chore: bump version to 3.45.2

Co-authored-by: Codex <noreply@openai.com>
fix(openai): negotiate Codex catalogs for Responses upstreams
2026-11-11 16:06:13 +00:00 · 2026-11-11 17:04:39 +08:00 · 2026-11-11 16:49:10 +08:00 · 2026-11-11 16:04:16 +08:00 · 2026-11-11 15:13:00 +08:00 · 2026-11-11 15:12:02 +08:00
775 changed files with 42668 additions and 11938 deletions
@@ -5,6 +5,13 @@ description: Codex Proxy RS 开发、修复、排障、代码审查和文档修

 # 开发指南

+## 首要写作要求：言简意赅
+
+所有面向人的文字都按此要求编写和审查，包括界面、通知、后端错误、任务状态、命令行、日志、注释、文档和交付说明
+
+- 先写读者需要知道的事实或动作。删掉一句不影响理解、判断或操作，就删；标题、正文和通知不重复同一信息
+- 保留会改变决定的条件、权限、后果和恢复步骤。错误通知只说已知问题，有明确办法才补一句；后端返回的提示在后端改，前端不重复解释。上游原文、用户内容和诊断事实保持原样
+
 ## 先确定领域与必读规范

 按用户意图、受影响行为与对象初判，定位后按实际文件复核，不要求用户说出“前端”“后端”或技能名。**所有命中行共同构成本次必读规范，先读完再确定方案、修改或给出审查结论**；跨领域叠加，不能只选最像当前步骤的一行
@@ -13,7 +20,7 @@ description: Codex Proxy RS 开发、修复、排障、代码审查和文档修

 | 领域或操作，行为影响与文件路径满足其一即可 | 确定方案前读取与执行 |
 | --- | --- |
-| 调整页面、弹窗、表单、按钮、文案、样式或交互；目标在 `frontend/`、`modules/ui/`、插件前端，或是 `.vue` 文件 | [前端流程](references/frontend.md)，覆盖组件复用、文案、Token、样式、视觉状态和运行证据；局部修改同样执行 |
+| 调整页面、弹窗、表单、按钮、文案、样式或交互；目标在 `frontend/`、`modules/ui/`、插件前端，或是 `.vue` 文件 | [前端流程](references/frontend.md)，局部修改同样按影响范围检查组件复用、文案、Token、样式、视觉状态和运行证据 |
 | 开发、排查或审查插件接入、宿主 SDK、Runtime、扩展接口或独立网关插件；目标在 `backend/crates/gateway-plugin/`、`modules/plugins/` | 完整读取[插件职责边界](references/plugin-boundaries.md)及所用 [SDK](../../../backend/crates/gateway-plugin/sdk/README.md) 类型与能力合同；宿主维护自身合同、资源与稳定性，插件业务错误在插件侧修复，不在宿主、SDK 或 Runtime 中补偿；独立插件开发、排查、审查另用 [cpr-plugin-dev](../cpr-plugin-dev/SKILL.md) |
 | 开发、排查或审查服务端接口、路由、调度、账号与用量规则、持久化、后台任务或协议行为；目标是 `backend/` 中的实现、配置、迁移，或 Rust 源码 | [Workspace 边界](../../../docs/architecture.md#3-workspace-边界)的模块与依赖规则、所属模块及[后端自审](../../../docs/architecture.md#后端自审)；Rust 使用 `$rust-best-practices` 和下方后端注释要求，宿主 Rust 同时读取 [Rust 模块组织约定](../../../docs/architecture.md#32-rust-模块组织约定) |
 | 修改页面接口调用，或开发、排查、审查面向管理端或模型客户端的 HTTP／WS API 合同 | [API](../../../docs/api.md)对应章节；优先复用已有接口，核对调用方 → 服务端解析 → 实际查询或执行，不能只凭前端类型认定参数生效；按实际改动叠加前后端规范 |
@@ -27,7 +34,7 @@ description: Codex Proxy RS 开发、修复、排障、代码审查和文档修

 纯文档任务按文档分支执行；核实文中的合同与职责时读对应领域条款，不因提及代码路径或语言加载实现、构建与页面验收流程

-命中的流程引用完整读取，并落实其中指定的必读章节；长文档先用 `rg -n '^#{1,4} ' 文件` 定位，读取指定章节的完整内容。`#章节` 不会自动截取，“按需”仅用于未命中的领域和后续操作资料，不能省略必读规范；已有内容只在当前上下文可用且仍适用时复用，不循环重读技能
+首次命中的流程引用完整读取，并落实其中指定的必读章节；长文档先用 `rg -n '^#{1,4} ' 文件` 定位，分段读取指定章节，避免输出截断。`#章节` 不会自动截取，“按需”仅用于未命中的领域和后续操作资料，不能省略必读规范；读取记录与验证证据的复用按 [任务延续与收尾](../../../AGENTS.md#任务延续与收尾) 执行

