-        "Path=/; Secure; HttpOnly; SameSite=Lax"
+        "Secure; HttpOnly; SameSite=Lax"
     }
 }
 
 pub(crate) fn value(headers: &HeaderMap) -> Option<String> {
+    named_value(headers, NAME)
+}
+
+pub(crate) fn refresh_value(headers: &HeaderMap) -> Option<String> {
+    named_value(headers, REFRESH_NAME)
+}
+
+fn named_value(headers: &HeaderMap, name: &str) -> Option<String> {
     let cookie = headers.get("cookie")?.to_str().ok()?;
     cookie.split(';').find_map(|part| {
         let (candidate, value) = part.trim().split_once('=')?;
-        (candidate == NAME).then(|| value.to_owned())
+        (candidate == name && !value.is_empty()).then(|| value.to_owned())
     })
 }

backend/crates/gateway-api/tests/admin/mod.rs

@@ -321,6 +321,7 @@ impl MemoryAuthStore {
                     },
                     admin_user_id: "admin_1".to_owned(),
                 },
+                renewal: None,
                 absolute_expires_at: None,
                 expires_at: Utc::now() + Duration::hours(1),
             },
@@ -339,7 +340,7 @@ impl MemoryAuthStore {
         self.sessions
             .lock()
             .unwrap()
-            .get_mut(session_id)
+            .get_mut(session_id.split('.').nth(1).unwrap_or(session_id))
             .unwrap()
             .expires_at = expires_at;
     }
@@ -415,19 +416,24 @@ impl AuthStore for MemoryAuthStore {
         Ok(())
     }
 
-    async fn renew_session(
+    async fn compare_exchange_session(
         &self,
         session_id: &str,
         expected: &AuthSession,
-        expires_at: chrono::DateTime<chrono::Utc>,
+        replacement: Option<&AuthSession>,
     ) -> AdminStoreResult<Option<AuthSession>> {
         let mut sessions = self.sessions.lock().unwrap();
         if let Some(session) = sessions.get_mut(session_id) {
-            if session.expires_at <= chrono::Utc::now() {
+            if session.retained_until() <= chrono::Utc::now() {
                 return Ok(None);
             }
             if session == expected {
-                session.expires_at = expires_at;
+                if let Some(replacement) = replacement {
+                    *session = replacement.clone();
+                } else {
+                    sessions.remove(session_id);
+                    return Ok(None);
+                }
             }
             return Ok(Some(session.clone()));
         }

backend/crates/gateway-api/tests/auth.rs

@@ -23,6 +23,27 @@ fn session_cookie(response: &axum::response::Response) -> String {
         .to_owned()
 }
 
+fn refresh_cookie(response: &axum::response::Response) -> String {
+    response
+        .headers()
+        .get_all(header::SET_COOKIE)
+        .iter()
+        .filter_map(|value| value.to_str().ok())
+        .find(|value| value.starts_with("cpr_refresh="))
+        .expect("refresh cookie")
+        .split(';')
+        .next()
+        .unwrap()
+        .to_owned()
+}
+
+async fn refresh(app: &axum::Router, cookie: &str) -> axum::response::Response {
+    app.clone()
+        .oneshot(cookie_request(Method::POST, "/api/auth/refresh", cookie))
+        .await
+        .unwrap()
+}
+
 async fn login(
     app: &axum::Router,
     body: Value,
@@ -537,64 +558,129 @@ async fn key_auth_should_issue_restore_and_clear_a_unified_cookie() {
 }
 
 #[tokio::test]
-async fn refresh_renews_admin_cookie_and_preserves_fixed_key_expiry() {
+async fn refresh_restores_expired_access_with_only_the_refresh_cookie() {
     let (app, fixture) = auth_app().await;
-    for body in [
+    let response = login(
+        &app,
         json!({"mode": "admin", "password": "strong-admin-password"}),
-        json!({"mode": "key", "apiKey": RAW_KEY}),
-    ] {
-        let response = login(&app, body.clone(), None).await;
-        let cookie = session_cookie(&response);
-        let original = response_json(response).await["data"]["expiresAt"]
-            .as_str()
-            .unwrap()
-            .to_owned();
-        if body["mode"] == "admin" {
-            fixture.set_session_expiry(
-                cookie.split_once('=').unwrap().1,
-                chrono::Utc::now() + chrono::Duration::minutes(1),
-            );
-        }
-        let response = app
-            .clone()
-            .oneshot(cookie_request(Method::POST, "/api/auth/refresh", &cookie))
+        None,
+    )
+    .await;
+    let access = session_cookie(&response);
+    let renewal = refresh_cookie(&response);
+    let cookies: Vec<_> = response
+        .headers()
+        .get_all(header::SET_COOKIE)
+        .iter()
+        .map(|value| value.to_str().unwrap())
+        .collect();
+    assert_eq!(cookies.len(), 2);
+    assert!(cookies[0].contains("Path=/;"));
+    assert!(cookies[1].contains("Path=/api/auth;"));
+    assert!(
+        cookies
+            .iter()
+            .all(|value| value.contains("HttpOnly") && value.contains("SameSite=Lax"))
+    );
+    assert_eq!(
+        response_json(refresh(&app, &access).await).await["data"]["authenticated"],
+        false
+    );
+    fixture.set_session_expiry(
+        access.split_once('=').unwrap().1,
+        chrono::Utc::now() - chrono::Duration::seconds(1),
+    );
+    assert_eq!(
+        get(&app, "/api/admin/system/version", &access)
             .await
-            .unwrap();
-        assert_eq!(response.status(), StatusCode::OK);
-        assert_eq!(response.headers()[header::CACHE_CONTROL], "no-store");
-        assert_eq!(session_cookie(&response), cookie);
-        assert!(
-            response.headers()[header::SET_COOKIE]
-                .to_str()
-                .unwrap()
-                .contains("HttpOnly")
-        );
-        let data = response_json(response).await;
-        assert_eq!(data["data"]["authenticated"], true);
-        let expiry = data["data"]["session"]["expiresAt"].as_str().unwrap();
-        if body["mode"] == "key" {
-            assert_eq!(expiry, original);
-        } else {
-            assert!(
-                chrono::DateTime::parse_from_rfc3339(expiry).unwrap()
-                    > chrono::Utc::now() + chrono::Duration::minutes(1)
-            );
-        }
-    }
+            .status(),
+        StatusCode::UNAUTHORIZED
+    );
+    assert_eq!(
+        response_json(get(&app, "/api/auth/status", &renewal).await).await["data"]["authenticated"],
+        false
+    );
+
+    let response = refresh(&app, &renewal).await;
+    assert_eq!(response.status(), StatusCode::OK);
+    assert_eq!(response.headers()[header::CACHE_CONTROL], "no-store");
+    let next_access = session_cookie(&response);
+    let next_renewal = refresh_cookie(&response);
+    assert_ne!(next_access, access);
+    assert_ne!(next_renewal, renewal);
+    assert_eq!(response_json(response).await["data"]["authenticated"], true);
+    assert_eq!(
+        get(&app, "/api/admin/system/version", &next_access)
+            .await
+            .status(),
+        StatusCode::OK
+    );
+    assert_eq!(
+        get(&app, "/api/admin/system/version", &access)
+            .await
+            .status(),
+        StatusCode::UNAUTHORIZED
+    );
+    // 模拟响应丢失后的重试，返回同一代 Cookie
+    let retry = refresh(&app, &renewal).await;
+    assert_eq!(session_cookie(&retry), next_access);
+    assert_eq!(refresh_cookie(&retry), next_renewal);
+}
+
+#[tokio::test]
+async fn key_refresh_preserves_fixed_expiry_and_clears_admin_refresh_cookie() {
+    let (app, _) = auth_app().await;
+    let admin = login(
+        &app,
+        json!({"mode": "admin", "password": "strong-admin-password"}),
+        None,
+    )
+    .await;
+    let renewal = refresh_cookie(&admin);
+    let response = login(
+        &app,
+        json!({"mode": "key", "apiKey": RAW_KEY}),
+        Some(&renewal),
+    )
+    .await;
+    assert_eq!(refresh_cookie(&response), "cpr_refresh=");
+    assert!(
+        response
+            .headers()
+            .get_all(header::SET_COOKIE)
+            .iter()
+            .any(|value| {
+                let value = value.to_str().unwrap();
+                value.starts_with("cpr_refresh=")
+                    && value.contains("Max-Age=0")
+                    && value.contains("Path=/api/auth;")
+            })
+    );
+    let cookie = session_cookie(&response);
+    let original = response_json(response).await["data"]["expiresAt"].clone();
+    let response = refresh(&app, &cookie).await;
+    assert_eq!(session_cookie(&response), cookie);
+    let data = response_json(response).await;
+    assert_eq!(data["data"]["authenticated"], true);
+    assert_eq!(data["data"]["session"]["expiresAt"], original);
+    assert_eq!(
+        response_json(refresh(&app, &renewal).await).await["data"]["authenticated"],
+        false
+    );
 }
 
 #[tokio::test]
 async fn refresh_after_logout_or_password_change_cannot_recreate_a_session() {
-    let (app, _) = auth_app().await;
+    let (app, fixture) = auth_app().await;
     for password_change in [false, true] {
-        let cookie = session_cookie(
-            &login(
-                &app,
-                json!({"mode": "admin", "password": "strong-admin-password"}),
-                None,
-            )
-            .await,
-        );
+        let login_response = login(
+            &app,
+            json!({"mode": "admin", "password": "strong-admin-password"}),
+            None,
+        )
+        .await;
+        let cookie = session_cookie(&login_response);
+        let renewal = refresh_cookie(&login_response);
         let response = if password_change {
             change_password(
                 &app,
@@ -604,15 +690,34 @@ async fn refresh_after_logout_or_password_change_cannot_recreate_a_session() {
             )
             .await
         } else {
+            fixture.set_session_expiry(
+                cookie.split_once('=').unwrap().1,
+                chrono::Utc::now() - chrono::Duration::seconds(1),
+            );
             app.clone()
-                .oneshot(cookie_request(Method::POST, "/api/auth/logout", &cookie))
+                .oneshot(cookie_request(Method::POST, "/api/auth/logout", &renewal))
                 .await
                 .unwrap()
         };
         assert_eq!(response.status(), StatusCode::OK);
+        assert_eq!(
+            response
+                .headers()
+                .get_all(header::SET_COOKIE)
+                .iter()
+                .count(),
+            2
+        );
+        assert!(
+            response
+                .headers()
+                .get_all(header::SET_COOKIE)
+                .iter()
+                .all(|value| value.to_str().unwrap().contains("Max-Age=0"))
+        );
         let response = app
             .clone()
-            .oneshot(cookie_request(Method::POST, "/api/auth/refresh", &cookie))
+            .oneshot(cookie_request(Method::POST, "/api/auth/refresh", &renewal))
             .await
             .unwrap();
         assert_eq!(response.status(), StatusCode::OK);

backend/crates/gateway-host/src/client_distribution.rs

@@ -24,6 +24,7 @@ const MAXIMUM_RESPONSE_BYTES: usize = 512 * 1024;
 const DYNAMIC_CACHE_SECONDS: i64 = 300;
 const FALLBACK_CACHE_SECONDS: u64 = 60;
 const MINIMUM_REMAINING_LINK_SECONDS: i64 = 600;
+const OFFICIAL_METADATA_TIMEOUT: Duration = Duration::from_secs(3);
 
 const OFFICIAL_X64_URL: &str = "https://persistent.oaistatic.com/codex-app-prod/ChatGPT-x64.msix";
 const OFFICIAL_ARM64_URL: &str =
@@ -53,7 +54,7 @@ impl RgAdguardClientDistribution {
     pub(crate) fn new() -> Self {
         let client = Client::builder()
             .connect_timeout(Duration::from_secs(5))
-            .timeout(Duration::from_secs(12))
+            .timeout(Duration::from_secs(30))
             .redirect(Policy::none())
             .build()
             .inspect_err(|_| {
@@ -69,10 +70,11 @@ impl RgAdguardClientDistribution {
     }
 
     async fn resolve_uncached(&self) -> (CodexDesktopWindowsDownloads, Duration) {
-        let now = Utc::now();
-        match self.fetch_store_packages(now).await {
+        match self.fetch_store_packages().await {
             Ok(packages) => {
-                let (packages, warning) = complete_with_official_fallback(packages);
+                let (mut packages, warning) = complete_with_official_fallback(packages);
+                self.fill_official_package_sizes(&mut packages).await;
+                let now = Utc::now();
                 let valid_seconds = packages
                     .iter()
                     .filter_map(|package| package.expires_at)
@@ -97,17 +99,33 @@ impl RgAdguardClientDistribution {
                     error_kind = ?error_kind,
                     "RG-Adguard package resolution failed; using official downloads"
                 );
-                (
-                    official_fallback(now),
-                    Duration::from_secs(FALLBACK_CACHE_SECONDS),
-                )
+                let mut downloads = official_fallback(Utc::now());
+                self.fill_official_package_sizes(&mut downloads.packages)
+                    .await;
+                downloads.resolved_at = Utc::now();
+                (downloads, Duration::from_secs(FALLBACK_CACHE_SECONDS))
             }
         }
     }
 
+    async fn fill_official_package_sizes(&self, packages: &mut [ClientDownloadPackage]) {
+        let Some(client) = self.client.as_ref() else {
+            return;
+        };
+        // 只补充回退包的展示大小，超时或缺失长度不能撤销官方稳定下载地址
+        futures::future::join_all(
+            packages
+                .iter_mut()
+                .filter(|package| package.source == ClientDownloadSource::OfficialOpenAi)
+                .map(|package| async {
+                    package.size_bytes = official_package_size(client, &package.download_url).await;
+                }),
+        )
+        .await;
+    }
+
     async fn fetch_store_packages(
         &self,
-        now: DateTime<Utc>,
     ) -> Result<Vec<ClientDownloadPackage>, ClientDistributionResolutionErrorKind> {
         let client = self
             .client
@@ -145,7 +163,8 @@ impl RgAdguardClientDistribution {
         }
         let html = std::str::from_utf8(&bytes)
             .map_err(|_| ClientDistributionResolutionErrorKind::InvalidResponse)?;
-        parse_store_packages(html, now)
+        // 上游解析可能耗时几十秒，按收到结果时的时间检查剩余有效期
+        parse_store_packages(html, Utc::now())
     }
 }
 
@@ -318,11 +337,12 @@ fn parse_size_bytes(value: &str) -> Option<u64> {
     if parts.next().is_some() {
         return None;
     }
+    // RG 页面以 KB/MB/GB 标记二进制大小，换算后才能与 CDN Content-Length 对齐
     let multiplier = match unit {
         "B" => 1_u128,
-        "KB" => 1_000,
-        "MB" => 1_000_000,
-        "GB" => 1_000_000_000,
+        "KB" => 1_024,
+        "MB" => 1_048_576,
+        "GB" => 1_073_741_824,
         _ => return None,
     };
     let (whole, fraction) = amount.split_once('.').unwrap_or((amount.as_str(), ""));
@@ -351,7 +371,7 @@ fn official_fallback(now: DateTime<Utc>) -> CodexDesktopWindowsDownloads {
         resolved_at: now,
         cached: false,
         warning: Some(
-            "Microsoft Store 离线直链暂不可用，已切换为 OpenAI 官方稳定安装包。".to_owned(),
+            "Microsoft Store 离线直链暂不可用，已切换为 OpenAI 官方稳定安装包".to_owned(),
         ),
         packages,
     }
@@ -375,7 +395,7 @@ pub fn complete_with_official_fallback(
     }
     let warning = (!missing.is_empty()).then(|| {
         format!(
-            "{} 的 Microsoft Store 临时直链不可用，已切换为 OpenAI 官方稳定安装包。",
+            "{} 的 Microsoft Store 临时直链不可用，已切换为 OpenAI 官方稳定安装包",
             missing.join("、")
         )
     });
@@ -397,3 +417,25 @@ fn official_package(architecture: ClientArchitecture) -> ClientDownloadPackage {
         expires_at: None,
     }
 }
+
+/// 读取官方安装包的响应头大小，不下载包字节
+pub async fn official_package_size(client: &Client, download_url: &str) -> Option<u64> {
+    let response = client
+        .head(download_url)
+        .timeout(OFFICIAL_METADATA_TIMEOUT)
+        .send()
+        .await
+        .ok()?;
+    if !response.status().is_success() {
+        return None;
+    }
+    // HEAD 没有正文，不能用正文长度推断实际安装包大小
+    response
+        .headers()
+        .get(reqwest::header::CONTENT_LENGTH)?
+        .to_str()
+        .ok()?
+        .parse::<u64>()
+        .ok()
+        .filter(|size| *size > 0)
+}

backend/crates/gateway-host/src/config.rs

@@ -72,7 +72,7 @@ fn missing_config_field(error: &config::ConfigError) -> Option<String> {
 }
 
 /// Host 唯一拥有的进程配置
-#[derive(Debug, Clone, Deserialize, PartialEq, Eq)]
+#[derive(Debug, Clone, Deserialize, PartialEq)]
 pub struct HostConfig {
     #[serde(default)]
     pub timezone: gateway_core::time::DeploymentTimeZone,
@@ -145,7 +145,7 @@ pub struct ListenConfig {
 }
 
 /// Host 结构化日志配置
-#[derive(Debug, Clone, Deserialize, PartialEq, Eq)]
+#[derive(Debug, Clone, Deserialize, PartialEq)]
 pub struct LoggingConfig {
     pub level: String,
     pub stdout: bool,
@@ -157,17 +157,17 @@ pub struct LoggingConfig {
     /// 请求报文的留存窗口由 request_dump_retention_days 独立控制
     #[serde(default)]
     pub request_dump: bool,
-    /// 完整报文的最少保留天数；按 UTC 日期整组清理，默认 1 天
+    /// 完整报文的最少保留天数；支持小数，每天按 24 小时换算，默认 1 天
     #[serde(default = "default_request_dump_retention_days")]
-    pub request_dump_retention_days: usize,
+    pub request_dump_retention_days: f64,
 }
 
 fn default_file_retention_days() -> usize {
     7
 }
 
-fn default_request_dump_retention_days() -> usize {
-    1
+fn default_request_dump_retention_days() -> f64 {
+    1.0
 }
 
 impl LoggingConfig {
@@ -190,14 +190,19 @@ impl LoggingConfig {
                 "host.logging.file.max_file_size_mb",
             ));
         }
-        if self.request_dump_retention_days == 0 {
-            return Err(ConfigError::InvalidField(
-                "host.logging.request_dump_retention_days",
-            ));
-        }
+        self.request_dump_retention()?;
         resolve_relative_path(source_dir, &mut self.file.directory);
         Ok(())
     }
+
+    pub(crate) fn request_dump_retention(&self) -> Result<Duration, ConfigError> {
+        Duration::try_from_secs_f64(self.request_dump_retention_days * 86_400.0)
+            .ok()
+            .filter(|duration| !duration.is_zero())
+            .ok_or(ConfigError::InvalidField(
+                "host.logging.request_dump_retention_days",
+            ))
+    }
 }
 
 /// Host 文件日志配置

backend/crates/gateway-host/src/logging/mod.rs

@@ -15,7 +15,7 @@ mod sink;
 mod writer;
 
 use sink::{FileLogGuard, FileLogSink, LogHealth};
-use writer::RotatingLogWriter;
+use writer::{LogRetention, RotatingLogWriter};
 
 // 文件前缀统一为 codex-proxy-rs-<kebab-case 类别>；专用 tracing target 使用 snake_case
 const APPLICATION_LOG_FILE_PREFIX: &str = "codex-proxy-rs-application";
@@ -45,9 +45,11 @@ pub enum LogError {
     AlreadyInitialized,
     #[error("logging size limit is too large")]
     SizeOverflow,
+    #[error(transparent)]
+    InvalidConfig(#[from] crate::config::ConfigError),
 }
 
-/// 初始化日志；文件按完整日期留存，不以分片数量淘汰窗口内记录
+/// 初始化日志；按各通道的保留窗口清理，不以分片数量淘汰记录
 pub fn initialize_logging(
     config: &LoggingConfig,
     timezone: gateway_core::time::DeploymentTimeZone,
@@ -74,7 +76,7 @@ pub fn initialize_logging(
         let (writer, guard) = create_file_writer(
             config,
             timezone,
-            config.file.retention_days,
+            LogRetention::CalendarDays(config.file.retention_days),
             APPLICATION_LOG_FILE_PREFIX,
             "gateway-log-application-file",
             Arc::clone(&health),
@@ -88,7 +90,7 @@ pub fn initialize_logging(
         let (writer, guard) = create_file_writer(
             config,
             timezone,
-            config.file.retention_days,
+            LogRetention::CalendarDays(config.file.retention_days),
             OAUTH_RECOVERY_LOG_FILE_PREFIX,
             "gateway-log-oauth-recovery-file",
             Arc::clone(&health),
@@ -102,7 +104,7 @@ pub fn initialize_logging(
         let (writer, guard) = create_file_writer(
             config,
             timezone,
-            config.request_dump_retention_days,
+            LogRetention::Elapsed(config.request_dump_retention()?),
             REQUEST_DUMP_LOG_FILE_PREFIX,
             "gateway-log-request-dump-file",
             Arc::clone(&health),
@@ -220,7 +222,7 @@ impl LogGuard {
 fn create_file_writer(
     config: &LoggingConfig,
     timezone: gateway_core::time::DeploymentTimeZone,
-    retention_days: usize,
+    retention: LogRetention,
     prefix: &'static str,
     thread_name: &'static str,
     health: Arc<LogHealth>,
@@ -234,7 +236,7 @@ fn create_file_writer(
         config.file.directory.clone(),
         prefix,
         maximum_bytes,
-        retention_days,
+        retention,
         Arc::clone(&health),
         timezone,
     )?;

backend/crates/gateway-host/src/logging/writer.rs

@@ -1,22 +1,30 @@
-//! 按大小轮转、压缩已关闭分片、按部署时区自然日期组清理
+//! 按大小与时间轮转、压缩已关闭分片，按自然日期或实际时长清理
 
 use std::collections::BTreeMap;
 use std::fs::{self, File, OpenOptions};
 use std::io::{self, BufWriter, Write};
 use std::path::{Path, PathBuf};
 use std::sync::Arc;
+use std::time::{Duration, Instant, SystemTime};
 
 use chrono::{NaiveDate, Utc};
 use flate2::{Compression, write::GzEncoder};
 
 use super::sink::LogHealth;
 
+#[derive(Clone, Copy)]
+pub(super) enum LogRetention {
+    CalendarDays(usize),
+    Elapsed(Duration),
+}
+
 pub(super) struct RotatingLogWriter {
     timezone: gateway_core::time::DeploymentTimeZone,
     directory: PathBuf,
     prefix: &'static str,
     maximum_bytes: u64,
-    retention_days: usize,
+    retention: LogRetention,
+    opened_at: Instant,
     date: NaiveDate,
     segment: usize,
     bytes_written: u64,
@@ -29,19 +37,23 @@ impl RotatingLogWriter {
         directory: PathBuf,
         prefix: &'static str,
         maximum_bytes: u64,
-        retention_days: usize,
+        retention: LogRetention,
         health: Arc<LogHealth>,
         timezone: gateway_core::time::DeploymentTimeZone,
     ) -> io::Result<Self> {
         fs::create_dir_all(&directory)?;
         let date = timezone.local(Utc::now()).date_naive();
-        cleanup_log_files(&directory, prefix, date, retention_days, timezone)?;
+        cleanup_log_files(&directory, prefix, retention, timezone, None)?;
         let latest = managed_log_files(&directory, prefix)?
             .into_iter()
             .filter(|entry| entry.date == date)
             .max_by_key(|entry| (entry.segment, entry.compressed));
         let (segment, bytes_written) = match latest {
-            Some(entry) if !entry.compressed && entry.path.metadata()?.len() < maximum_bytes => {
+            Some(entry)
+                if matches!(retention, LogRetention::CalendarDays(_))
+                    && !entry.compressed
+                    && entry.path.metadata()?.len() < maximum_bytes =>
+            {
                 (entry.segment, entry.path.metadata()?.len())
             }
             Some(entry) => (next_segment(entry.segment)?, 0),
@@ -54,7 +66,8 @@ impl RotatingLogWriter {
             directory,
             prefix,
             maximum_bytes,
-            retention_days,
+            retention,
+            opened_at: Instant::now(),
             date,
             segment,
             bytes_written,
@@ -78,7 +91,14 @@ impl RotatingLogWriter {
         let day_changed = date != self.date;
         let size_exceeded = self.bytes_written > 0
             && self.bytes_written.saturating_add(incoming_bytes as u64) > self.maximum_bytes;
-        if !day_changed && !size_exceeded {
+        // 小流量转储也需及时关闭分片，避免小数保留期仍要等自然日切换才能生效
+        let age_exceeded = match self.retention {
+            LogRetention::CalendarDays(_) => false,
+            LogRetention::Elapsed(duration) => {
+                self.opened_at.elapsed() >= duration.min(Duration::from_secs(3600))
+            }
+        };
+        if !day_changed && !size_exceeded && !age_exceeded {
             return Ok(());
         }
         let previous = self
@@ -104,6 +124,7 @@ impl RotatingLogWriter {
         self.date = date;
         self.segment = segment;
         self.bytes_written = self.file.get_ref().metadata()?.len();
+        self.opened_at = Instant::now();
         if let Err(error) = compress_log_file(&previous) {
             self.health.maintenance_failed(error.kind());
         }
@@ -111,9 +132,9 @@ impl RotatingLogWriter {
         if let Err(error) = cleanup_log_files(
             &self.directory,
             self.prefix,
-            date,
-            self.retention_days,
+            self.retention,
             self.timezone,
+            Some(&path),
         ) {
             self.health.maintenance_failed(error.kind());
         }
@@ -203,17 +224,38 @@ fn managed_log_files(directory: &Path, prefix: &str) -> io::Result<Vec<ManagedLo
 fn cleanup_log_files(
     directory: &Path,
     prefix: &str,
-    today: NaiveDate,
-    retention_days: usize,
+    retention: LogRetention,
     timezone: gateway_core::time::DeploymentTimeZone,
+    active_path: Option<&Path>,
 ) -> io::Result<()> {
+    let files = managed_log_files(directory, prefix)?;
+    let retention_days = match retention {
+        LogRetention::CalendarDays(days) => days,
+        LogRetention::Elapsed(duration) => {
+            let now = SystemTime::now();
+            for entry in files {
+                if active_path == Some(entry.path.as_path()) {
+                    continue;
+                }
+                let modified = entry.path.metadata()?.modified()?;
+                if now
+                    .duration_since(modified)
+                    .is_ok_and(|age| age >= duration)
+                {
+                    fs::remove_file(entry.path)?;
+                }
+            }
+            return Ok(());
+        }
+    };
+    let today = timezone.local(Utc::now()).date_naive();
     let days =
         u64::try_from(retention_days).map_err(|_| io::Error::other("log retention overflow"))?;
     let cutoff = today
         .checked_sub_days(chrono::Days::new(days))
         .unwrap_or(NaiveDate::MIN);
     let mut dates = BTreeMap::<NaiveDate, Vec<PathBuf>>::new();
-    for entry in managed_log_files(directory, prefix)? {
+    for entry in files {
         dates.entry(entry.date).or_default().push(entry.path);
     }
     for (date, paths) in dates {

backend/crates/gateway-host/tests/client_distribution.rs

@@ -30,7 +30,7 @@ fn parser_selects_latest_valid_package_for_each_architecture() {
     assert_eq!(packages[0].architecture, ClientArchitecture::X64);
     assert_eq!(packages[0].version.as_deref(), Some("26.825.6671.0"));
     assert!(packages[0].download_url.starts_with("http://"));
-    assert_eq!(packages[0].size_bytes, Some(744_250_000));
+    assert_eq!(packages[0].size_bytes, Some(780_402_688));
     assert_eq!(packages[1].architecture, ClientArchitecture::Arm64);
     assert!(packages[1].download_url.starts_with("https://"));
 }
@@ -72,3 +72,74 @@ fn missing_architecture_uses_only_its_official_fallback() {
     assert_eq!(packages[1].source, ClientDownloadSource::OfficialOpenAi);
     assert!(warning.is_some_and(|value| value.contains("arm64")));
 }
+
+#[tokio::test]
+async fn official_package_size_reads_head_length_without_downloading_the_body() {
+    use tokio::io::{AsyncReadExt as _, AsyncWriteExt as _};
+
+    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+    let url = format!("http://{}/ChatGPT-x64.msix", listener.local_addr().unwrap());
+    let server = tokio::spawn(async move {
+        let (mut stream, _) = listener.accept().await.unwrap();
+        let mut request = Vec::new();
+        let mut buffer = [0; 1024];
+        while !request.windows(4).any(|bytes| bytes == b"\r\n\r\n") {
+            let read = stream.read(&mut buffer).await.unwrap();
+            assert!(read > 0);
+            request.extend_from_slice(&buffer[..read]);
+        }
+        assert!(request.starts_with(b"HEAD /ChatGPT-x64.msix HTTP/1.1\r\n"));
+        // 只发送响应头，不发送大包正文，证明解析使用文件长度而不是 HEAD 正文长度
+        stream
+            .write_all(b"HTTP/1.1 200 OK\r\ncontent-length: 944929441\r\nconnection: close\r\n\r\n")
+            .await
+            .unwrap();
+    });
+    let client = reqwest::Client::builder().no_proxy().build().unwrap();
+    assert_eq!(
+        gateway_host::client_distribution::official_package_size(&client, &url).await,
+        Some(944_929_441)
+    );
+    server.await.unwrap();
+}
+
+#[tokio::test]
+async fn official_package_size_failure_keeps_metadata_optional() {
+    use wiremock::{
+        Mock, MockServer, ResponseTemplate,
+        matchers::{method, path},
+    };
+
+    let server = MockServer::start().await;
+    for (route, response) in [
+        ("/missing.msix", ResponseTemplate::new(404)),
+        ("/empty.msix", ResponseTemplate::new(200)),
+        (
+            "/slow.msix",
+            ResponseTemplate::new(200).set_delay(std::time::Duration::from_secs(4)),
+        ),
+    ] {
+        Mock::given(method("HEAD"))
+            .and(path(route))
+            .respond_with(response)
+            .expect(1)
+            .mount(&server)
+            .await;
+    }
+    let client = reqwest::Client::builder().no_proxy().build().unwrap();
+    for route in ["/missing.msix", "/empty.msix", "/slow.msix"] {
+        assert_eq!(
+            tokio::time::timeout(
+                std::time::Duration::from_millis(3500),
+                gateway_host::client_distribution::official_package_size(
+                    &client,
+                    &format!("{}{route}", server.uri()),
+                ),
+            )
+            .await
+            .expect("metadata timeout must not wait for the slow response"),
+            None
+        );
+    }
+    server.verify().await;
+}

backend/crates/gateway-host/tests/config.rs

@@ -146,7 +146,7 @@ fn logging_rejects_zero_retention_windows() {
     for request_dump in [false, true] {
         let mut config = valid_config();
         if request_dump {
-            config.logging.request_dump_retention_days = 0;
+            config.logging.request_dump_retention_days = 0.0;
         } else {
             config.logging.file.retention_days = 0;
         }
@@ -168,7 +168,7 @@ fn logging_defaults_to_time_retention_and_ignores_removed_count_retention() {
         "file": { "enabled": true, "directory": "logs", "max_file_size_mb": 20 }
     });
     let config: LoggingConfig = serde_json::from_value(value.clone()).unwrap();
-    assert_eq!(config.request_dump_retention_days, 1);
+    assert_eq!(config.request_dump_retention_days, 1.0);
     assert_eq!(config.file.retention_days, 7);
     assert!(!config.oauth_recovery);
     value["file"]["max_files"] = serde_json::json!(20);
@@ -178,6 +178,55 @@ fn logging_defaults_to_time_retention_and_ignores_removed_count_retention() {
     );
 }
 