 ## 参考仓库的优先级

@@ -38,8 +45,9 @@ description: Codex Proxy RS 开发、修复、排障、代码审查和文档修
 1. 遵守已提供的 [AGENTS.md](../../../AGENTS.md)，按其 CodeGraph 约定定位代码；确认工作区、任务范围与已有改动，找到事实归属、同类实现和调用链，补齐上表命中规范及[项目约定](../../../CONTRIBUTING.md#项目约定)对应条目后再修改
 2. 以最终差异重新匹配上表，补齐新增领域的规范并检查实际实现，再处理本次引入的职责越界、重复规则、冗余状态与无依据分支；删除或替换功能时一并清理失效的配置、类型、调用、测试与文档，已部署数据和公开合同仍遵守所属迁移及兼容规则；仅审查时报告，不自行修复
 3. 按最终行为执行[文档检查](references/documentation.md)，核对所属正文及相关概述、示例和引用，在本任务内完成必要同步；不以尚无文档差异跳过检查。内部重构等未改变文档所述事实时无需改文档；常规文档只写当前状态，普通开发不自动修改 `release/notes.md`
-4. 按变更范围执行[验证](../../../CONTRIBUTING.md#验证)及其停止条件，后端命令见[验证命令](../../../docs/architecture.md#验证命令)；沿用本轮有效证据与用户已确定的验收分工，区分通过、失败、跳过与未执行；提交时补读[提交约定](../../../CONTRIBUTING.md#项目约定)
-5. 交付实际结果与验证缺口；前端按[前端流程](references/frontend.md)核对最终差异和运行证据，后端按上表检查生命周期，不把构建通过当作行为验收
+4. 按变更范围执行[验证](../../../CONTRIBUTING.md#验证)及其停止条件，后端命令见[验证命令](../../../docs/architecture.md#验证命令)；复用仍适用的验证证据与用户已确定的验收分工，区分通过、失败、跳过与未执行
+5. 交付前按[首要写作要求](#首要写作要求言简意赅)通读本次新增或修改的文字。交代实际结果与验证缺口；前端按[前端流程](references/frontend.md)核对运行证据，后端按上表检查生命周期，不把构建通过当作行为验收
+6. 按授权完成提交与交付；提交前按[提交约定](../../../CONTRIBUTING.md#项目约定)准备提交信息与实际共同作者署名，提交后核对实际提交消息，PR 的 AI 披露不能替代提交署名

 ## 测试维护

@@ -4,7 +4,7 @@

 ## 领域必读

-确定页面方案或审查结论前，读取[前端职责](../../../../docs/architecture.md#34-前端模块职责)、[文案与信息层级](../../../../docs/theme.md#界面文案与信息层级)和[界面验证](../../../../CONTRIBUTING.md#界面验证)的完整章节；只改文案或局部样式也执行。明确本次用户操作、原页面、最接近的同类实现及可复用基础组件，沿用既有设计与请求层，按本轮验收分工留存所需截图
+确定页面方案或审查结论前，读取[前端职责](../../../../docs/architecture.md#34-前端模块职责)、[文案与信息层级](../../../../docs/theme.md#界面文案与信息层级)和[界面验证](../../../../CONTRIBUTING.md#界面验证)的完整章节，局部修改同样读取。明确本次用户操作、原页面、最接近的同类实现及可复用基础组件，沿用既有设计与请求层，按本轮验收分工留存所需截图

 ## 按改动补齐规范

@@ -21,9 +21,15 @@

 普通维护和新增业务页面沿用现有设计；设计技能中的配色、字体、布局探索不覆盖项目规范，主题算法只在涉及时读取

+## 验收范围与收尾
+
+验证前按[界面验证](../../../../CONTRIBUTING.md#界面验证)明确本次受影响的用户路径、状态和通过条件。局部修改围绕受影响区域及相关操作验收；主题、窗口尺寸和空/加载/错误状态仅在受影响时补充，共用主题或基础组件变更按主题规范扩大范围
+
+通过后按[验证停止条件](../../../../CONTRIBUTING.md#验证)收尾；只有新改动、失败或未解疑点时补验相关部分。补交截图或 PR 材料时复用仍有效的运行证据
+
 ## 交付前

-对照最终差异和实际页面逐项核对，不以读取过规范代替检查：
+对照最终差异和实际页面核对适用项，不以读取过规范代替检查：

 - **复用与范围**：是否沿用参考页面和基础组件，已有组件能承载时不手写替代控件；共用缺陷按职责修复，修复后清理本次已失效的页面补丁，不顺带重排无关区域或新增重复入口
 - **文案与层级**：标点是否合规，标题、状态和帮助是否重复，详细说明与当前决策必需提示的位置是否合适
@@ -15,6 +15,8 @@ description: 准备、创建、更新或审查 GitHub PR，含回复讨论与处

 本仓库目标分支为 `main`，其他仓库使用其可信基线规则与模板，PR 内修改的规则不能降低审查要求

+为本仓库拟写或更新 PR 标题时，完整标题使用英文，沿用提交信息的 Conventional Commits 格式，例如 `fix(store): preserve client key ledgers after deletion`
+
 涉及上游行为的判断按[问题与方案依据](../../../CONTRIBUTING.md#问题与方案依据)执行