+#[test]
+fn request_dump_retention_accepts_integer_and_fractional_yaml_days() {
+    for (input, expected) in [("1", 1.0), ("0.5", 0.5), ("0.25", 0.25), ("1.5", 1.5)] {
+        let yaml = format!(
+            "level: info\nstdout: true\nrequest_dump_retention_days: {input}\nfile:\n  enabled: true\n  directory: logs\n  max_file_size_mb: 20\n"
+        );
+        let mut config = valid_config();
+        config.logging = config::Config::builder()
+            .add_source(config::File::from_str(&yaml, config::FileFormat::Yaml))
+            .build()
+            .unwrap()
+            .try_deserialize()
+            .unwrap();
+        config
+            .resolve_and_validate(
+                std::path::Path::new("/srv/gateway"),
+                std::path::Path::new("/srv/gateway/web/dist"),
+            )
+            .unwrap();
+        assert_eq!(config.logging.request_dump_retention_days, expected);
+    }
+}
+
+#[test]
+fn request_dump_retention_rejects_invalid_durations() {
+    for days in [
+        0.0,
+        -0.5,
+        f64::NAN,
+        f64::INFINITY,
+        f64::NEG_INFINITY,
+        f64::MAX,
+        1e-20,
+    ] {
+        let mut config = valid_config();
+        config.logging.request_dump_retention_days = days;
+        let error = config
+            .resolve_and_validate(
+                std::path::Path::new("/srv/gateway"),
+                std::path::Path::new("/srv/gateway/web/dist"),
+            )
+            .unwrap_err();
+        assert!(matches!(
+            error,
+            gateway_host::ConfigError::InvalidField("host.logging.request_dump_retention_days")
+        ));
+    }
+}
+
 #[test]
 fn dedicated_file_channels_can_be_enabled_without_application_sinks() {
     for oauth_recovery in [false, true] {
@@ -220,7 +269,7 @@ fn valid_config() -> HostConfig {
             },
             oauth_recovery: false,
             request_dump: false,
-            request_dump_retention_days: 1,
+            request_dump_retention_days: 1.0,
         },
         system_update,
         worker_shutdown_timeout_seconds: 30,

backend/crates/gateway-host/tests/logging/mod.rs

@@ -48,7 +48,7 @@ fn logging_requires_at_least_one_sink() {
             },
             oauth_recovery: false,
             request_dump: false,
-            request_dump_retention_days: 1,
+            request_dump_retention_days: 1.0,
         },
         system_update: SystemUpdateConfig::default(),
         worker_shutdown_timeout_seconds: 30,
@@ -325,7 +325,7 @@ fn logging_config(directory: PathBuf, request_dump: bool) -> HostConfig {
             },
             oauth_recovery: true,
             request_dump,
-            request_dump_retention_days: 1,
+            request_dump_retention_days: 1.0,
         },
         system_update: SystemUpdateConfig::default(),
         worker_shutdown_timeout_seconds: 30,

backend/crates/gateway-host/tests/logging/writer.rs

@@ -1,4 +1,4 @@
-//! 验证日志压缩、轮转与重启后按日期保留完整记录
+//! 验证日志压缩、轮转，以及重启后的自然日与小数天数保留窗口
 
 use super::*;
 use std::time::SystemTime;
@@ -10,12 +10,11 @@ fn retention_preserves_complete_dates_across_compression_rotation_and_restart()
     if env::var_os(CHILD_PROCESS_ENV).is_some() {
         with_file_logging(
             PathBuf::from(env::var_os(LOG_DIRECTORY_ENV).unwrap()),
-            true,
+            false,
             || {
                 let payload = "x".repeat(1024 * 1024);
                 // 三条记录已跨过 1 MiB 轮转边界；保留日期的 25 个分段由下方单独构造
                 for sequence in 0..ROTATION_RECORDS {
-                    tracing::info!(target: REQUEST_DUMP_LOG_TARGET, sequence, payload, "retention record");
                     tracing::info!(target: APPLICATION_LOG_TARGET, sequence, payload, "retention record");
                     tracing::info!(target: OAUTH_RECOVERY_LOG_TARGET, sequence, payload, "retention record");
                 }
@@ -32,7 +31,6 @@ fn retention_preserves_complete_dates_across_compression_rotation_and_restart()
     for (prefix, days) in [
         (APPLICATION_LOG_FILE_PREFIX, 7),
         (OAUTH_RECOVERY_LOG_FILE_PREFIX, 7),
-        (REQUEST_DUMP_LOG_FILE_PREFIX, 1),
     ] {
         let boundary = today - chrono::Days::new(days);
         for segment in 1..=25 {
@@ -90,11 +88,7 @@ fn retention_preserves_complete_dates_across_compression_rotation_and_restart()
         );
         assert!(unrelated.exists());
 
-        for prefix in [
-            APPLICATION_LOG_FILE_PREFIX,
-            OAUTH_RECOVERY_LOG_FILE_PREFIX,
-            REQUEST_DUMP_LOG_FILE_PREFIX,
-        ] {
+        for prefix in [APPLICATION_LOG_FILE_PREFIX, OAUTH_RECOVERY_LOG_FILE_PREFIX] {
             let body = read_log_file_set(directory.path(), prefix);
             let mut sequences = [0; ROTATION_RECORDS];
             let mut boundaries = std::collections::BTreeSet::new();
@@ -141,6 +135,151 @@ fn retention_preserves_complete_dates_across_compression_rotation_and_restart()
     }
 }
 
+#[test]
+fn request_dump_retention_uses_elapsed_time_across_compression_and_restart() {
+    const RETENTION_ENV: &str = "CPR_LOGGING_TEST_RETENTION_DAYS";
+    if env::var_os(CHILD_PROCESS_ENV).is_some() {
+        let mut config =
+            logging_config(PathBuf::from(env::var_os(LOG_DIRECTORY_ENV).unwrap()), true);
+        config.logging.request_dump_retention_days =
+            env::var(RETENTION_ENV).unwrap().parse().unwrap();
+        with_logging(config, || {
+            let payload = "x".repeat(1024 * 1024);
+            for sequence in 0..ROTATION_RECORDS {
+                tracing::info!(target: REQUEST_DUMP_LOG_TARGET, sequence, payload, "elapsed retention record");
+            }
+        });
+        return;
+    }
+
+    for days in [0.25, 0.5, 1.0, 1.5] {
+        let directory = tempfile::tempdir().unwrap();
+        let now = chrono::Utc::now();
+        let cutoff = now - chrono::Duration::seconds((days * 86_400.0) as i64);
+        let mut retained = Vec::new();
+        let mut expired = Vec::new();
+        // 同一日期内既有过期文件也有有效文件，文件名日期不覆盖实际修改时间
+        for (segment, modified, keep) in [
+            (0, cutoff - chrono::Duration::minutes(1), false),
+            (1, cutoff + chrono::Duration::minutes(1), true),
+            (2, now + chrono::Duration::hours(1), true),
+        ] {
+            let path = directory.path().join(format!(
+                "{REQUEST_DUMP_LOG_FILE_PREFIX}{}.{segment}.log",
+                now.date_naive()
+            ));
+            fs::write(&path, format!("seed-{segment}\n")).unwrap();
+            fs::File::open(&path)
+                .unwrap()
+                .set_modified(modified.into())
+                .unwrap();
+            if keep {
+                let modified = path.metadata().unwrap().modified().unwrap();
+                retained.push((path, modified));
+            } else {
+                expired.push(path);
+            }
+        }
+        // 归档的修改时间也参与清理，压缩不能重置保留窗口
+        let archive = directory.path().join(format!(
+            "{REQUEST_DUMP_LOG_FILE_PREFIX}{}.3.log.gz",
+            now.date_naive() - chrono::Days::new(3)
+        ));
+        let mut encoder = flate2::write::GzEncoder::new(
+            fs::File::create(&archive).unwrap(),
+            flate2::Compression::fast(),
+        );
+        std::io::Write::write_all(&mut encoder, b"expired archive\n").unwrap();
+        encoder
+            .finish()
+            .unwrap()
+            .set_modified((cutoff - chrono::Duration::hours(1)).into())
+            .unwrap();
+        expired.push(archive);
+        let unrelated = directory.path().join("unmanaged.log");
+        fs::write(&unrelated, "unmanaged\n").unwrap();
+
+        for run in 1..=2 {
+            let output = Command::new(env::current_exe().unwrap())
+                .args(["--exact", "logging::writer::request_dump_retention_uses_elapsed_time_across_compression_and_restart"])
+                .env(CHILD_PROCESS_ENV, "1")
+                .env(LOG_DIRECTORY_ENV, directory.path())
+                .env(LOG_TIMEZONE_ENV, "America/New_York")
+                .env(RETENTION_ENV, days.to_string())
+                .env("RUST_LOG", "off")
+                .output().unwrap();
+            assert!(
+                output.status.success(),
+                "{}",
+                String::from_utf8_lossy(&output.stderr)
+            );
+            for (path, modified) in &retained {
+                let archive = path.with_extension("log.gz");
+                assert!(archive.exists());
+                assert_eq!(archive.metadata().unwrap().modified().unwrap(), *modified);
+            }
+            assert!(
+                expired
+                    .iter()
+                    .all(|path| !path.exists() && !path.with_extension("log.gz").exists())
+            );
+            assert!(unrelated.exists());
+            let body = read_log_file_set(directory.path(), REQUEST_DUMP_LOG_FILE_PREFIX);
+            assert!(body.contains("seed-1\n") && body.contains("seed-2\n"));
+            assert_eq!(
+                body.matches("elapsed retention record").count(),
+                run * ROTATION_RECORDS
+            );
+        }
+    }
+}
+
+#[test]
+fn request_dump_rotates_small_files_when_the_time_window_elapses() {
+    if env::var_os(CHILD_PROCESS_ENV).is_some() {
+        let directory = PathBuf::from(env::var_os(LOG_DIRECTORY_ENV).unwrap());
+        let mut config = logging_config(directory.clone(), true);
+        config.logging.request_dump_retention_days = 1.0 / 86_400.0;
+        with_logging(config, || {
+            tracing::info!(target: REQUEST_DUMP_LOG_TARGET, "before retention window");
+            let deadline = std::time::Instant::now() + std::time::Duration::from_secs(5);
+            loop {
+                let body = read_log_file_set(&directory, REQUEST_DUMP_LOG_FILE_PREFIX);
+                if body.contains("before retention window") {
+                    break;
+                }
+                assert!(
+                    std::time::Instant::now() < deadline,
+                    "first record was not flushed"
+                );
+                std::thread::sleep(std::time::Duration::from_millis(10));
+            }
+            std::thread::sleep(std::time::Duration::from_millis(1100));
+            tracing::info!(target: REQUEST_DUMP_LOG_TARGET, "after retention window");
+        });
+        return;
+    }
+    let directory = tempfile::tempdir().unwrap();
+    let output = Command::new(env::current_exe().unwrap())
+        .args([
+            "--exact",
+            "logging::writer::request_dump_rotates_small_files_when_the_time_window_elapses",
+        ])
+        .env(CHILD_PROCESS_ENV, "1")
+        .env(LOG_DIRECTORY_ENV, directory.path())
+        .env("RUST_LOG", "off")
+        .output()
+        .unwrap();
+    assert!(
+        output.status.success(),
+        "{}",
+        String::from_utf8_lossy(&output.stderr)
+    );
+    let body = read_log_file_set(directory.path(), REQUEST_DUMP_LOG_FILE_PREFIX);
+    assert!(!body.contains("before retention window"));
+    assert!(body.contains("after retention window"));
+}
+
 fn seed_log(path: &Path, date: chrono::NaiveDate, body: &str) {
     fs::write(path, body).unwrap();
     let modified = gateway_core::time::DeploymentTimeZone::default()

backend/crates/gateway-host/tests/support/host.rs

@@ -56,7 +56,7 @@ pub fn configuration(directory: &Path) -> HostConfig {
             },
             oauth_recovery: false,
             request_dump: false,
-            request_dump_retention_days: 1,
+            request_dump_retention_days: 1.0,
         },
         system_update: Default::default(),
         worker_shutdown_timeout_seconds: 1,

backend/crates/gateway-store/src/admin_adapter.rs

@@ -286,17 +286,17 @@ impl AuthStore for AuthStoreAdapter {
         .map_err(|error| admin_store_error("authentication session", error))
     }
 
-    async fn renew_session(
+    async fn compare_exchange_session(
         &self,
         session_id: &str,
         expected: &AuthSession,
-        expires_at: chrono::DateTime<chrono::Utc>,
+        replacement: Option<&AuthSession>,
     ) -> AdminStoreResult<Option<AuthSession>> {
-        redis::AuthStateRepository::renew_session(
+        redis::AuthStateRepository::compare_exchange_session(
             &self.state,
             session_id,
             &auth_session_record(expected),
-            expires_at,
+            replacement.map(auth_session_record).as_ref(),
         )
         .await
         .map_err(|error| admin_store_error("authentication session renewal", error))?
@@ -399,6 +399,7 @@ fn auth_session(record: redis::AuthSessionRecord) -> AdminStoreResult<AuthSessio
         subject,
         expires_at: record.expires_at,
         absolute_expires_at: record.absolute_expires_at,
+        renewal: record.renewal,
     })
 }
 
@@ -419,5 +420,6 @@ fn auth_session_record(session: &AuthSession) -> redis::AuthSessionRecord {
         subject,
         expires_at: session.expires_at,
         absolute_expires_at: session.absolute_expires_at,
+        renewal: session.renewal.clone(),
     }
 }

backend/crates/gateway-store/src/redis/auth.rs

@@ -55,13 +55,28 @@ pub struct AuthSessionRecord {
     pub subject: SessionSubjectRecord,
     pub expires_at: DateTime<Utc>,
     pub absolute_expires_at: Option<DateTime<Utc>>,
+    pub renewal: Option<gateway_admin::model::auth::SessionRenewal>,
 }
 
 impl AuthSessionRecord {
     fn validate(&self) -> StoreResult<u64> {
         self.subject.validate()?;
-        let expires_at_millis = u64::try_from(self.expires_at.timestamp_millis())
-            .map_err(|_| auth_invalid("session expiry must be after the Unix epoch"))?;
+        if let Some(renewal) = &self.renewal
+            && (!matches!(self.subject, SessionSubjectRecord::Admin { .. })
+                || self.expires_at > renewal.expires_at
+                || self
+                    .absolute_expires_at
+                    .is_none_or(|limit| renewal.expires_at > limit))
+        {
+            return Err(auth_invalid("invalid renewable session lifetime"));
+        }
+        let expires_at_millis = u64::try_from(
+            self.renewal
+                .as_ref()
+                .map_or(self.expires_at, |renewal| renewal.expires_at)
+                .timestamp_millis(),
+        )
+        .map_err(|_| auth_invalid("session expiry must be after the Unix epoch"))?;
         if expires_at_millis > MAX_REDIS_EXACT_INTEGER {
             return Err(auth_invalid(
                 "session expiry is outside the supported range",
@@ -82,11 +97,11 @@ pub trait AuthStateRepository: Send + Sync {
     async fn store_session(&self, session_id: &str, session: &AuthSessionRecord)
     -> StoreResult<()>;
     async fn delete_session(&self, session_id: &str) -> StoreResult<Option<AuthSessionRecord>>;
-    async fn renew_session(
+    async fn compare_exchange_session(
         &self,
         session_id: &str,
         expected: &AuthSessionRecord,
-        expires_at: DateTime<Utc>,
+        replacement: Option<&AuthSessionRecord>,
     ) -> StoreResult<Option<AuthSessionRecord>>;
     async fn consume_login_attempt(
         &self,
@@ -127,29 +142,26 @@ impl RedisAuthStateRepository {
 