 ## 按模式读取
@@ -18,8 +18,9 @@ description: Codex Proxy RS 的版本规划、发布说明、正式或预发行
 ## 必须保持的边界

 - Codex 兼容性变化按[问题与方案依据](../../../CONTRIBUTING.md#问题与方案依据)核对已有依据与验证范围，缺少依据列为发行风险，不以 CI 通过代替
- `release/publish` 会提交、打 tag、推送并触发工作流，没有只读预演模式，不能用于探测或演练
- 同名版本、超时或中断先查本地与远端状态，不删已发布 tag、不移动 tag、不强推掩盖冲突
+- `release/publish --check <version>` 只读检查发行准备条件；不带 `--check` 会提交、打 tag、推送并触发工作流，实际发布仍需相应授权
+- 同版本失败先区分[续跑原任务与修复源码后重发](references/operations.md#恢复与验收)：前者沿用原提交；后者仅在版本尚未公开时清理失败的版本提交，再生成唯一的版本提交。已发布的 tag 和产物保持不变
+- 备版只更新构建版本；发布后回读 `main:release/version.yaml` 的 `published`，核对已公开的通道候选
 - 预发行不得覆盖 GitHub Latest 或镜像 `latest`，完成后回读核对
 - `release/notes.md` 只承载当前发行的说明；常规文档修改另按开发入口执行[文档检查](../cpr-dev-guide/references/documentation.md)
 - 交付版本、提交、Release／工作流链接与实际结果，未完成构建或缺失产物时不称发布成功
@@ -27,7 +27,7 @@
  应用内更新仅允许同一轮实验，规则见[版本命名与升级规则](../../../../deploy/README.md#版本命名与升级规则)。
  发版前核对上一实验版是否已包含该更新器；仍禁用在线更新的旧构建需要先手动升级。
 - GitHub Release 标为 Pre-release，且不设为 Latest；Docker 发布版本标签，不覆盖稳定版 `latest`。
-  正式版和 alpha、beta、rc 均不接收实验版更新；环境变量不能改变发行线。
+  发布任务应将该基线的最高公开实验版写入`main:release/version.yaml` 的 `published[大版本].exp[基线]`，不推进普通通道。
 - 复用正式版平台清单、质量检查、完整安装包与多架构镜像，以及部署文件、校验和和现有产物证明。
  对照本次清单确认平台，不以“实验版”为由仅发布单架构镜像。
 - 部署说明交代与稳定实例并存的目录、配置、端口和数据库要求；需要 Compose 隔离配置时，
@@ -20,7 +20,7 @@

 调用入口前重新核对当前脚本的副作用、目标版本和待推送提交，保留无关工作区内容，不自动清理或暂存用户文件。
 先编辑 `release/notes.md`，保留为未提交改动（已暂存或未暂存均可）；其他已跟踪文件的改动应先单独提交。
-脚本会更新 `release/version.yaml`，按[接口弃用规则](../../../../backend/crates/gateway-plugin/sdk/docs/manifest.md#接口弃用)校验并维护 `plugin-api-deprecations.json`，将这些差异与最终工作区中的发布说明一起提交为 `chore(release): vX.Y.Z`。
+脚本只改 `release/version.yaml` 的顶层 `version`，按[接口弃用规则](../../../../backend/crates/gateway-plugin/sdk/docs/manifest.md#接口弃用)校验并维护 `plugin-api-deprecations.json`，将这些差异与最终工作区中的发布说明一起提交为 `chore: bump version to <version>`。
 不要提前单独提交说明或把版本文件改成目标版本；脚本要求说明相对 HEAD 有改动，并自行更新版本号。
 本任务需要的提交按[项目约定](../../../../CONTRIBUTING.md#项目约定)保留英文 Conventional Commits 与相应署名。