 #[async_trait]
 impl AuthStateRepository for RedisAuthStateRepository {
-    async fn renew_session(
+    async fn compare_exchange_session(
         &self,
         session_id: &str,
         expected: &AuthSessionRecord,
-        expires_at: DateTime<Utc>,
+        replacement: Option<&AuthSessionRecord>,
     ) -> StoreResult<Option<AuthSessionRecord>> {
-        if expires_at < expected.expires_at
-            || expected
-                .absolute_expires_at
-                .is_none_or(|limit| expires_at > limit)
-        {
-            return Err(auth_invalid("session renewal is outside its lifetime"));
-        }
-        let renewed = AuthSessionRecord {
-            expires_at,
-            ..expected.clone()
-        };
-        let expiry = renewed.validate()?;
+        let payload = replacement.map(encode_session).transpose()?;
+        let expiry = replacement
+            .map(AuthSessionRecord::validate)
+            .transpose()?
+            .unwrap_or(0);
         // 比较和写入在同一脚本完成；GET 会检查 Redis 到期，退出后的键不能复活
         let payload: Option<String> = Script::new(
             r#"
 local current = redis.call('GET', KEYS[1])
 if current == ARGV[1] then
+    if ARGV[2] == '' then
+        redis.call('DEL', KEYS[1])
+        return nil
+    end
     redis.call('SET', KEYS[1], ARGV[2], 'PXAT', ARGV[3], 'XX')
     return ARGV[2]
 end
@@ -158,7 +170,7 @@ return current
         )
         .key(self.session_key(session_id)?)
         .arg(encode_session(expected)?)
-        .arg(encode_session(&renewed)?)
+        .arg(payload.unwrap_or_default())
         .arg(expiry)
         .invoke_async(&mut self.connection.clone())
         .await
@@ -250,11 +262,14 @@ struct AuthSessionWire {
     expires_at: String,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     absolute_expires_at: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    renewal: Option<gateway_admin::model::auth::SessionRenewal>,
 }
 
 fn encode_session(session: &AuthSessionRecord) -> StoreResult<String> {
     serde_json::to_string(&AuthSessionWire {
         subject: session.subject.clone(),
+        renewal: session.renewal.clone(),
         expires_at: session
             .expires_at
             .to_rfc3339_opts(SecondsFormat::Nanos, true),
@@ -277,6 +292,7 @@ fn decode_session(value: &str) -> StoreResult<AuthSessionRecord> {
     let expires_at = parse(&wire.expires_at)?;
     Ok(AuthSessionRecord {
         subject: wire.subject,
+        renewal: wire.renewal,
         expires_at,
         absolute_expires_at: wire.absolute_expires_at.as_deref().map(parse).transpose()?,
     })

backend/crates/gateway-store/tests/redis/auth.rs

@@ -20,6 +20,7 @@ async fn client_session_should_use_fixed_ttl_without_storing_session_or_api_key_
         subject: SessionSubjectRecord::Key {
             client_key_id: "key-42".to_owned(),
         },
+        renewal: None,
         absolute_expires_at: None,
         expires_at: Utc::now() + chrono::Duration::seconds(60),
     };
@@ -116,6 +117,7 @@ async fn client_session_should_reject_invalid_intervals_and_rate_limit_policies(
         subject: SessionSubjectRecord::Key {
             client_key_id: "key-42".to_owned(),
         },
+        renewal: None,
         absolute_expires_at: None,
         expires_at: now,
     };
@@ -156,6 +158,7 @@ fn admin_auth_state_rejects_invalid_ttl_boundaries() {
             credential_fingerprint: String::new(),
             admin_user_id: "admin".to_owned(),
         },
+        renewal: None,
         absolute_expires_at: None,
         expires_at: Utc::now() - chrono::Duration::seconds(1),
     };
@@ -183,6 +186,7 @@ async fn admin_auth_state_keeps_fixed_ttl_and_opaque_keys() {
             credential_fingerprint: "test-password-fingerprint".to_owned(),
             admin_user_id: "default-admin".to_owned(),
         },
+        renewal: None,
         absolute_expires_at: None,
         expires_at: Utc::now() + chrono::Duration::seconds(60),
     };
@@ -252,6 +256,7 @@ async fn unified_session_rejects_invalid_identities_and_loads_legacy_admin_paylo
                 subject: SessionSubjectRecord::Key {
                     client_key_id: "key-42".to_owned(),
                 },
+                renewal: None,
                 absolute_expires_at: None,
                 expires_at: Utc::now() + chrono::Duration::seconds(60),
             },
@@ -309,83 +314,83 @@ async fn unified_session_rejects_invalid_identities_and_loads_legacy_admin_paylo
     );
 }
 
-#[tokio::test]
-async fn renewal_is_atomic_monotonic_and_cannot_resurrect_a_deleted_session() {
-    let Some((repository, _, _)) = auth_repository().await else {
-        return;
-    };
-    let original = AuthSessionRecord {
+fn renewable_record() -> AuthSessionRecord {
+    AuthSessionRecord {
         subject: SessionSubjectRecord::Admin {
             admin_user_id: "admin".into(),
             credential_fingerprint: "fingerprint".into(),
         },
-        expires_at: Utc::now() + chrono::Duration::minutes(1),
+        expires_at: Utc::now() - chrono::Duration::minutes(1),
         absolute_expires_at: Some(Utc::now() + chrono::Duration::minutes(10)),
+        renewal: Some(gateway_admin::model::auth::SessionRenewal {
+            expires_at: Utc::now() + chrono::Duration::minutes(5),
+            access_digest: [1; 32],
+            refresh_digest: [2; 32],
+            previous: None,
+        }),
+    }
+}
+
+#[tokio::test]
+async fn rotation_is_atomic_and_logout_cannot_be_undone_by_inflight_refresh() {
+    let Some((repository, _, _)) = auth_repository().await else {
+        return;
     };
+    let original = renewable_record();
     repository
-        .store_session("renewal", &original)
+        .store_session("rotation", &original)
         .await
         .unwrap();
-    let expiry = Utc::now() + chrono::Duration::minutes(5);
+    let mut replacement = original.clone();
+    replacement.expires_at = Utc::now() + chrono::Duration::minutes(1);
+    replacement.renewal.as_mut().unwrap().refresh_digest = [3; 32];
+    let mut competing = replacement.clone();
+    competing.renewal.as_mut().unwrap().refresh_digest = [4; 32];
     let (first, second) = tokio::join!(
-        repository.renew_session("renewal", &original, expiry),
-        repository.renew_session("renewal", &original, expiry + chrono::Duration::minutes(1)),
+        repository.compare_exchange_session("rotation", &original, Some(&replacement)),
+        repository.compare_exchange_session("rotation", &original, Some(&competing)),
     );
     let first = first.unwrap().unwrap();
-    assert_eq!(Some(first.clone()), second.unwrap());
-    assert_eq!(first.absolute_expires_at, original.absolute_expires_at);
-    assert!(first.expires_at >= expiry);
+    assert_eq!(second.unwrap(), Some(first.clone()));
+    assert_eq!(
+        repository.load_session("rotation").await.unwrap(),
+        Some(first.clone())
+    );
+    // 过时快照不能撤销已轮换的状态；领域层重新核对后才决定是否撤销
     assert_eq!(
         repository
-            .renew_session("renewal", &original, original.expires_at)
+            .compare_exchange_session("rotation", &original, None)
             .await
             .unwrap(),
         Some(first.clone())
     );
     assert!(
         repository
-            .renew_session(
-                "renewal",
-                &first,
-                original.absolute_expires_at.unwrap() + chrono::Duration::seconds(1)
-            )
-            .await
-            .is_err()
-    );
-    repository.delete_session("renewal").await.unwrap();
-    assert!(
-        repository
-            .renew_session("renewal", &first, expiry + chrono::Duration::minutes(2))
+            .compare_exchange_session("rotation", &first, None)
             .await
             .unwrap()
             .is_none()
     );
-    assert!(repository.load_session("renewal").await.unwrap().is_none());
+    assert!(
+        repository
+            .compare_exchange_session("rotation", &first, Some(&replacement))
+            .await
+            .unwrap()
+            .is_none()
+    );
+    assert!(repository.load_session("rotation").await.unwrap().is_none());
 }
 
 #[tokio::test]
-async fn renewal_updates_redis_ttl_and_rejects_a_key_that_expired_after_loading() {
+async fn redis_retains_refresh_after_access_expiry_but_never_resurrects_expired_sessions() {
     let Some((repository, mut connection, namespace)) = auth_repository().await else {
         return;
     };
-    let original = AuthSessionRecord {
-        subject: SessionSubjectRecord::Admin {
-            admin_user_id: "admin".into(),
-            credential_fingerprint: "fingerprint".into(),
-        },
-        expires_at: Utc::now() + chrono::Duration::minutes(1),
-        absolute_expires_at: Some(Utc::now() + chrono::Duration::minutes(10)),
-    };
+    let original = renewable_record();
     repository
         .store_session("expiry-race", &original)
         .await
         .unwrap();
-    let expiry = Utc::now() + chrono::Duration::minutes(5);
-    let renewed = repository
-        .renew_session("expiry-race", &original, expiry)
-        .await
-        .unwrap()
-        .unwrap();
     let keys: Vec<String> = redis::cmd("KEYS")
         .arg(format!("{namespace}:session:*"))
         .query_async(&mut connection)
@@ -397,6 +402,25 @@ async fn renewal_updates_redis_ttl_and_rejects_a_key_that_expired_after_loading(
         .await
         .unwrap();
     assert!((240_000..=300_000).contains(&ttl));
+    assert_eq!(
+        repository.load_session("expiry-race").await.unwrap(),
+        Some(original.clone())
+    );
+    let mut replacement = original.clone();
+    replacement.renewal.as_mut().unwrap().expires_at = Utc::now() + chrono::Duration::minutes(6);
+    assert_eq!(
+        repository
+            .compare_exchange_session("expiry-race", &original, Some(&replacement))
+            .await
+            .unwrap(),
+        Some(replacement.clone())
+    );
+    let ttl: i64 = redis::cmd("PTTL")
+        .arg(&keys[0])
+        .query_async(&mut connection)
+        .await
+        .unwrap();
+    assert!((300_000..=360_000).contains(&ttl));
     redis::cmd("PEXPIRE")
         .arg(&keys[0])
         .arg(1)
@@ -406,11 +430,7 @@ async fn renewal_updates_redis_ttl_and_rejects_a_key_that_expired_after_loading(
     tokio::time::sleep(Duration::from_millis(20)).await;
     assert!(
         repository
-            .renew_session(
-                "expiry-race",
-                &renewed,
-                expiry + chrono::Duration::minutes(1)
-            )
+            .compare_exchange_session("expiry-race", &replacement, Some(&replacement))
             .await
             .unwrap()
             .is_none()

backend/crates/providers/openai/src/credential/quota/warmup.rs

@@ -164,10 +164,8 @@ impl CodexCredentialQuotaService {
                 "service_tier".to_owned(),
                 Value::String("default".to_owned()),
             );
-            body.insert(
-                "reasoning".to_owned(),
-                serde_json::json!({"effort": "none"}),
-            );
+            // 目录里各模型的最低档都是 low，none 会收到上游 error 终态并让整次预热记为失败
+            body.insert("reasoning".to_owned(), serde_json::json!({"effort": "low"}));
             body.insert("text".to_owned(), serde_json::json!({"verbosity": "low"}));
 
             let upstream_request = CodexResponsesRequest::from_body(body);

backend/crates/providers/openai/src/credential/selector.rs

@@ -1758,6 +1758,8 @@ pub enum CredentialSelectionError {
     InvalidCredential(#[source] Option<ErrorSource>),
     #[error("Codex account changed repeatedly during selection")]
     AccountSnapshotChanged,
+    #[error("Codex credential revision conflict")]
+    RevisionConflict(#[source] ErrorSource),
     #[error("Codex account store is unavailable")]
     Store(#[source] ErrorSource),
     #[error("Codex account lease runtime is unavailable")]
@@ -1776,8 +1778,10 @@ impl From<CredentialRepositoryError> for CredentialSelectionError {
             CredentialRepositoryError::InvalidCredentialData(_) => {
                 Self::InvalidCredential(Some(ErrorSource::new(error)))
             }
-            CredentialRepositoryError::RevisionConflict(_)
-            | CredentialRepositoryError::Store(_) => Self::Store(ErrorSource::new(error)),
+            CredentialRepositoryError::RevisionConflict(_) => {
+                Self::RevisionConflict(ErrorSource::new(error))
+            }
+            CredentialRepositoryError::Store(_) => Self::Store(ErrorSource::new(error)),
         }
     }
 }

backend/crates/providers/openai/src/provider/execution.rs

@@ -919,18 +919,33 @@ pub(super) fn cold_response_stream(response: ColdResponse) -> EventStream {
         }
         if allows_account_state_mutation
             && !response.set_cookie_headers.is_empty()
-            && let Ok(outcome) = selector
+        {
+            match selector
                 .capture_response_cookies(
                     &active_account,
                     &response_origin,
                     &response.set_cookie_headers,
                 )
                 .await
-                && let Some(revision) = outcome.credential_revision
-                && let Ok(current) = selector.current_account(active_account.id()).await
-                && current.revision().get() == revision
-        {
-            active_account = current;
+            {
+                Ok(outcome) => {
+                    if let Some(revision) = outcome.credential_revision
+                        && let Ok(current) = selector.current_account(active_account.id()).await
+                        && current.revision().get() == revision
+                    {
+                        active_account = current;
+                    }
+                }
+                Err(error) => {
+                    tracing::warn!(
+                        request_id = %request_id,
+                        account_id = %active_account.id(),
+                        credential_revision = active_account.revision().get(),
+                        error = %error,
+                        "Failed to persist OpenAI response cookies"
+                    );
+                }
+            }
         }
         let response_transport = response.transport;
         let websocket_connection_id = response.websocket_connection_id;
@@ -940,7 +955,6 @@ pub(super) fn cold_response_stream(response: ColdResponse) -> EventStream {
             // opening ID 标识连接，不可作为缺失请求级错误头时的当前请求 ID
             failure_diagnostics.request_id = None;
         }
-        let failure_set_cookie_headers = response.set_cookie_headers.clone();
         let failure_rate_limit_headers = response.rate_limit_headers.clone();
         let mut passive_quota_observation =
             OpenAiPassiveQuotaObservation::new(response.rate_limit_headers);
@@ -1110,7 +1124,6 @@ pub(super) fn cold_response_stream(response: ColdResponse) -> EventStream {
                     map_canonical_error(
                         error,
                         &failure_diagnostics,
-                        &failure_set_cookie_headers,
                         &failure_rate_limit_headers,
                         ReplayBoundary::from_semantic_output(
                             semantic_output_seen || client_events.replay_closed(),
@@ -1226,7 +1239,6 @@ pub(super) fn cold_response_stream(response: ColdResponse) -> EventStream {
                 map_canonical_error(
                     error,
                     &failure_diagnostics,
-                    &failure_set_cookie_headers,
                     &failure_rate_limit_headers,
                     ReplayBoundary::from_semantic_output(
                         semantic_output_seen || client_events.replay_closed(),

backend/crates/providers/openai/src/provider/failure.rs

@@ -351,6 +351,7 @@ pub(super) async fn apply_failure(
     {
         tracing::warn!(
             account_id = %account.id(),
+            credential_revision = account.revision().get(),
             error = %error,
             "Failed to persist OpenAI response cookies"
         );
@@ -462,7 +463,7 @@ pub(super) fn apply_websocket_recovery_policy(
     if failure.error.retry_is_prohibited() {
         return;
     }
-    // 明确账号拒绝走已有换号路径，容量拒绝走请求内退避；两者都不消耗 WS 传输预算
+    // 明确账号拒绝走已有换号路径，业务瞬态失败走请求内退避，不消耗 WS 传输预算
     if failure.error.replay_is_safe()
         && (failure.account_failure.is_some()
             || matches!(
@@ -711,7 +712,6 @@ pub(super) fn stream_transport_allows_pre_delivery_retry(error: &CodexClientErro
 pub(super) fn map_canonical_error(
     error: CodexCanonicalError,
     diagnostics: &CodexUpstreamDiagnostics,
-    set_cookie_headers: &[String],
     rate_limit_headers: &[(String, String)],
     replay_boundary: ReplayBoundary,
 ) -> MappedProviderFailure {
@@ -721,7 +721,8 @@ pub(super) fn map_canonical_error(
             CodexUpstreamFailure::from_sse_failure(
                 &failure,
                 diagnostics,
-                set_cookie_headers,
+                // 响应头在开始消费流时已写回，流内失败不重放同一批 Cookie
+                &[],
                 rate_limit_headers,
                 CodexUpstreamSendPhase::AfterPayload,
             ),
@@ -1326,6 +1327,7 @@ pub(super) fn map_upstream_failure(
 ) -> MappedProviderFailure {
     let category = failure.category();
     let capacity_unavailable = category == CodexFailureCategory::CapacityUnavailable;
+    let transient_retry = capacity_unavailable || failure.is_retryable_server_error();
     let cyber_policy_failure = failure
         .status
         .is_some_and(|status| status.is_client_error())
@@ -1392,7 +1394,7 @@ pub(super) fn map_upstream_failure(
     if let Some(retry_after) = failure.retry_after_seconds.map(Duration::from_secs) {
         error = error.with_retry_after(retry_after);
     }
-    if capacity_unavailable && error.replay_is_safe() {
+    if transient_retry && error.replay_is_safe() {
         let max_delay = Duration::from_secs(8);
         error = error.with_transient_retry(
             NonZeroU32::new(3).unwrap_or(NonZeroU32::MIN),
@@ -1462,7 +1464,9 @@ pub(super) const fn provider_error_kind(category: CodexFailureCategory) -> Provi
             ProviderErrorKind::PermissionDenied
         }
         CodexFailureCategory::UsageLimitExhausted => ProviderErrorKind::QuotaExhausted,
-        CodexFailureCategory::RateLimited => ProviderErrorKind::RateLimited,
+        CodexFailureCategory::RateLimited | CodexFailureCategory::TurnRateLimited => {
+            ProviderErrorKind::RateLimited
+        }
         CodexFailureCategory::QuotaExhausted => ProviderErrorKind::QuotaExhausted,
         CodexFailureCategory::CloudflareChallenge
         | CodexFailureCategory::CloudflarePathBlocked
@@ -1517,6 +1521,7 @@ pub(super) fn account_failure(
             Some(CodexAccountFailure::CloudflarePathBlocked)
         }
         CodexFailureCategory::ModelUnsupported
+        | CodexFailureCategory::TurnRateLimited
         | CodexFailureCategory::InvalidRequest
         | CodexFailureCategory::PermissionDenied
         | CodexFailureCategory::Timeout

backend/crates/providers/openai/src/provider/observation.rs

@@ -812,6 +812,9 @@ pub(super) fn map_selection_error(error: CredentialSelectionError) -> ProviderEr
 fn selection_failure(error: &CredentialSelectionError) -> ProviderError {
     let diagnostic_code = match error {
         CredentialSelectionError::InvalidCredential(_) => Some("account_credential_invalid"),
+        CredentialSelectionError::RevisionConflict(_) => {
+            Some("account_credential_revision_conflict")
+        }
         CredentialSelectionError::Store(_) => Some("account_store_unavailable"),
         CredentialSelectionError::Coordinator(_) => Some("account_coordinator_unavailable"),
         CredentialSelectionError::CookiePolicy(_) => Some("account_cookie_policy_rejected"),
@@ -861,6 +864,7 @@ fn selection_failure(error: &CredentialSelectionError) -> ProviderError {
                 .with_classification("account_selection", "account_snapshot_conflict"),
         ),
         CredentialSelectionError::InvalidCredential(_)
+        | CredentialSelectionError::RevisionConflict(_)
         | CredentialSelectionError::Store(_)
         | CredentialSelectionError::Coordinator(_)
         | CredentialSelectionError::CookiePolicy(_) => provider_error(

backend/crates/providers/openai/src/transport/diagnostics.rs

@@ -36,7 +36,7 @@ pub enum CodexUpstreamSendPhase {
     Ambiguous,
 }
 
-/// Transport 边界对上游失败的账号级分类
+/// Transport 边界对上游失败的分类
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub enum CodexFailureCategory {
     ModelUnsupported,
@@ -46,6 +46,8 @@ pub enum CodexFailureCategory {
     /// 当前用量窗口已经耗尽，但存在自动恢复的重置时间
     UsageLimitExhausted,
     RateLimited,
+    /// 当前 turn 的限流交给客户端等待，不据此推导账号级冷却
+    TurnRateLimited,
     QuotaExhausted,
     CloudflareChallenge,
     CloudflarePathBlocked,
@@ -174,29 +176,40 @@ impl CodexUpstreamFailure {
         }
     }
 
-    /// 返回账号级失败分类
+    /// 返回上游失败分类
     #[must_use]
     pub const fn category(&self) -> CodexFailureCategory {
         self.category
     }
 
-    /// 只有明确识别的账号或容量拒绝才允许网关重放，普通上游错误交给客户端
+    /// 明确的 503 server_error 允许有界恢复，不把普通 5xx 当作容量或账号故障
+    pub(crate) fn is_retryable_server_error(&self) -> bool {
+        self.category == CodexFailureCategory::Unavailable
+            && self.status == Some(StatusCode::SERVICE_UNAVAILABLE)
+            && self
+                .code
+                .as_deref()
+                .is_some_and(|code| code.trim().eq_ignore_ascii_case("server_error"))
+    }
+
+    /// 只对明确识别的账号、容量拒绝或 503 server_error 提供重放资格
     #[must_use]
-    pub const fn replay_is_safe(&self) -> bool {
+    pub fn replay_is_safe(&self) -> bool {
         !matches!(self.send_phase, CodexUpstreamSendPhase::Ambiguous)
-            && matches!(
-                self.category,
-                CodexFailureCategory::ModelUnsupported
-                    | CodexFailureCategory::CredentialExpired
-                    | CodexFailureCategory::IdentityVerificationRequired
-                    | CodexFailureCategory::Banned
-                    | CodexFailureCategory::UsageLimitExhausted
-                    | CodexFailureCategory::RateLimited
-                    | CodexFailureCategory::QuotaExhausted
-                    | CodexFailureCategory::CloudflareChallenge
-                    | CodexFailureCategory::CloudflarePathBlocked
-                    | CodexFailureCategory::CapacityUnavailable
-            )
+            && (self.is_retryable_server_error()
+                || matches!(
+                    self.category,
+                    CodexFailureCategory::ModelUnsupported
+                        | CodexFailureCategory::CredentialExpired
+                        | CodexFailureCategory::IdentityVerificationRequired
+                        | CodexFailureCategory::Banned
+                        | CodexFailureCategory::UsageLimitExhausted
+                        | CodexFailureCategory::RateLimited
+                        | CodexFailureCategory::QuotaExhausted
+                        | CodexFailureCategory::CloudflareChallenge
+                        | CodexFailureCategory::CloudflarePathBlocked
+                        | CodexFailureCategory::CapacityUnavailable
+                ))
     }
 
     pub(crate) fn upstream_code(&self) -> Option<&str> {
@@ -378,6 +391,9 @@ fn classify_upstream_failure(
     if code == "flex_unavailable" {
         return CodexFailureCategory::FlexUnavailable;
     }
+    if code == "turn_rate_limit_exceeded" {
+        return CodexFailureCategory::TurnRateLimited;
+    }
 
     // 容量拒绝可能带 400/429/503；仅用结构化错误字段识别，不能扫描任意正文
     if is_capacity_error(

backend/crates/providers/openai/src/transport/websocket/exchange/mod.rs

@@ -68,6 +68,8 @@ pub type CodexWebSocketResponseMetadataUpdates = Arc<Mutex<CodexWebSocketRespons
 pub(super) fn reusable_websocket_metadata(
     mut metadata: CodexWebSocketConnectionMetadata,
 ) -> CodexWebSocketConnectionMetadata {
+    // 握手 Cookie 只属于首次响应，复用旧头会重复写入并覆盖后续轮换结果
+    metadata.set_cookie_headers.clear();
     metadata.rate_limit_headers.clear();
     metadata.turn_state = None;
     // 模型报告属于上一轮请求，池中连接不能把它带到下一轮缺失报告的响应

backend/crates/providers/openai/tests/credential/contract/mod.rs

@@ -1840,6 +1840,41 @@ fn cloudflare_path_block_deletes_provider_owned_cookies() {
     assert!(data.cookies().is_empty());
 }
 
+#[test]
+fn stale_response_cookie_capture_reports_revision_conflict_and_preserves_newer_cookie() {
+    let store = Arc::new(MemoryAccountStore::default());
+    create_account(&store, "acct_primary", "at-primary");
+    let selector = selector(&store, Arc::new(TestLeaseCoordinator::default()));
+    let origin = Url::parse("https://chatgpt.com/backend-api/codex/responses").unwrap();
+    let stale = store.account("acct_primary").unwrap();
+    block_on(selector.capture_response_cookies(
+        &stale,
+        &origin,
+        &["cf_clearance=newer; Path=/; Secure; Max-Age=3600".to_owned()],
+    ))
+    .unwrap();
+    let current = store.account("acct_primary").unwrap();
+
+    let error = block_on(selector.capture_response_cookies(
+        &stale,
+        &origin,
+        &["cf_clearance=older; Path=/; Secure; Max-Age=3600".to_owned()],
+    ))
+    .unwrap_err();
+
+    assert!(matches!(
+        error,
+        CredentialSelectionError::RevisionConflict(_)
+    ));
+    assert_eq!(error.to_string(), "Codex credential revision conflict");
+    assert_eq!(
+        store.account("acct_primary").unwrap().revision(),
+        current.revision()
+    );
+    let data = block_on(store.repository().load_complete_data(&current)).unwrap();
+    assert_eq!(data.cookies()[0].value, "newer");
+}
+
 #[test]
 fn response_cookie_rotation_returns_a_current_account_for_later_fenced_writes() {
     let store = Arc::new(MemoryAccountStore::default());

backend/crates/providers/openai/tests/credential/quota/warmup.rs

@@ -1,4 +1,4 @@
-//! 验证额度预热按 SSE 终态判定结果并跳过过期凭据
+//! 验证额度预热按 SSE 终态判定结果、请求档位并跳过过期凭据
 
 use super::*;
 
@@ -40,6 +40,43 @@ async fn warmup_consumes_completed_sse_and_persists_rate_limit_event() {
     assert!(store.quota_json("acct_warmup_completed").is_some());
 }
 
+#[tokio::test]
+async fn warmup_sends_the_lowest_reasoning_effort_supported_by_the_catalog() {
+    let server = MockServer::start().await;
+    let sse = concat!(
+        "event: response.completed\n",
+        "data: {\"type\":\"response.completed\",\"response\":{\"id\":\"resp_warmup_effort\",\"status\":\"completed\",\"output\":[]}}\n\n",
+        "data: [DONE]\n\n",
+    );
+    Mock::given(method("POST"))
+        .and(path("/codex/responses"))
+        .respond_with(ResponseTemplate::new(200).set_body_raw(sse, "text/event-stream"))
+        .expect(1)
+        .mount(&server)
+        .await;
+    let store = Arc::new(MemoryAccountStore::default());
+    create_account(&store, "acct_warmup_effort").await;
+    let service = quota_service_with_base_url(
+        &store,
+        reqwest::Client::builder()
+            .no_proxy()
+            .build()
+            .expect("client"),
+        server.uri(),
+    );
+
+    let summary = service.execute_warmup("test-model").await.expect("warmup");
+
+    assert_eq!(summary.warmed_up, 1);
+    let requests = server.received_requests().await.expect("recorded requests");
+    let decoded =
+        zstd::stream::decode_all(requests[0].body.as_slice()).expect("zstd body should decode");
+    let body: serde_json::Value =
+        serde_json::from_slice(&decoded).expect("warmup body should be valid JSON");
+    // 上游按目录拒绝目录外的档位，none 曾让全部定时预热只留下 error 终态
+    assert_eq!(body["reasoning"]["effort"], "low");
+}
+
 #[tokio::test]
 async fn warmup_rejects_failed_sse_despite_successful_http_headers() {
     let server = MockServer::start().await;

backend/crates/providers/openai/tests/provider/contract/cookies.rs

@@ -0,0 +1,104 @@
+//! 验证真实响应头只写回一次，流内失败不重复处理 Cookie
+
+use super::*;
+
+fn cookie_provider(store: &Arc<MemoryAccountStore>, base_url: String) -> Arc<CodexProvider> {
+    let profile = wire_profile();
+    let http = reqwest::Client::builder().no_proxy().build().unwrap();
+    let leases = Arc::new(TestLeaseCoordinator::default());
+    let catalog = Arc::new(CodexCredentialCatalogService::new(
+        store.repository(),
+        profile.clone(),
+        http.clone(),
+        base_url.clone(),
+        catalog_cache(),
+    ));
+    let quota = Arc::new(CodexCredentialQuotaService::new(
+        store.repository(),
+        profile.clone(),
+        http.clone(),
+        base_url.clone(),
+        Arc::new(MemoryCooldownPort::new()),
+        Arc::clone(&leases) as Arc<dyn ProviderLeasePort>,
+        crate::support::runtime_policy(),
+    ));
+    let feedback = Arc::new(AccountFeedbackStats::default());
+    let selector = Arc::new(CodexCredentialSelector::new(
+        ProviderKind::new("openai").unwrap(),
+        store.repository(),
+        leases,
+        Arc::new(MemorySessionAffinity::default()),
+        Arc::new(MemorySessionExclusions::default()),
+        Arc::clone(&quota),
+        Arc::clone(&feedback),
+        // 测试仅允许本机模拟上游，生产 Cookie 白名单不放宽
+        CodexCookiePolicy::new(["cf_clearance"], ["127.0.0.1"]).unwrap(),
+    ));
+    Arc::new(
+        CodexProvider::new(
+            selector,
+            catalog,
+            quota,
+            feedback,
+            http,
+            profile,
+            base_url,
+            Arc::new(CodexWebSocketPool::default()),
+            0,
+        )
+        .unwrap(),
+    )
+}
+
+#[tokio::test]
+async fn response_cookies_are_saved_once_for_stream_and_opening_failures() {
+    for streaming in [true, false] {
+        let store = Arc::new(MemoryAccountStore::default());
+        create_account(&store, "acct_provider_contract").await;
+        let original = store.account("acct_provider_contract").unwrap();
+        let server = MockServer::start().await;
+        let failure = json!({"type":"error", "error":{"type":"server_error", "code":"server_error", "message":"backend unavailable"}});
+        let response = if streaming {
+            ResponseTemplate::new(200)
+                .insert_header("content-type", "text/event-stream")
+                .set_body_string(format!("event: error\ndata: {failure}\n\n"))
+        } else {
+            ResponseTemplate::new(503).set_body_json(&failure)
+        }
+        .insert_header("set-cookie", "cf_clearance=current; Path=/; Max-Age=3600");
+        Mock::given(method("POST"))
+            .and(path("/codex/responses"))
+            .respond_with(response)
+            .expect(1)
+            .mount(&server)
+            .await;
+        let mut stream = cookie_provider(&store, server.uri())
+            .execute(
+                planned_request("openai", http_generate_operation()),
+                context("req_cookie_failure", CancellationToken::new()),
+            )
+            .await
+            .unwrap();
+        let mut failure = None;
+        while let Some(event) = stream.next().await {
+            if let Err(error) = event {
+                failure = Some(error);
+                break;
+            }
+        }
+        assert!(failure.is_some(), "simulated upstream must fail");
+        let current = store.account("acct_provider_contract").unwrap();
+        assert_eq!(
+            current.revision().get(),
+            original.revision().get() + 1,
+            "streaming={streaming}"
+        );
+        let data = store
+            .repository()
+            .load_complete_data(&current)
+            .await
+            .unwrap();
+        assert_eq!(data.cookies()[0].value, "current");
+        server.verify().await;
+    }
+}

backend/crates/providers/openai/tests/provider/contract/mod.rs

@@ -2,6 +2,7 @@
 
 mod account_isolation;
 mod capacity;
+mod cookies;
 mod error_details;
 mod image_account_eligibility;
 mod image_model_access;
@@ -8497,15 +8498,27 @@ async fn capacity_http_and_websocket_opening_rejections_use_bounded_business_ret
 }
 