@@ -31,19 +31,36 @@ release/publish "$release_version"
 ```

 该命令会创建上述版本提交与 annotated tag，原子推送分支和 tag，再从长期分支手动触发 `release.yml`。
-它没有只读预演模式；不能为了检查或演练而执行。发布工作流读取 tag 中的说明，修改 tag 之后的本地文件不会改变该次构建。
+只读预检使用 `release/publish --check "$release_version"`。发布工作流读取 tag 中的说明，修改 tag 之后的本地文件不会改变该次构建。

 只调整已发布页面的标题或正文时，编辑对应 GitHub Release 的 `name` 或 `body` 并回读核对；
 保持已有 tag、源码提交、附件和预发行状态，不重新执行发布入口。

 ## 恢复与验收

- 脚本中断或网络超时时，先核对本地提交与 tag、远端分支与 tag、对应工作流 run 及 Release，确定已完成到哪一步。
-  若本地已创建版本提交或 tag，不直接重跑入口，也不通过删 tag、回退版本或强推来消除报错。
- 提交和 tag 已推送但工作流未触发时，核对目标后使用脚本提示的 dispatch 命令补触发；
-  工作流已存在则跟踪或恢复对应 run，避免重复发布。发现 tag 指向不同提交时报告冲突，不移动已发布 tag。
- 跟踪与本次 tag 对应的 run ID，核对工作流解析的目标提交。触发工作流成功只表示已开始，不能当作发布完成。
+先核对本地与远端的分支头、版本提交、tag，以及对应的工作流、GitHub Release 和版本镜像。超时或任务失败不等于版本未公开；即使 Release 还是草稿，版本镜像也可能已经推送
+
+### 续跑原任务
+
+源码无需修改时保留版本提交和 tag，核对两者指向后从断点继续：
+
+- 尚未推送：补齐缺失的步骤，按入口原子推送分支和 tag
+- 已推送但未触发：使用入口提示的 dispatch 命令
+- 已有 run：跟踪对应提交的任务，失败时重跑失败任务。构建产物保留 7 天，过期后从原 tag 重跑完整工作流
+
+### 修复源码后同版本重发
+
+1. 确认旧工作流已停止、该版本没有公开 Release 或版本镜像，且待清理提交不在其他已发布 tag 的历史中。已有公开产物时保留原提交和 tag，代码修复另发新版本；发布状态不明时先查清
+2. 从失败版本提交的父提交重新接上后续功能和修复，跳过已核实的失败版本提交。保留最终说明为未提交改动，版本号和插件弃用清单交给发行入口。核对差异，确保修复未丢失、失败提交已不在待发历史中
+3. 只清理本次失败的 tag 和草稿。涉及远端改写时，先核对授权，以事先记录的分支头和 tag 对象 SHA 作显式租约，原子更新分支并删除未发行 tag。租约不匹配就停止，不合并旧线
+4. 修复验证通过后执行 `release/publish --check <version>`，再按[执行发版](#执行发版)重发。核对上一发行至新 tag 的历史中只有一个本版本的发行提交，且与工作流构建的提交一致
+
+### 验收
+
 - 发布完成后核对 GitHub Release 的版本、正式版/预发行状态和中文变更正文；对照平台清单与工作流确认归档、校验和及镜像产物。
  工作流附加的安装说明和自动提交列表按其当前配置处理，不用它们替代手写的中文变更说明。
+- 回读 `main:release/version.yaml` 的 `published`。正式版参与同一大版本四个普通通道的比较；RC 参与 RC、Beta、Alpha，Beta 参与 Beta、Alpha，Alpha 只参与自身。实验版只推进 `exp["X.Y.Z"]`。有通道推进时应有 `chore(release): update release channels to <version>` 提交；重复执行或较旧版本未推进任何通道时无提交
+- 通道表写入失败时，确认该版本已公开、工作流能写入 `main`，再按已有授权执行 `gh workflow run release.yml --ref main -f tag="v$release_version" -f index_only=true`。恢复任务重新校验公开附件、读取并合并当前清单，不重新打包或改 tag
+- v3.42.0 在线升级：首个包含新更新器的 3.x 正式版公开并通过校验后，从该次通道提交取出 `release/version.yaml`，将顶层 `version` 设为该正式版，作为同名附件上传到该 Release。回读附件，确认 3.x 稳定通道指向该版本且安装包可用，再手动将已有 `update-index` 正文改为 `{"current":"<该正式版>"}`。此后保留该页与附件，无需再编辑
 - 返回版本、tag 对应提交、Release/工作流链接及实际结果。失败、仍在构建或缺失产物时明确说明，不能称为发布成功；
  Release 和镜像已生成也不表示用户的运行实例已经升级。
@@ -5,7 +5,7 @@
 ## 基线与版本

 1. 确认类型、分支、upstream、目标仓库、工作区与完整待发布范围，保留无关改动；未跟踪文件也需核对
-2. 读取 [version.yaml](../../../../release/version.yaml)、相关 tag 和实际 Release，确定上一发布基线与本次目标提交，再核对二者间的最终 diff，不只看最近几条提交
+2. 读取 [version.yaml](../../../../release/version.yaml)、相关 tag 和实际 Release，区分顶层构建版本与 `main` 上的 `published` 通道表，结合目标通道确定上一发布基线与本次目标提交，再核对二者间的最终 diff，不只看最近几条提交
 3. 使用用户确定的目标版本，建议版本时说明兼容性、能力或修复依据；同名 tag 先区分重试与新发行，不递增版本掩盖冲突
 4. 命名与晋级按[版本命名与升级规则](../../../../deploy/README.md#版本命名与升级规则)，实验版另读[实验流程](experimental.md#分支与版本)

@@ -14,7 +14,9 @@
 读取当前 [notes.md](../../../../release/notes.md)与[项目约定](../../../../CONTRIBUTING.md#项目约定)中的发布说明条目

 - 只在发布说明任务中修改 `release/notes.md`，替换为本次版本内容，首行为目标 tag，正文使用中文
- 按用户可感知的最终变化归并，省略空章节，不逐条翻译提交，不写排查过程或未经验证的承诺
+- 常规版本按「新增功能」「优化改进」「问题修复」「升级须知」归类，省略空章节；单一改动可直接写一句。安装命令和文档入口由工作流附加
+- 每条用一句短语讲清一个用户可感知的结果，不加句号，例如「系统更新：确认当前平台有安装包后才提示升级」
+- 同一变化只写一次，保留会影响使用或升级的默认值和限制，不展开实现过程、逐条翻译提交或写未经验证的承诺
 - 剔除回退、重复及未进入发行范围的内容，升级事项须能追溯到实际迁移、配置或兼容变化
 - 只翻译已有准确说明时保持事实与范围，不混入其他变更
 - 常规文档仍只描述当前状态；必要修订执行[文档检查](../../cpr-dev-guide/references/documentation.md)，不复制发布说明中的版本变化列表
@@ -26,6 +28,11 @@

 进入实际发行准备后，读取目标分支的 [release/publish](../../../../release/publish)、[工作流](../../../../.github/workflows/release.yml)与[平台清单](../../../../release/platforms.yaml)，按当前入口执行，不另写脚本或绕过检查

+在上一发行基线到 HEAD 的提交中检查是否已有目标版本的备版提交（`chore: bump version to <version>`；查历史时也匹配 `chore(release): prepare v<version>` 和 `chore(release): v<version>`），即使同名 tag 已不存在也要查。命中时先核对该提交对应的发行状态，按[失败恢复](operations.md#恢复与验收)处理，不在旧提交上再叠一个同名提交
+
+发布说明准备好、其他代码已提交后，执行 `release/publish --check <version>`，检查版本、说明、工作区、远端分支与 tag、工具链和插件兼容窗口。
+预检不修改文件、Git 引用或远端状态；远端存在本地未知提交时先同步再检查。它不替代 CI、发行物验证或实际发布授权
+
 按[验证要求](../../../../CONTRIBUTING.md#验证)核对目标提交的证据，区分通过、失败、跳过与未执行
 数据库变更同时读取[迁移冻结规则](../../../../backend/migrations/README.md#冻结规则)：

@@ -0,0 +1,3 @@
+# SQLx migration checksums are byte-sensitive; keep migration inputs portable across hosts.
+backend/migrations/*.sql text eol=lf
+backend/migrations/.frozen-sha256 text eol=lf
@@ -139,7 +139,6 @@ body:
    id: expected-behavior
    attributes:
      label: 预期行为
-      description: 说明原本期望得到的结果。
    validations:
      required: true

@@ -108,7 +108,6 @@ body:
    id: expected-behavior
    attributes:
      label: 预期行为
-      description: 说明原本期望得到的结果。
    validations:
      required: true

@@ -0,0 +1,76 @@
+name: Build binary
+description: Build a native release binary with shared dependency caching and timings
+inputs:
+  rust:
+    description: Pinned Rust toolchain
+    required: true
+  target:
+    description: Rust target triple
+    required: true
+  platform:
+    description: Release platform name, such as linux-amd64
+    required: true
+  binary:
+    description: Executable filename
+    default: codex-proxy-rs
+  rust-image:
+    description: Pinned Linux builder image; empty for native builds
+    default: ''
+runs:
+  using: composite
+  steps:
+    - name: Setup Rust
+      uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master
+      with:
+        toolchain: ${{ inputs.rust }}
+        targets: ${{ inputs.target }}
+
+    - name: Configure Windows runtime linkage
+      if: runner.os == 'Windows'
+      shell: bash
+      # 发行包静态链接 MSVC 运行库，解压运行时无需安装 VC++ Redistributable
+      run: echo 'RUSTFLAGS=-C target-feature=+crt-static' >> "$GITHUB_ENV"
+
+    - name: Cache Rust dependencies
+      uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
+      with:
+        workspaces: backend -> target
+        shared-key: release-${{ inputs.target }}-${{ inputs.rust-image }}
+        cache-bin: false
+        # 只缓存依赖，避免随版本变化的 workspace 产物挤占缓存
+        save-if: ${{ github.event_name != 'pull_request' }}
+
+    - name: Build binary
+      shell: bash
+      working-directory: backend
+      env:
+        BUILD_TARGET: ${{ inputs.target }}
+        BUILD_PLATFORM: ${{ inputs.platform }}
+        BUILD_BINARY: ${{ inputs.binary }}
+        RUST_IMAGE: ${{ inputs.rust-image }}
+      run: |
+        set -euo pipefail
+        if [ -n "$RUST_IMAGE" ]; then
+          mkdir -p "$HOME/.cargo"
+          docker run --rm --user "$(id -u):$(id -g)" \
+            -e CARGO_HOME=/cargo -e HOME=/tmp \
+            -e CPR_VERSION -e CPR_GIT_SHA -e CPR_BUILD_TIME -e CPR_BUILD_TYPE \
+            -v "$HOME/.cargo:/cargo" -v "$PWD/..:/workspace" \
+            -w /workspace/backend "$RUST_IMAGE" \
+            cargo build --release --locked --timings --target "$BUILD_TARGET" --bin codex-proxy-rs
+        else
+          cargo build --release --locked --timings --target "$BUILD_TARGET" --bin codex-proxy-rs
+        fi
+        "target/$BUILD_TARGET/release/$BUILD_BINARY" --help
+        "target/$BUILD_TARGET/release/$BUILD_BINARY" --version
+        mkdir -p "../dist/binaries/$BUILD_PLATFORM"
+        cp "target/$BUILD_TARGET/release/$BUILD_BINARY" "../dist/binaries/$BUILD_PLATFORM/$BUILD_BINARY"
+
+    - name: Upload build timings
+      if: always()
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+      with:
+        name: build-timings-${{ inputs.platform }}
+        path: backend/target/cargo-timings/
+        if-no-files-found: ignore
+        retention-days: 7
@@ -43,4 +43,4 @@ runs:
        name: frontend-dist
        path: frontend/dist
        if-no-files-found: error
-        retention-days: 1
+        retention-days: 7
@@ -1,24 +0,0 @@
-# syntax=docker/dockerfile:1.7@sha256:a57df69d0ea827fb7266491f2813635de6f17269be881f696fbfdf2d83dda33e
-
-FROM busybox:1.37.0-musl@sha256:5cec3fc171c87218698e85a52af7087de727372aae264a787b8112901a5b0092 AS restore
-ARG CACHE_STAMP
-RUN --mount=type=bind,target=/cache \
-    --mount=type=cache,target=/usr/local/cargo/registry \
-    --mount=type=cache,target=/usr/local/cargo/git \
-    --mount=type=cache,target=/app/backend/target \
-    test -n "$CACHE_STAMP" \
-    && tar -xzf /cache/registry.tar.gz -C /usr/local/cargo/registry \
-    && tar -xzf /cache/git.tar.gz -C /usr/local/cargo/git \
-    && tar -xzf /cache/target.tar.gz -C /app/backend/target
-
-FROM busybox:1.37.0-musl@sha256:5cec3fc171c87218698e85a52af7087de727372aae264a787b8112901a5b0092 AS snapshot
-ARG CACHE_STAMP
-# 直接压缩 mount 内容，构建层和 runner 只保存归档，避免多份展开的编译产物占满磁盘
-RUN --mount=type=cache,target=/usr/local/cargo/registry \
-    --mount=type=cache,target=/usr/local/cargo/git \
-    --mount=type=cache,target=/app/backend/target \
-    test -n "$CACHE_STAMP" \
-    && mkdir -p /cache \
-    && tar -czf /cache/registry.tar.gz -C /usr/local/cargo/registry . \
-    && tar -czf /cache/git.tar.gz -C /usr/local/cargo/git . \
-    && tar -czf /cache/target.tar.gz -C /app/backend/target .
@@ -1,31 +0,0 @@
-name: Cargo cache mounts
-description: Restore or export a validated Cargo snapshot for a BuildKit builder
-inputs:
-  operation:
-    description: Cache operation, restore or snapshot
-    required: true
-  builder:
-    description: Buildx builder name
-    required: true
-  path:
-    description: Cargo snapshot directory on the runner
-    required: true
-  architecture:
-    description: Cargo target directory architecture, amd64 or arm64
-    required: true
-outputs:
-  usable:
-    description: Whether the restored or exported snapshot contains Cargo dependencies
-    value: ${{ steps.cache.outputs.usable }}
-runs:
-  using: composite
-  steps:
-    - id: cache
-      shell: bash
-      env:
-        ACTION_PATH: ${{ github.action_path }}
-        OPERATION: ${{ inputs.operation }}
-        BUILDER: ${{ inputs.builder }}
-        CACHE_PATH: ${{ inputs.path }}
-        ARCHITECTURE: ${{ inputs.architecture }}