 #[tokio::test]
-async fn flex_http_and_websocket_opening_rejections_should_not_retry_or_cool_down_accounts() {
+async fn request_rejections_should_not_retry_or_cool_down_accounts() {
     use gateway_core::provider_ports::ProviderCooldownPort as _;
-    for use_websocket in [false, true] {
+    for (use_websocket, (code, expected_kind)) in [false, true].into_iter().flat_map(|websocket| {
+        [
+            ("flex_unavailable", ProviderErrorKind::Unavailable),
+            ("turn_rate_limit_exceeded", ProviderErrorKind::RateLimited),
+        ]
+        .map(|case| (websocket, case))
+    }) {
         let store = Arc::new(MemoryAccountStore::default());
         let account_id = "acct_provider_contract";
         create_account(&store, account_id).await;
         let cooldowns = Arc::new(MemoryCooldownPort::new());
         let server = MockServer::start().await;
-        let body = json!({"error":{"type":"resource_unavailable","code":"flex_unavailable","message":"Flex capacity unavailable."}});
+        let error_type = if code == "turn_rate_limit_exceeded" {
+            "rate_limit_error"
+        } else {
+            "resource_unavailable"
+        };
+        let body =
+            json!({"error":{"type":error_type,"code":code,"message":"Retry this request later."}});
         Mock::given(method(if use_websocket { "GET" } else { "POST" }))
             .and(path("/codex/responses"))
             .respond_with(
@@ -8526,7 +8539,7 @@ async fn flex_http_and_websocket_opening_rejections_should_not_retry_or_cool_dow
         let mut stream = provider
             .execute(
                 planned_request("openai", operation),
-                context("req_flex", CancellationToken::new()),
+                context("req_terminal_rejection", CancellationToken::new()),
             )
             .await
             .unwrap();
@@ -8534,14 +8547,12 @@ async fn flex_http_and_websocket_opening_rejections_should_not_retry_or_cool_dow
             match stream.next().await {
                 Some(Ok(_)) => {}
                 Some(Err(error)) => break error,
-                None => panic!("expected Flex failure"),
+                None => panic!("expected request rejection"),
             }
         };
-        assert_eq!(error.kind(), ProviderErrorKind::Unavailable);
-        assert_eq!(
-            error.upstream_code().map(|code| code.as_str()),
-            Some("flex_unavailable")
-        );
+        assert_eq!(error.kind(), expected_kind);
+        assert_eq!(error.upstream_code().map(|code| code.as_str()), Some(code));
+        assert_eq!(error.retry_after(), Some(Duration::from_secs(300)));
         assert!(!error.replay_is_safe());
         assert!(error.pre_delivery_retry().is_none());
         assert!(error.retry_is_prohibited());
@@ -8551,6 +8562,11 @@ async fn flex_http_and_websocket_opening_rejections_should_not_retry_or_cool_dow
         let response = error.client_visible_upstream_response().unwrap();
         assert_eq!(response.status(), 429);
         assert_eq!(response.body().as_ref(), body.to_string().as_bytes());
+        assert!(
+            response.headers().iter().any(|header| {
+                header.name() == "retry-after" && header.value().as_ref() == b"300"
+            })
+        );
         let account = store.account(account_id).unwrap();
         assert_eq!(account.credential_state(), CredentialState::Ready);
         assert_eq!(account.quota().access(), QuotaAccessState::Unknown);
@@ -8814,6 +8830,12 @@ async fn capacity_feedback_in_stream_only_counts_explicit_overload() {
                     ProviderErrorKind::Unavailable,
                     false,
                 ),
+                (
+                    "turn_rate_limit_exceeded",
+                    "Retry this turn later.",
+                    ProviderErrorKind::RateLimited,
+                    false,
+                ),
                 (
                     "invalid_prompt",
                     "Invalid prompt: we've limited access to this content for safety reasons.",
@@ -8855,7 +8877,10 @@ async fn capacity_feedback_in_stream_only_counts_explicit_overload() {
             if semantic_output {
                 events.push(json!({"type": "response.output_text.delta", "output_index": 0, "content_index": 0, "delta": "hello"}));
             }
-            let original = json!({"type": "response.failed", "response": {"id": "resp_capacity", "error": {"code": code, "message": message}}});
+            let mut original = json!({"type": "response.failed", "response": {"id": "resp_capacity", "error": {"code": code, "message": message}}});
+            if code == "turn_rate_limit_exceeded" {
+                original["response"]["error"]["headers"] = json!({"retry-after": "7"});
+            }
             events.push(original.clone());
             let (base_url, _http_server, websocket_server) = if use_websocket {
                 let listener = TcpListener::bind("127.0.0.1:0").await.expect("listener");
@@ -8927,6 +8952,10 @@ async fn capacity_feedback_in_stream_only_counts_explicit_overload() {
             );
             assert_eq!(error.replay_is_safe(), capacity && !semantic_output);
             assert_eq!(error.upstream_status(), None);
+            if code == "turn_rate_limit_exceeded" {
+                assert!(error.retry_is_prohibited());
+                assert_eq!(error.retry_after(), Some(Duration::from_secs(7)));
+            }
             assert_eq!(
                 error.pre_delivery_retry().is_some(),
                 capacity && !semantic_output

backend/crates/providers/openai/tests/provider/contract/recovery.rs

@@ -3,6 +3,149 @@
 use super::precommit::stream_failure;
 use super::*;
 
+#[tokio::test]
+async fn server_error_503_stream_recovery_requires_no_semantic_output() {
+    for websocket in [false, true] {
+        for semantic_output in [false, true] {
+            let store = Arc::new(MemoryAccountStore::default());
+            create_account(&store, "acct_provider_contract").await;
+            let failure = json!({"type":"error","status":503,"error":{"code":"server_error","type":"server_error","message":"You can retry your request."}});
+            let mut upstream_events = vec![
+                json!({"type":"codex.response.metadata","metadata":{}}),
+                json!({"type":"response.created","response":{"id":"resp_503","status":"in_progress","output":[]}}),
+                json!({"type":"response.in_progress","response":{"id":"resp_503","status":"in_progress","output":[]}}),
+            ];
+            if semantic_output {
+                upstream_events.push(json!({"type":"response.output_text.delta","response_id":"resp_503","item_id":"msg_503","output_index":0,"content_index":0,"delta":"hello"}));
+            }
+            upstream_events.push(failure.clone());
+            let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
+            let base = format!("http://{}", listener.local_addr().unwrap());
+            let server = tokio::spawn(async move {
+                let (mut socket, _) = listener.accept().await.unwrap();
+                if websocket {
+                    let mut socket = accept_codex_test_websocket(socket).await;
+                    socket.next().await.unwrap().unwrap();
+                    for event in upstream_events {
+                        socket
+                            .send(Message::Text(event.to_string().into()))
+                            .await
+                            .unwrap();
+                    }
+                } else {
+                    read_http_request(&mut socket).await;
+                    let body = upstream_events
+                        .iter()
+                        .map(|event| {
+                            gateway_protocol::openai::sse::encode_sse_event(
+                                event["type"].as_str().unwrap(),
+                                &event.to_string(),
+                            )
+                        })
+                        .collect::<String>();
+                    socket.write_all(format!("HTTP/1.1 200 OK\r\nContent-Type: text/event-stream\r\nContent-Length: {}\r\n\r\n{body}", body.len()).as_bytes()).await.unwrap();
+                }
+            });
+            let operation = if websocket {
+                capacity_websocket_operation()
+            } else {
+                http_generate_operation()
+            };
+            let mut stream = provider_with_base_url(&store, base)
+                .execute(
+                    planned_request("openai", operation),
+                    context("req_server_error_503", CancellationToken::new()),
+                )
+                .await
+                .unwrap();
+            let (mut events, mut error) = stream_failure(&mut stream).await;
+            assert_eq!(error.kind(), ProviderErrorKind::Unavailable);
+            assert_eq!(error.upstream_status(), Some(503));
+            assert_eq!(error.send_state(), UpstreamSendState::Sent);
+            assert_eq!(error.replay_is_safe(), !semantic_output);
+            if semantic_output {
+                assert!(error.pre_delivery_retry().is_none());
+                assert!(
+                    events
+                        .iter()
+                        .any(|event| event.has_client_event() && !event.is_replayable_prelude())
+                );
+            } else {
+                assert!(!error.retry_is_prohibited());
+                assert!(
+                    matches!(error.pre_delivery_retry(), Some(PreDeliveryRetry::SameAccountTransientRetry { max_retries, initial_delay, max_delay })
+                    if max_retries.get() == 3 && initial_delay == Duration::from_millis(500) && max_delay == Duration::from_secs(8))
+                );
+                assert!(
+                    events
+                        .iter()
+                        .filter(|event| event.has_client_event())
+                        .all(|event| event.is_replayable_prelude())
+                );
+            }
+            assert_eq!(
+                serde_json::from_str::<Value>(error.raw_upstream_error().unwrap().as_str())
+                    .unwrap(),
+                failure
+            );
+            events.extend(error.take_atomic_client_events());
+            assert_eq!(
+                events.last().unwrap().wire_event().unwrap().data(),
+                &failure
+            );
+            let account = store.account("acct_provider_contract").unwrap();
+            assert_eq!(account.credential_state(), CredentialState::Ready);
+            assert_eq!(account.quota().access(), QuotaAccessState::Unknown);
+            server.await.unwrap();
+        }
+    }
+}
+
+#[tokio::test]
+async fn server_error_503_opening_rejections_request_bounded_retry_and_keep_response() {
+    for websocket in [false, true] {
+        let store = Arc::new(MemoryAccountStore::default());
+        create_account(&store, "acct_provider_contract").await;
+        let server = MockServer::start().await;
+        let body =
+            r#"{ "error":{"code":"server_error","type":"server_error","message":"retry later"} }"#;
+        Mock::given(method(if websocket { "GET" } else { "POST" }))
+            .and(path("/codex/responses"))
+            .respond_with(
+                ResponseTemplate::new(503)
+                    .insert_header("retry-after", "17")
+                    .set_body_string(body),
+            )
+            .expect(1)
+            .mount(&server)
+            .await;
+        let operation = if websocket {
+            capacity_websocket_operation()
+        } else {
+            http_generate_operation()
+        };
+        let mut stream = provider_with_base_url(&store, server.uri())
+            .execute(
+                planned_request("openai", operation),
+                context("req_server_error_opening", CancellationToken::new()),
+            )
+            .await
+            .unwrap();
+        let (_, error) = stream_failure(&mut stream).await;
+        assert!(error.replay_is_safe());
+        assert!(!error.retry_is_prohibited());
+        assert!(matches!(
+            error.pre_delivery_retry(),
+            Some(PreDeliveryRetry::SameAccountTransientRetry { .. })
+        ));
+        assert_eq!(error.retry_after(), Some(Duration::from_secs(17)));
+        let response = error.client_visible_upstream_response().unwrap();
+        assert_eq!(response.status(), 503);
+        assert_eq!(response.body().as_ref(), body.as_bytes());
+        server.verify().await;
+    }
+}
+
 #[tokio::test]
 async fn ordinary_http_and_websocket_opening_errors_remain_client_decisions() {
     for websocket in [false, true] {

backend/crates/providers/openai/tests/transport/diagnostics.rs

@@ -1,4 +1,4 @@
-//! 验证上游诊断的容量错误分类、请求标识与响应事实提取
+//! 验证上游失败分类、重放资格、请求标识与响应事实提取
 
 use base64::{Engine as _, engine::general_purpose::STANDARD};
 use provider_openai::transport::CodexUpstreamDiagnostics;
@@ -43,6 +43,87 @@ fn flex_capacity_rejection_should_be_terminal_even_before_payload_send() {
     }
 }
 
+#[test]
+fn turn_rate_limit_does_not_grant_proxy_replay_or_account_cooldown() {
+    for phase in [
+        CodexUpstreamSendPhase::BeforePayload,
+        CodexUpstreamSendPhase::AfterPayload,
+        CodexUpstreamSendPhase::Ambiguous,
+    ] {
+        let failure = CodexUpstreamFailure::from_response(
+            reqwest::StatusCode::TOO_MANY_REQUESTS,
+            r#"{"error":{"code":"turn_rate_limit_exceeded","type":"rate_limit_error","message":"Retry this turn later."}}"#,
+            Some(53),
+            &CodexUpstreamDiagnostics::default(),
+            None,
+            &[],
+            &[],
+            phase,
+        );
+        assert_eq!(failure.category(), CodexFailureCategory::TurnRateLimited);
+        assert!(!failure.replay_is_safe());
+    }
+    assert_eq!(
+        classify(429, r#"{"error":{"message":"turn_rate_limit_exceeded"}}"#),
+        CodexFailureCategory::RateLimited
+    );
+}
+
+#[test]
+fn server_error_replay_requires_explicit_503_and_unambiguous_send() {
+    for (status, body, retryable) in [
+        (
+            503,
+            r#"{"error":{"code":"server_error","type":"server_error"}}"#,
+            true,
+        ),
+        (
+            500,
+            r#"{"error":{"code":"server_error","type":"server_error"}}"#,
+            false,
+        ),
+        (
+            504,
+            r#"{"error":{"code":"server_error","type":"server_error"}}"#,
+            false,
+        ),
+        (503, r#"{"error":{"type":"server_error"}}"#, false),
+        (
+            503,
+            r#"{"error":{"code":"Vendor.Future.v2","type":"server_error"}}"#,
+            false,
+        ),
+        (
+            503,
+            r#"{"error":{"code":"flex_unavailable","type":"server_error"}}"#,
+            false,
+        ),
+        (503, "server_error", false),
+    ] {
+        for phase in [
+            CodexUpstreamSendPhase::BeforePayload,
+            CodexUpstreamSendPhase::AfterPayload,
+            CodexUpstreamSendPhase::Ambiguous,
+        ] {
+            let failure = CodexUpstreamFailure::from_response(
+                reqwest::StatusCode::from_u16(status).unwrap(),
+                body,
+                None,
+                &CodexUpstreamDiagnostics::default(),
+                None,
+                &[],
+                &[],
+                phase,
+            );
+            assert_eq!(
+                failure.replay_is_safe(),
+                retryable && phase != CodexUpstreamSendPhase::Ambiguous,
+                "status={status}, body={body}, phase={phase:?}"
+            );
+        }
+    }
+}
+
 #[test]
 fn capacity_rejections_are_request_scoped_across_http_statuses() {
     for status in [400, 429, 503] {

backend/crates/providers/openai/tests/transport/websocket_pool.rs

@@ -3,6 +3,62 @@
 use super::*;
 use provider_openai::transport::websocket::PreviousResponseUnavailableReason;
 
+#[tokio::test]
+async fn reused_websocket_does_not_replay_opening_response_cookies() {
+    let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
+    let addr = listener.local_addr().unwrap();
+    let server = tokio::spawn(async move {
+        let (socket, _) = listener.accept().await.unwrap();
+        let mut websocket = accept_codex_test_websocket_with(socket, |_, response| {
+            response.headers_mut().append(
+                "set-cookie",
+                "__cf_bm=opening; Domain=chatgpt.com; Path=/; Secure; Max-Age=3600"
+                    .parse()
+                    .unwrap(),
+            );
+        })
+        .await;
+        for response_id in ["resp_cookie_first", "resp_cookie_reuse"] {
+            websocket.next().await.unwrap().unwrap();
+            websocket
+                .send(Message::Text(
+                    completed_websocket_response(response_id, 1, 1).into(),
+                ))
+                .await
+                .unwrap();
+        }
+    });
+    let backend = CodexBackendClient::new(
+        reqwest::Client::builder().no_proxy().build().unwrap(),
+        format!("http://{addr}"),
+        test_wire_profile(),
+    )
+    .with_websocket_pool(Arc::new(CodexWebSocketPool::new(Duration::from_mins(1))));
+    let request = pooled_websocket_request("conversation-cookie-reuse");
+    let first = backend
+        .create_response(
+            &request,
+            request_context("req_cookie_first", Some("chatgpt-account")),
+        )
+        .await
+        .unwrap();
+    let second = backend
+        .create_response(
+            &request,
+            request_context("req_cookie_reuse", Some("chatgpt-account")),
+        )
+        .await
+        .unwrap();
+    assert_eq!(first.set_cookie_headers.len(), 1);
+    assert!(
+        second
+            .websocket_pool_decision
+            .is_some_and(WebSocketPoolDecision::is_reuse)
+    );
+    assert!(second.set_cookie_headers.is_empty());
+    server.await.unwrap();
+}
+
 #[tokio::test]
 async fn codex_backend_client_should_reuse_pooled_websocket_for_same_account_and_conversation() {
     let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();

deploy/README.md

@@ -151,11 +151,14 @@ openssl rand -hex 24
 
 | 会话配置 | 含义 | 配置模板 / 默认值 |
 | --- | --- | --- |
-| `admin.session_ttl_minutes` | 管理员不活动期限 | 模板为 10080 分钟（7 天） |
+| `admin.session_ttl_minutes` | 管理员续期凭据有效期，成功续期后重新计时 | 模板为 10080 分钟（7 天） |
 | `admin.session_absolute_ttl_minutes` | 从登录起计算的最长有效期 | 模板及省略时均为 43200 分钟（30 天） |
 | `client.session_ttl_minutes` | 密钥身份固定有效期，不随活动续期 | 默认 1440 分钟（1 天） |
 