-      run: bash "$ACTION_PATH/cargo-cache.sh" "$OPERATION" "$BUILDER" "$CACHE_PATH" "$ARCHITECTURE"
@@ -1,78 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-if [ "$#" -ne 4 ]; then
-  echo "usage: $0 restore|snapshot BUILDER DIRECTORY amd64|arm64" >&2
-  exit 2
-fi
-operation="$1"
-builder="$2"
-directory="$(realpath -m "$3")"
-architecture="$4"
-case "$operation" in restore|snapshot) ;; *) exit 2 ;; esac
-case "$architecture" in amd64|arm64) ;; *) exit 2 ;; esac
-dockerfile="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/Dockerfile"
-
-usable() {
-  # 流式检查归档中的非空依赖文件，校验时不在 runner 展开编译产物
-  python3 - "$1" "$architecture" <<'PY'
-import pathlib
-import re
-import sys
-import tarfile
-
-root = pathlib.Path(sys.argv[1])
-architecture = sys.argv[2]
-
-def contains(filename, pattern):
-    with tarfile.open(root / filename, mode="r|gz") as archive:
-        return any(
-            member.isfile() and member.size > 0
-            and re.fullmatch(pattern, member.name.removeprefix("./"))
-            for member in archive
-        )
-
-try:
-    valid = (
-        (root / "git.tar.gz").stat().st_size > 0
-        and contains("registry.tar.gz", r"cache/[^/]+/[^/]+\.crate")
-        and contains("target.tar.gz", rf"{architecture}/release/deps/[^/]+\.rlib")
-    )
-except (OSError, tarfile.TarError):
-    valid = False
-sys.exit(0 if valid else 1)
-PY
-}
-
-command=(docker buildx build --builder "$builder" --file "$dockerfile" --progress plain)
-# mount 的内容不参与层指纹，用时间戳重跑归档操作；--no-cache 会重置 cache mount
-command+=(--build-arg "CACHE_STAMP=$(date +%s%N)" --target "$operation")
-valid=false
-if [ "$operation" = restore ]; then
-  if usable "$directory"; then
-    "${command[@]}" --output type=cacheonly "$directory"
-    valid=true
-  else
-    echo "No usable Cargo snapshot; cached image layers may still be available"
-  fi
-else
-  # 导出只发送空上下文，新快照独立校验后替换旧目录，避免残留文件造成误判。
-  mkdir -p "$(dirname "$directory")"
-  temporary="$(mktemp -d "${directory}.XXXXXX")"
-  trap 'rm -rf "$temporary"' EXIT
-  mkdir "$temporary"/{context,snapshot}
-  # tar 流避开 local exporter 的逐文件同步阻塞，只接收 /cache 下的压缩归档
-  # 直接导出打包阶段，避免再创建一层归档副本
-  # https://github.com/moby/buildkit/issues/2950
-  "${command[@]}" --output type=tar,dest=- "$temporary/context" \
-    | tar -xf - -C "$temporary/snapshot" --strip-components=1 cache/
-  if usable "$temporary/snapshot"; then
-    rm -rf "$directory"
-    mv "$temporary/snapshot" "$directory"
-    valid=true
-  fi
-fi
-
-echo "Cargo snapshot for $architecture: usable=$valid"
-if [ "$valid" = true ]; then du -sh "$directory"; fi
-if [ -n "${GITHUB_OUTPUT:-}" ]; then printf 'usable=%s\n' "$valid" >> "$GITHUB_OUTPUT"; fi
@@ -70,7 +70,6 @@ updates:
  - package-ecosystem: docker
    directories:
      - /deploy
-      - /.github/actions/cargo-cache
    labels: []
    schedule:
      interval: weekly
@@ -1,10 +1,10 @@
 require 'digest'
 require 'fileutils'
-require 'json'
+require_relative 'release-metadata'

 # 归档与镜像消费相同二进制和封口清单，不在打包时重新解释插件分发策略
 module ReleasePackage
-  APP_NAME = 'codex-proxy-rs'
+  APP_NAME = ReleaseMetadata::APP_NAME
  MANIFEST = 'dist/plugin-release-assets/plugin-release-manifest.json'

  def self.install_manifest(directory)
@@ -34,7 +34,6 @@ module ReleasePackage
    default_image = "${CPR_IMAGE:-#{image}:latest}"
    raise 'Expected exactly one default application image in deploy/compose.yaml' unless compose.scan(default_image).length == 1
    File.write("#{release_dir}/compose.yaml", compose.sub(default_image, "${CPR_IMAGE:-#{image}:#{ENV.fetch('DOCKER_VERSION')}}"))
-    FileUtils.cp(MANIFEST, release_dir)

    platforms.each do |platform|
      raise "Unsupported archive format: #{platform['archive']}" unless platform['archive'] == 'tar.gz'
@@ -47,7 +46,7 @@ module ReleasePackage
      FileUtils.cp_r('dist/frontend/.', "#{root}/web/dist")
      FileUtils.cp(config, "#{root}/deploy")
      install_manifest("#{root}/plugins/official")
-      archive = "#{release_dir}/#{APP_NAME}_#{ENV.fetch('VERSION')}_#{platform['os']}_#{platform['arch']}.tar.gz"
+      archive = File.join(release_dir, ReleaseMetadata.archive_name(ENV.fetch('VERSION'), platform))
      raise "Failed to create #{archive}" unless system('tar', '-czf', archive, '-C', File.dirname(root), APP_NAME)
    end

@@ -0,0 +1,105 @@
+require 'base64'
+require 'uri'
+require_relative 'release-metadata'
+
+# 各发行线共用 main 通道表；只合并本次已核实的版本
+module PublishedChannels
+  PATH = 'release/version.yaml'
+  LIMIT = 128 * 1024
+
+  def self.advance(document, version)
+    version = ReleaseMetadata.version(version)
+    major, = version.split('.', 2)
+    core, stage = version.split('+', 2).first.split('-', 2)
+    channels = (document.fetch('published')[major] ||= {})
+    if stage&.start_with?('exp.')
+      channels = (channels['exp'] ||= {})
+      keys = [core]
+    else
+      stages = %w[stable rc beta alpha]