-修改配置需重启，不能延长已建立会话的最长有效期。浏览器会话与续期规则见[认证 API](../docs/api.md#统一登录与会话)，独立于 `/v1/*` 鉴权和限额
+管理员访问凭据最多有效 24 小时，由内部策略控制；不活动期限较短时，访问期限缩短到其四分之一，为自动续期留出窗口。
+推荐使用模板中的 7 天不活动期限和 30 天最长登录期限。修改配置需重启，不能延长已建立会话的最长有效期。
+升级后仅有单凭据的已有会话保留到原期限，重新登录后获得自动续期能力。
+浏览器会话与续期规则见[认证 API](../docs/api.md#统一登录与会话)，独立于 `/v1/*` 鉴权和限额
 
 PostgreSQL 与 Redis 密码必须是 48 位十六进制字符。Compose 通过 `config.yaml` 的凭据桥接区
 引用同一密码；三个值都不需要额外导出为环境变量，数据库和 Redis 密码也不能嵌入连接 URL
@@ -454,19 +457,26 @@ Provider schema 以明文 JSON 保存于 PostgreSQL。Redis 只保存可重建
 | 文件集 | 保留配置 | 默认完整窗口 |
 | --- | --- | --- |
 | 普通日志、OAuth 恢复日志 | `host.logging.file.retention_days` | 前 7 个完整自然日及当天 |
-| 全量请求/响应报文 | `host.logging.request_dump_retention_days` | 前 1 个完整自然日及当天 |
+| 全量请求/响应报文 | `host.logging.request_dump_retention_days` | 最近 24 小时 |
 
 文件名统一为 `codex-proxy-rs-<类别>.YYYY-MM-DD[.N].log[.gz]`，类别分别为
 `application`、`oauth-recovery`、`request-dump`。专用 tracing target 为 `oauth_recovery` 和
 `request_dump`；普通日志保留各 Rust 模块的 target，便于按模块过滤。
 程序只管理上述规范名称的日志，其他命名的文件由运维手动清理。
 
-日志时间戳采用部署时区并携带数字偏移，文件按该时区的日期轮转和整组保留：例如 9 月 8 日配置 1 天，会保留 9 月 7 日全天及 9 月 8 日的所有分片，
+日志时间戳采用部署时区并携带数字偏移。普通日志与 OAuth 恢复日志按该时区的日期轮转和整组保留：例如 9 月 8 日配置 1 天，会保留 9 月 7 日全天及 9 月 8 日的所有分片，
 到 9 月 9 日才允许清理 9 月 7 日，避免留下半天日志。夏令时日期允许为 23 或 25 小时。切换时区不重命名历史文件；
 按文件名日期与部署时区中的实际修改日期取较近值，旧日期分片近期被写入时整组延后删除。
+
+请求转储保留期支持正小数，按每天 24 小时换算，例如 `0.5` 为 12 小时、`0.25` 为 6 小时。
+已关闭分片以最后修改时间判断过期，整片删除，不受时区或夏令时影响。
+时间轮转间隔取一小时与保留期中的较小值，在下一条记录写入时触发。
+实际保存时间可能长于配置值，取决于分片的最后写入时间和下次清理时机
+
 `max_file_size_mb` 仅决定分片大小（默认 20 MiB），不决定保存时长，单条大记录不会被截断。
 关闭的分片压缩为 `.log.gz`；成功压缩、同步并发布归档后才删除原文件，保留原修改时间。
-清理发生在启动和轮转时；空闲期间过期文件可能暂时多保留。检索时须同时读取 `.log` 与 `.log.gz`
+清理发生在启动和轮转时；空闲期间过期文件可能暂时多保留。请求转储重启时新建分片，避免反复追加延后旧记录的过期点。
+检索时须同时读取 `.log` 与 `.log.gz`
 
 报文开关为 `host.logging.request_dump`，默认关闭；开启时原始报文按块写入独立文件，
 缓冲拒收或写入失败可能造成缺块，需结合 `file_logging` 健康状态判断完整性。

deploy/config.example.yaml

@@ -24,6 +24,7 @@ host:
     oauth_recovery: false
     # 将完整请求与响应头、正文写入独立文件；包含凭据，仅排障时开启。
     request_dump: false
+    # 按实际时长保留，支持正小数天数，例如 0.5 为 12 小时
     request_dump_retention_days: 1
     file:
       enabled: true

docs/api.md

@@ -443,6 +443,9 @@ xAI 的 `reasoning.effort` 接受 `none / minimal / low / medium / high / xhigh
 
 #### 容量拒绝与重试
 
+`turn_rate_limit_exceeded` 保留原始错误和 `Retry-After`，由客户端按自身重试预算等待。
+代理不因此写入账号冷却、换号或透明重试，其他会话仍可使用该账号
+
 Responses 的 HTTP/SSE 与 WebSocket 按顺序即时交付正常事件，不暂存前导等待后续输出。
 未启用中间件链时，无输出的 `response.created`、`response.in_progress`
 及 `codex.response.metadata`、`codex.rate_limits` 元数据交付后仍可按已有安全条件重试，
@@ -570,15 +573,16 @@ call 与账号的绑定保存在网关进程内，未连接时一小时过期；
 ### 统一登录与会话
 
 管理员和密钥登录共用 `/api/auth/*`。登录模式 `mode` 只用于选择凭据验证方式，不直接授予权限；
-验证成功后，由后端写入身份和绑定 ID。一个浏览器只持有一份 `cpr_session` HttpOnly Cookie，
-原始 Key 不进入 URL、Pinia 或浏览器存储。登录页的切换只改变本地表单，不改变 URL。
+验证成功后，由后端写入身份和绑定 ID。浏览器通过 `cpr_session` HttpOnly Cookie 访问业务接口，
+管理员另持有仅发送到 `/api/auth` 的 `cpr_refresh` HttpOnly Cookie。原始 Key 不进入 URL、Pinia 或浏览器存储。
+登录页的切换只改变本地表单，不改变 URL。
 管理员进入管理端；Key 登录后进入 `/key-usage`，只读取当前会话绑定 Key 的数据
 
 | 方法 | 路由 | 请求 | 说明 |
 | --- | --- | --- | --- |
 | `POST` | `/api/auth/login` | `{ mode: "admin", username?, password }` 或 `{ mode: "key", apiKey }` | 验证凭据、创建会话；成功后撤销请求携带的旧会话 |
 | `GET` | `/api/auth/status` | 无 | 只读校验 Cookie 对应身份，返回 `{ authenticated, session }` |
-| `POST` | `/api/auth/refresh` | 无 | 校验身份并按管理员策略续期，返回同 status 的结构；有效会话同步设置 Cookie |
+| `POST` | `/api/auth/refresh` | 无 | 使用管理员续期 Cookie 恢复访问凭据；返回同 status 的结构并同步 Cookie，Key 会话保持原期限 |
 | `POST` | `/api/auth/logout` | 无 | 删除当前会话并清除 Cookie；存储失败返回 503，不假装退出成功 |
 | `POST` | `/api/auth/password` | `{ currentPassword, newPassword }` | 仅管理员会话可用；验证当前密码后修改密码，撤销全部管理员会话并清除当前 Cookie |
 
@@ -591,11 +595,14 @@ call 与账号的绑定保存在网关进程内，未连接时一小时过期；
 并发修改中只有旧密码哈希仍匹配的请求可以提交，冲突返回 409；密码更新与安全审计在同一事务提交。
 该入口共用登录尝试限流，超限返回 429。普通设置变更和管理员 API Key 变更不撤销密码登录会话，密钥身份会话也不受改密影响
 
-会话由服务端保存，Cookie 属性为 `Path=/; HttpOnly; SameSite=Lax`，`Max-Age` /
-`Expires` 对齐服务端有效期，`Secure` 沿用上述 Origin 规则。普通业务请求和状态轮询不会续期。
-管理员通过 refresh 在不活动期限内续期，不能超过登录时确定的最长有效期；已过期或撤销的会话不会重新创建。
-refresh 未认证时返回 `{ authenticated: false, session: null }`，不写 Cookie；依赖故障返回 503。
-密钥身份和缺少最长有效期记录的会话保持固定期限。期限配置见[部署配置](../deploy/README.md#手动安装)
+会话由服务端保存，两种 Cookie 均为 `HttpOnly; SameSite=Lax`，`Max-Age` / `Expires` 对齐各自有效期，
+`Secure` 沿用上述 Origin 规则。访问 Cookie 使用 `Path=/`，续期 Cookie 使用 `Path=/api/auth`，不能直接访问业务接口。
+普通业务请求和状态轮询不会续期。管理员访问凭据到期后，仍可通过续期 Cookie 恢复登录；续期成功会轮换两种凭据，
+并重新计算不活动期限，但不能超过登录时确定的最长有效期。访问凭据仍有效时，refresh 返回同一组凭据和期限。
+轮换后 30 秒内重试上一代续期凭据返回同一组新凭据；超出窗口再次使用已识别的上一代凭据会撤销该会话。
+续期已过期或会话已撤销时不会重新创建；未认证返回 `{ authenticated: false, session: null }`，不写 Cookie；依赖故障返回 503。
+退出可以只携带续期 Cookie，并清除两种 Cookie。Key 登录清除续期 Cookie；密钥身份和仅有单凭据的会话保持固定期限。
+期限配置及升级注意事项见[部署配置](../deploy/README.md#手动安装)
 
 每次恢复密钥会话时重新确认 Key 存在且启用；停用或删除后会话失效，重新启用不会恢复已撤销会话。
 依赖不可用时返回 503，不返回已认证或假装未登录。预算耗尽不妨碍登录
@@ -608,7 +615,8 @@ refresh 未认证时返回 `{ authenticated: false, session: null }`，不写 Co
 拒绝时使用 `42901` 和 `Retry-After`
 
 认证错误共用 `40101`（会话失效）、`40102`（凭据错误）和 `40301`（权限不足）。
-前端在 `40101` 后统一尝试一次会话恢复，并发请求等待同一恢复结果；恢复成功后最多重放一次，确认失效才退出。
+前端首次读取状态未认证时尝试续期；业务请求在 `40101` 后统一尝试一次会话恢复，并发请求等待同一恢复结果；
+恢复成功后最多重放一次，确认失效才退出。
 `40102` 和 `40301` 不触发恢复，网络或依赖故障不清除身份
 