+      keys = stages.drop(stages.index(stage ? stage.split('.').first : 'stable'))
+    end
+    incoming = ReleaseMetadata.sort_key(version)
+    changed = false
+    keys.each do |key|
+      current = channels[key]
+      if current
+        comparison = incoming <=> ReleaseMetadata.sort_key(current)
+        raise "Conflicting release identities: #{current}, #{version}" if comparison.zero? && current != version
+        next unless comparison.positive?
+      end
+      channels[key] = version
+      changed = true
+    end
+    changed
+  end
+
+  class Publisher
+    def api(endpoint, method: 'GET', data: nil, optional: false)
+      args = ['gh', 'api', endpoint, '--method', method]
+      args.concat(%w[--input -]) if data
+      out, error, status = Open3.capture3(*args, stdin_data: data ? JSON.generate(data) : '')
+      return nil if optional && !status.success? && error.include?('(HTTP 404)')
+      raise "Cannot access #{endpoint}: #{error.strip}" unless status.success?
+      JSON.parse(out)
+    end
+
+    def initialize(repository)
+      @base = "repos/#{repository}"
+    end
+
+    def find_release(version)
+      api("#{@base}/releases/tags/v#{ReleaseMetadata.version(version)}", optional: true)
+    end
+
+    def verify_assets(version)
+      release = find_release(version)
+      tag = "v#{version}"
+      raise "Release is not public or tag differs: #{tag}" unless release && release.fetch('tag_name') == tag &&
+        !release.fetch('draft') && release.fetch('prerelease') == ReleaseMetadata.prerelease?(version)
+      data = api("#{@base}/contents/release/platforms.yaml?ref=#{URI.encode_www_form_component(tag)}")
+      platforms = YAML.safe_load(Base64.decode64(data.fetch('content'))).fetch('platforms')
+      raise "Missing platforms for #{tag}" if platforms.empty?
+      expected = platforms.map { |p| ReleaseMetadata.archive_name(version, p) }
+      expected.concat(%w[checksums.txt compose.yaml config.example.yaml])
+      uploaded = release.fetch('assets').filter_map do |asset|
+        asset.fetch('name') if asset.fetch('state') == 'uploaded' && asset.fetch('size').positive?
+      end
+      missing = expected - uploaded
+      raise "Incomplete release #{tag}: #{missing.join(', ')}" unless missing.empty?
+    end
+
+    def check_unpublished(version)
+      existing = find_release(version)
+      raise "Release v#{version} already public; use index-only recovery" if existing && !existing.fetch('draft')
+    end
+
+    def publish(version)
+      verify_assets(version)
+      # 读取 main 的当前文件，实验分支和较晚结束的旧构建都不能覆盖其他通道或构建版本
+      endpoint = "#{@base}/contents/#{PATH}"
+      file = api("#{endpoint}?ref=main")
+      document = YAML.safe_load(Base64.decode64(file.fetch('content')))
+      return unless PublishedChannels.advance(document, version)
+
+      content = YAML.dump(document).delete_prefix("---\n")
+      raise 'Published index exceeds the client size limit' if content.bytesize > LIMIT
+      # 按读取的文件 SHA 写入；并发备版改过同一文件时交给恢复任务重新合并
+      api(endpoint, method: 'PUT', data: {
+        branch: 'main', sha: file.fetch('sha'), content: Base64.strict_encode64(content),
+        message: "chore(release): update release channels to #{version}"
+      })
+    end
+  end
+end
+
+if $PROGRAM_NAME == __FILE__
+  mode, raw = ARGV
+  version = ReleaseMetadata.version(raw || '')
+  publisher = PublishedChannels::Publisher.new(ENV.fetch('GITHUB_REPOSITORY'))
+  case mode
+  when 'check' then publisher.check_unpublished(version)
+  when 'publish' then publisher.publish(version)
+  else abort 'usage: published-channels.rb check|publish VERSION'
+  end
+end
@@ -62,6 +62,10 @@ module ReleaseMetadata
    entries
  end

+  def self.archive_name(version, platform)
+    "#{APP_NAME}_#{version}_#{platform.fetch('os')}_#{platform.fetch('arch')}.#{platform.fetch('archive')}"
+  end
+
  def self.outputs(tag)
    value = version(YAML.load_file('release/version.yaml').fetch('version'))
    raise "Release tag #{tag} does not match v#{value}" unless tag == "v#{value}"
@@ -82,6 +86,7 @@ module ReleaseMetadata
      'platform_matrix' => JSON.generate('include' => entries),
      'docker_matrix' => JSON.generate('include' => docker),
      'non_docker_matrix' => JSON.generate('include' => native),
+      'windows_matrix' => JSON.generate('include' => entries.select { |entry| entry['os'] == 'windows' }),
      'docker_platforms' => docker.map { |entry| entry['dockerPlatform'] }.join(','),
      'previous_tag' => previous,
      'prerelease' => prerelease?(value),
@@ -0,0 +1,44 @@
+require 'json'
+require 'open3'
+
+# 仅复用同一源码的主分支 CI，缺少证据时完整检查发行提交
+module ReleaseQuality
+  def self.capture(*command)
+    output, error, status = Open3.capture3(*command)
+    raise "#{command.first} failed: #{error.strip}" unless status.success?
+    output
+  end
+
+  def self.evidence(repository)