 ### Key 用量与客户端配置
@@ -1695,7 +1703,8 @@ Windows 离线包接口固定解析 Microsoft Store Product ID `9PLM9XGG6VKS`
 产品 ID、上游地址、ring 或文件名。后端只返回通过包名、架构、Microsoft CDN host/path、scheme 和失效
 时间校验的 `x64` / `arm64` MSIX 直链，不代理安装包字节。Store 内容通道返回 HTTP/80 临时地址时保留
 原始 scheme，不强制改写为该 host 不保证支持的 HTTPS。动态链接不足 10 分钟即失效时不会下发；某个架构
-解析失败时只将该架构降级到 OpenAI 官方 HTTPS 稳定 MSIX，并通过 `warning` 说明。响应形状为：
+解析失败时只将该架构降级到 OpenAI 官方 HTTPS 稳定 MSIX，并通过 `warning` 说明。Store 解析最多等待
+30 秒，官方回退包通过最多 3 秒的 HEAD 请求补充大小，大小查询失败不影响下载地址。响应形状为：
 
 ```json
 {
@@ -1708,7 +1717,7 @@ Windows 离线包接口固定解析 Microsoft Store Product ID `9PLM9XGG6VKS`
       "source": "microsoft_store",
       "version": "26.825.6671.0",
       "fileName": "OpenAI.Codex_26.825.6671.0_x64__2p2nqsd0c76g0.msix",
-      "sizeBytes": 744250000,
+      "sizeBytes": 780402688,
       "downloadUrl": "http://dl.delivery.mp.microsoft.com/filestreamingservice/files/...",
       "expiresAt": "2026-09-01T07:30:00Z"
     }

docs/architecture.md

@@ -376,8 +376,8 @@ Client Key 鉴权完成后，API adapter 从有界请求头识别客户端，Cor
 
 - 一个客户端请求对应一条 `model_requests`；attempt 是请求内事实，不建立第二张权威表
 - Provider 的一次 `execute` 只选择一个 credential 并返回一个冷流；换号、重试和 fallback 由 Core 决定
-- OpenAI 的自动恢复限于明确识别的账号、容量、续接和传输场景；普通上游拒绝保留响应与重试提示，
-  交由客户端决策。WS opening 尚未发送业务 payload 也不扩大该恢复范围，明确的 `426` 仍允许 HTTP 回退
+- OpenAI 的自动恢复限于明确识别的账号、容量、`503 + error.code=server_error`、续接和传输场景；
+  其他上游拒绝保留响应与重试提示，交由客户端决策。WS opening 尚未发送业务 payload 也不扩大该恢复范围，明确的 `426` 仍允许 HTTP 回退
 - `not_sent`、`sent`、`ambiguous` 是单调的上游发送边界；结果不明确时不能假定上游未收到请求
 - HTTP 明确未发送的瞬时建连失败（含 TLS 握手 EOF）共享最多 4 次 opening、30 秒的请求内预算；
   证书、TLS 协议及配置错误不进入同账号建连恢复，取消和执行 deadline 优先终止等待
@@ -388,8 +388,8 @@ Client Key 鉴权完成后，API adapter 从有界请求头识别客户端，Cor
   仍检查错误分类、续接归属、发送状态、副作用及预算。中间件链不启用此前导例外
 - API 在最终错误编码出口投影客户端恢复信号；该投影不修改 Provider 上游事实，也不改变 Core 的
   重试与提交边界。具体错误合同见 [数据面接口](api.md#3-openai-数据面与模型目录)
-- Provider 可将明确容量拒绝标记为有界同账号退避，Core 在既有安全重放边界内执行，按账号维护请求内
-  预算，耗尽后复用普通换号路径。该退避消耗总路由预算，与 WS 传输恢复、OAuth 刷新及账号额度冷却分开
+- Provider 可将明确容量拒绝或 `503 + error.code=server_error` 标记为有界同账号退避，Core 在既有安全重放边界内执行，
+  按账号维护请求内预算，耗尽后复用普通换号路径。该退避消耗总路由预算，与 WS 传输恢复、OAuth 刷新及账号额度冷却分开
 - OpenAI Provider 与 WS 传输层不暂存前导等待后续事件，正常帧按顺序即时交付；
   Provider 只保留单向推进的重放边界，实际输出、终态或未知事件关闭重放窗口。
   中间件链中的正常事件同样即时交付，但不保留可替换前导的重试资格。
@@ -587,9 +587,11 @@ Vue 普通管理请求的错误提示由 `api/request/` 请求封装统一负责
 AuthService 每次恢复 Key 会话时重新检查 Key 是否存在且启用；Key 会话不能访问管理员页面和管理接口。
 前端只维护一份 Auth Store，不在每个 API 请求上标记身份；401 会话失效、403 权限不足和 503 依赖故障分别处理。
 成功登录替换当前浏览器的旧会话，登出必须确认服务端撤销。
-管理员的不活动期限和最长有效期由 AuthService 持有；显式续期验证当前身份并限制写入频率，Store 原子比较会话后延长期限，
-不重新创建已退出或过期的键，API 将返回的有效期同步到 Cookie。Key 与缺少最长有效期记录的会话保持固定期限。
-前端首次进入受保护页面只读取登录状态，点击、滚动、聚焦等页面活动不触发续期；
+管理员访问凭据和续期凭据绑定同一逻辑会话，AuthService 负责签发、身份校验、轮换、不活动期限和最长有效期。
+Store 保存凭据摘要与上一代重试所需的派生盐，原子比较后替换记录或撤销；Redis TTL 对齐续期期限，
+访问到期不删除逻辑会话，刷新不能重建已退出或过期的键。短窗口重试返回同一代凭据，避免响应丢失与并发刷新互相撤销。
+API 只把签发结果投影为两种 HttpOnly Cookie；Key 与单凭据会话保持固定期限。
+前端首次进入受保护页面先读取状态，未认证时尝试续期；点击、滚动、聚焦等页面活动不单独触发续期；
 认证 Cookie 写入在支持 Web Locks 的环境中跨标签页串行，其他环境在当前页面串行。
 请求层仅在业务接口返回 `40101` 时共用一次会话续期，失败请求及恢复期间的新请求等待同一结果；
 成功后原请求最多重放一次，取消或身份已切换的请求不重放，确认失效才退出。恢复接口跳过该协调以避免循环等待。

frontend/src/layout/components/AppSidebar.vue

@@ -422,6 +422,7 @@ onBeforeUnmount(() => {
 
     <ZScrollbar class="my-6 w-full flex-1">
       <div class="px-4">
+        <!-- 焦点环绘制在按钮内侧，避免被滚动区和折叠菜单裁切 -->
         <nav class="relative grid gap-3" :class="isCollapsed ? 'mx-auto w-11.5' : 'w-full'" aria-label="主导航">
           <span
             class="pointer-events-none absolute inset-x-0 top-0 h-11.5 overflow-hidden rounded-cp bg-cp-menu-item-selected-bg transition-[transform,opacity] duration-260 ease-[cubic-bezier(0.22,1,0.36,1)] motion-reduce:transition-none"
@@ -436,7 +437,7 @@ onBeforeUnmount(() => {
             <div v-if="item.path === '/plugins'" class="relative z-10 grid min-w-0">
               <button
                 type="button"
-                class="inline-flex h-11.5 cursor-pointer items-center rounded-cp border-0 bg-transparent text-sm leading-[1.15] outline-none focus-visible:ring-2 focus-visible:ring-cp-control-outline focus-visible:ring-offset-2 focus-visible:ring-offset-cp-bg-container"
+                class="inline-flex h-11.5 cursor-pointer items-center rounded-cp border-0 bg-transparent text-sm leading-[1.15] outline-none focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-cp-control-outline"
                 :class="[
                   isCollapsed ? 'w-11.5 justify-center' : 'w-full gap-3 px-4',
                   isActive(item.path)
@@ -490,7 +491,7 @@ onBeforeUnmount(() => {
                     </span>
                     <button
                       type="button"
-                      class="relative inline-flex h-10 min-w-0 cursor-pointer items-center gap-2 rounded-cp border-0 bg-transparent px-3 text-left text-cp-sm outline-none transition-colors focus-visible:ring-2 focus-visible:ring-cp-control-outline motion-reduce:transition-none"
+                      class="relative inline-flex h-10 min-w-0 cursor-pointer items-center gap-2 rounded-cp border-0 bg-transparent px-3 text-left text-cp-sm outline-none transition-colors focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-cp-control-outline motion-reduce:transition-none"
                       :class="route.name === 'plugins'
                         ? 'font-emphasis text-cp-text'
                         : navFeedbackMuted ? 'font-semibold text-cp-text-secondary' : 'font-semibold text-cp-text-secondary hover:bg-cp-fill-quaternary hover:text-cp-text'"
@@ -504,7 +505,7 @@ onBeforeUnmount(() => {
                       v-for="view in pluginPageViews"
                       :key="view.target.instanceId"
                       type="button"
-                      class="relative inline-flex h-10 min-w-0 cursor-pointer items-center gap-2 rounded-cp border-0 bg-transparent px-3 text-left text-cp-sm outline-none transition-colors focus-visible:ring-2 focus-visible:ring-cp-control-outline motion-reduce:transition-none"
+                      class="relative inline-flex h-10 min-w-0 cursor-pointer items-center gap-2 rounded-cp border-0 bg-transparent px-3 text-left text-cp-sm outline-none transition-colors focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-cp-control-outline motion-reduce:transition-none"
                       :class="isPluginViewActive(view)
                         ? 'font-emphasis text-cp-text'
                         : navFeedbackMuted ? 'font-semibold text-cp-text-secondary' : 'font-semibold text-cp-text-secondary hover:bg-cp-fill-quaternary hover:text-cp-text'"
@@ -522,7 +523,7 @@ onBeforeUnmount(() => {
             <button
               v-else
               type="button"
-              class="relative z-10 inline-flex h-11.5 cursor-pointer items-center rounded-cp border-0 text-sm leading-[1.15] outline-none focus-visible:ring-2 focus-visible:ring-cp-control-outline focus-visible:ring-offset-2 focus-visible:ring-offset-cp-bg-container"
+              class="relative z-10 inline-flex h-11.5 cursor-pointer items-center rounded-cp border-0 text-sm leading-[1.15] outline-none focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-cp-control-outline"
               :class="[
                 isCollapsed ? 'w-11.5 justify-center' : 'w-full gap-3 px-4',
                 isActive(item.path)

frontend/src/stores/modules/auth.ts

@@ -19,7 +19,10 @@ export const useAuthStore = defineStore('auth', () => {
   function checkAuth(): Promise<boolean> {
     if (pendingCheck.value)
       return pendingCheck.value
-    const check = loadSession(getAuthStatus).finally(() => {
+    const check = loadSession(async () => {
+      const status = await getAuthStatus()
+      return status.authenticated ? status : refreshAuthSession()
+    }).finally(() => {
       if (pendingCheck.value === check)
         pendingCheck.value = undefined
     })

frontend/src/views/accounts/components/AccountBatchEditModal.vue

@@ -10,7 +10,6 @@ defineProps<{
   groups: AccountGroupRef[]
   groupsLoading: boolean
   saving: boolean
-  hasChanges: boolean
 }>()
 
 const emit = defineEmits<{
@@ -59,7 +58,7 @@ const selectedGroupIds = defineModel<string[]>('selectedGroupIds', { required: t
       <ZButton
         type="primary"
         :loading="saving"
-        :disabled="selectedCount === 0 || groupsLoading || !hasChanges"
+        :disabled="selectedCount === 0 || groupsLoading"
         @click="emit('save')"
       >
         保存更改

frontend/src/views/accounts/composables/useAccountBatchEditor.ts

@@ -2,7 +2,7 @@ import type { Ref } from 'vue'
 import type { Account, AccountModelAccess } from '@/api'
 
 import { ZNotification } from '@codex-proxy/ui'
-import { computed, ref, shallowRef, watch } from 'vue'
+import { ref, shallowRef, watch } from 'vue'
 import { batchUpdateAccounts } from '@/api'
 import { useAsyncAction } from '@/composables/useAsyncAction'
 import { accountModelAccessError } from '../utils/modelAccess'
@@ -17,24 +17,23 @@ export function useAccountBatchEditor(options: {
   const selectedAccountsById = new Map<string, Account>()
   const showBatchEditModal = shallowRef(false)
   const editingCount = shallowRef(0)
-  const schedulingEnabled = shallowRef(true)
+  const schedulingEnabled = shallowRef(false)
   const concurrencyLimit = shallowRef('')
   const weight = shallowRef('1')
   const modelAccess = ref<AccountModelAccess | undefined>()
-  const editedFields = ref(new Set<'enabled' | 'concurrencyLimit' | 'weight' | 'groupIds'>())
+  const editedFields = ref(new Set<'concurrencyLimit' | 'weight' | 'groupIds'>())
   const catalogAccountId = shallowRef<string>()
   const proxyMode = shallowRef('preserve')
   const proxyId = shallowRef('')
   const selectedGroupIds = ref<string[]>([])
   const saveAction = useAsyncAction()
   const saving = saveAction.loading
-  const hasChanges = computed(() => Boolean(modelAccess.value) || editedFields.value.size > 0 || proxyMode.value !== 'preserve')
 
-  // 未操作的字段保持每个账号原值，避免展开表单就覆盖混合设置。
-  watch([schedulingEnabled, concurrencyLimit, weight, selectedGroupIds], (values, previous) => {
+  // 调度按开关值统一更新，其他未操作字段保留每个账号原值
+  watch([concurrencyLimit, weight, selectedGroupIds], (values, previous) => {
     if (!showBatchEditModal.value || saving.value)
       return
-    const fields = ['enabled', 'concurrencyLimit', 'weight', 'groupIds'] as const
+    const fields = ['concurrencyLimit', 'weight', 'groupIds'] as const
     fields.forEach((field, index) => {
       if (values[index] !== previous[index])
         editedFields.value.add(field)
@@ -50,7 +49,7 @@ export function useAccountBatchEditor(options: {
     modelAccess.value = undefined
     editedFields.value.clear()
     catalogAccountId.value = accounts[0]?.id
-    schedulingEnabled.value = accounts.every(account => account.enabled)
+    schedulingEnabled.value = false
     proxyMode.value = 'preserve'
     proxyId.value = ''
     concurrencyLimit.value = sharedConcurrencyLimit(accounts)
@@ -67,10 +66,6 @@ export function useAccountBatchEditor(options: {
       ZNotification.warning({ message: modelError })
       return
     }
-    if (!hasChanges.value) {
-      ZNotification.warning({ message: '请选择需要更新的设置' })
-      return
-    }
     const scheduling = parseAccountSchedulingForm(editedFields.value.has('concurrencyLimit') ? concurrencyLimit.value : '', editedFields.value.has('weight') ? weight.value : '1')
     if (proxyMode.value === 'proxy' && !proxyId.value.trim()) {
       ZNotification.warning({ message: '请选择已通过测试的代理' })
@@ -87,7 +82,7 @@ export function useAccountBatchEditor(options: {
         accountIds,
         modelAccess: modelAccess.value,
         outboundProxyId: proxyMode.value === 'preserve' ? undefined : proxyMode.value === 'direct' ? '' : proxyId.value.trim(),
-        enabled: editedFields.value.has('enabled') ? schedulingEnabled.value : undefined,
+        enabled: schedulingEnabled.value,
         concurrencyLimit: editedFields.value.has('concurrencyLimit') ? scheduling.values.concurrencyLimit : undefined,
         weight: editedFields.value.has('weight') ? scheduling.values.weight : undefined,
         groupIds: editedFields.value.has('groupIds') ? [...new Set(selectedGroupIds.value)] : undefined,
@@ -130,7 +125,6 @@ export function useAccountBatchEditor(options: {
     concurrencyLimit,
     weight,
     modelAccess,
-    hasChanges,
     catalogAccountId,
     proxyMode,
     proxyId,

frontend/src/views/accounts/index.vue

@@ -152,7 +152,6 @@ const {
   concurrencyLimit: batchConcurrencyLimit,
   weight: batchWeight,
   modelAccess: batchModelAccess,
-  hasChanges: batchHasChanges,
   catalogAccountId: batchCatalogAccountId,
   editingCount: batchEditingCount,
   proxyMode: batchProxyMode,
@@ -454,7 +453,6 @@ const {
       :groups="groups"
       :groups-loading="groupsLoading"
       :saving="savingBatchEdit"
-      :has-changes="batchHasChanges"
       @save="saveBatchEdit"
     />
 

frontend/src/views/settings/components/client-version/components/ClientDesktopOfflineDownloads.vue

@@ -4,11 +4,13 @@ import { ZButton, ZEmpty, ZIconButton, ZSkeleton } from '@codex-proxy/ui'
 
 import { ArrowDownToLine, PackageOpen, RefreshCw } from '@lucide/vue'
 
+import { computed } from 'vue'
+
 import ClientInstallCommandList from './ClientInstallCommandList.vue'
 
 defineOptions({ name: 'ClientDesktopOfflineDownloads' })
 
-withDefaults(
+const props = withDefaults(
   defineProps<{
     downloads?: CodexDesktopWindowsDownloads | null
     loading?: boolean
@@ -26,6 +28,13 @@ const emit = defineEmits<{
   retry: []
 }>()
 
+const downloadDescription = computed(() => {
+  const packages = props.downloads?.packages
+  if (packages?.length && packages.every(packageItem => packageItem.source === 'official_openai'))
+    return 'OpenAI 官方安装包，请选择与设备一致的架构'
+  return 'Microsoft Store 离线安装包，请选择与设备一致的架构'
+})
+
 const localInstallCommand = [
   {
     label: '下载后使用 PowerShell 安装 / 升级',
@@ -71,12 +80,12 @@ function formatFileSize(value: number | null): string {
             </span>
           </div>
           <p class="mt-1.5 mb-0 text-cp-sm leading-[1.45] font-semibold text-cp-text-secondary">
-            后端实时校验 Microsoft CDN 直链，请选择与设备一致的架构
+            {{ downloadDescription }}
           </p>
         </div>
       </div>
       <ZIconButton
-        :aria-label="loading ? '正在重新提取离线下载链接' : '重新提取离线下载链接'" variant="solid"
+        :aria-label="loading ? '正在刷新离线下载链接' : '刷新离线下载链接'" variant="solid"
         :disabled="loading"
         :aria-busy="loading || undefined"
         @click="emit('refresh')"
@@ -100,7 +109,7 @@ function formatFileSize(value: number | null): string {
       {{ error }}，当前仍显示上次成功结果
     </p>
 
-    <div v-if="loading && !downloads" class="grid gap-3 sm:grid-cols-2" aria-label="正在提取离线安装包">
+    <div v-if="loading && !downloads" class="grid gap-3 sm:grid-cols-2" aria-label="正在加载离线安装包">
       <div v-for="index in 2" :key="index" class="grid gap-3 rounded-cp bg-cp-bg-container p-4 shadow-cp-tertiary">
         <ZSkeleton class="h-4 w-28" />
         <ZSkeleton class="h-3 w-44" shape="text" />

frontend/vite.config.ts

@@ -21,6 +21,7 @@ export default defineConfig(({ mode }) => {
         '/dev': {
           target: 'http://127.0.0.1:8080',
           changeOrigin: true,
+          cookiePathRewrite: { '/api/auth': '/dev/api/auth' },
           rewrite: path => path.replace(/^\/dev/, ''),
         },
       },

release/notes.md

@@ -1,12 +1,17 @@
-# v3.26.1
+# v3.26.2
 
 ## 修复与改进
 
-- OpenAI Responses 的 HTTP/SSE 与 WebSocket 即时转发前导事件和压缩进度，移除等待后续输出的暂存，避免上游已有进度却迟迟无法到达客户端；关联 [#405](https://github.com/zyycn/codex-proxy-rs/issues/405)
-- 未启用中间件链且仅交付可替换前导时，保留已有的有界重试；修复 WebSocket 先收到响应元数据后，连接寿命限制错误未进入恢复流程的问题
-- 管理端 API 请求超时固定为 120 秒，不再读取构建变量 `VITE_API_TIMEOUT_MS`
+- 修复 OpenAI `turn_rate_limit_exceeded` 被错误扩大为账号冷却的问题，保留原始错误和 `Retry-After`，由客户端按自身重试预算处理，避免后续请求在本地被挡成 `no_available_provider`
+- OpenAI 明确返回 `503 + error.code=server_error` 时，在既有安全重放边界内进行有界重试，已交付正文或工具活动后不重放
+- 修复 OpenAI 流式失败和 WebSocket 复用时重复写回旧 Cookie 的问题，并区分凭据版本冲突与存储故障
+- OpenAI 账号预热改用模型目录支持的推理强度，避免因不支持的 `none` 导致预热失败
+- 管理员登录分离访问凭据与续期凭据，访问凭据到期后可自动恢复；续期轮换支持短窗口内的并发与重试，并识别超出重试窗口的旧续期凭据重用
+- 请求转储保留期支持正小数天数，例如 `0.5` 为 12 小时、`0.25` 为 6 小时，按已关闭分片的最后写入时间清理
+- Windows 离线安装包优先解析 Microsoft Store，最多等待 30 秒后按架构回退到 OpenAI 官方包；修正包大小并按实际来源展示下载说明
+- 账号批量编辑默认关闭调度，保存时始终应用界面显示的调度开关值；修复侧边栏键盘焦点环被裁切的问题
 
-## 使用说明
+## 升级说明
 
-- 本版本不调整既有心跳频率和默认空闲超时；SSE 注释与 WebSocket Ping/Pong 不延长官方 Codex 的事件等待期限，上游长时间没有新事件时仍可能超时
-- 正文、工具活动、压缩进度或未知事件交付后，网关不再透明重放；中间件链不启用可替换前导的重试例外
+- 已有单凭据登录会话保留到原期限，重新登录后获得新的自动续期能力
+- `host.logging.request_dump_retention_days` 的默认值仍为 `1`，含义改为最近 24 小时；清理按分片进行，实际保存时间受最后写入时间和下次清理时机影响

release/version.yaml

@@ -1 +1 @@
-version: "3.26.1"
+version: "3.26.2"