+    parents = capture('git', 'rev-list', '--parents', '-n', '1', 'HEAD').split
+    return nil unless parents.length == 2
+    parent = parents.last
+    changes = capture('git', 'diff', '--name-only', '-z', parent, 'HEAD').split("\0")
+    return nil if changes.empty? || (changes - %w[release/version.yaml release/notes.md]).any?
+
+    # 按最新一次运行判断，失败或仍在执行时不回退到旧的成功记录
+    endpoint = "repos/#{repository}/actions/workflows/ci.yml/runs?event=push&branch=main&head_sha=#{parent}&per_page=1"
+    run = JSON.parse(capture('gh', 'api', endpoint)).fetch('workflow_runs').first
+    return nil unless run && run.fetch('head_sha') == parent && run.fetch('conclusion') == 'success'
+    return nil unless run.fetch('head_repository').fetch('full_name') == repository
+
+    rows = capture('gh', 'api', '--paginate', "repos/#{repository}/actions/runs/#{run.fetch('id')}/jobs?per_page=100", '--jq', '.jobs[] | @json')
+    job = rows.lines.map { |line| JSON.parse(line) }.find { |entry| entry.fetch('name') == 'quality / backend' }
+    return nil unless job && job.fetch('conclusion') == 'success'
+    job.fetch('html_url')
+  end
+end
+
+if $PROGRAM_NAME == __FILE__
+  begin
+    evidence = ReleaseQuality.evidence(ENV.fetch('GITHUB_REPOSITORY'))
+  rescue StandardError => error
+    warn "CI evidence unavailable; running full release checks: #{error.message}"
+    evidence = nil
+  end
+  puts "run_backend=#{evidence.nil?}"
+  if ENV['GITHUB_STEP_SUMMARY']
+    message = evidence ? "后端质量检查复用版本提交父提交的 [CI 结果](#{evidence})；仅版本与发布说明不同" : '未找到可复用的后端 CI 结果，完整检查发行提交'
+    File.open(ENV.fetch('GITHUB_STEP_SUMMARY'), 'a') { |file| file.puts(message) }
+  end
+end
@@ -7,13 +7,58 @@ on:
        description: Exact commit SHA to build and validate
        required: true
        type: string
+      source_build:
+        description: Validate the complete Docker source build
+        type: boolean
+        default: true

 permissions:
  contents: read
  security-events: write

 jobs:
+  frontend:
+    if: ${{ !inputs.source_build }}
+    runs-on: ubuntu-26.04
+    timeout-minutes: 15
+    env:
+      CI: 'true'
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.ref }}
+      - uses: ./.github/actions/build-frontend
+        with:
+          upload-artifact: 'true'
+
+  binary:
+    if: ${{ !inputs.source_build }}
+    runs-on: ubuntu-26.04
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.ref }}
+      - id: toolchains
+        run: ruby .github/scripts/toolchains.rb >> "$GITHUB_OUTPUT"
+      - uses: ./.github/actions/build-binary
+        with:
+          rust: ${{ steps.toolchains.outputs.rust }}
+          target: x86_64-unknown-linux-gnu
+          platform: linux-amd64
+          rust-image: ${{ steps.toolchains.outputs.rust_image }}
+        env:
+          CPR_GIT_SHA: ${{ inputs.ref }}
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: codex-proxy-rs-linux-amd64
+          path: dist/binaries/linux-amd64/
+          if-no-files-found: error
+          retention-days: 7
+
  container:
+    needs: [frontend, binary]
+    if: always() && !cancelled()
    runs-on: ubuntu-26.04
    timeout-minutes: 45
    env:
@@ -21,6 +66,14 @@ jobs:
      TRIVY_QUIET: 'true'
      TRIVY_SKIP_VERSION_CHECK: 'true'
    steps:
+      # 上游失败必须传递给已有的容器检查，不能让必需状态变成 skipped
+      - name: Require prebuilt inputs
+        if: ${{ !inputs.source_build }}
+        env:
+          FRONTEND_RESULT: ${{ needs.frontend.result }}
+          BINARY_RESULT: ${{ needs.binary.result }}
+        run: test "$FRONTEND_RESULT" = success && test "$BINARY_RESULT" = success
+
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
@@ -30,41 +83,51 @@ jobs:
        id: buildx
        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1

-      - name: Restore Cargo snapshot
-        id: cargo-cache
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      - name: Download frontend
+        if: ${{ !inputs.source_build }}
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
-          path: ${{ runner.temp }}/container-cargo
-          # 同一平台和依赖复用快照，源码变化由 Cargo 指纹判定是否重编译
-          key: container-cargo-v4-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('backend/Cargo.lock', 'backend/rust-toolchain.toml', 'backend/**/Cargo.toml', 'backend/.cargo/config.toml', 'deploy/Dockerfile', '.github/actions/cargo-cache/Dockerfile') }}
-          restore-keys: |
-            container-cargo-v4-${{ runner.os }}-${{ runner.arch }}-
+          name: frontend-dist
+          path: dist/docker/web/dist

-      - name: Restore Cargo mounts to BuildKit
-        id: cargo-restore
-        uses: ./.github/actions/cargo-cache
+      - name: Download binary
+        if: ${{ !inputs.source_build }}
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
-          operation: restore
-          builder: ${{ steps.buildx.outputs.name }}
-          path: ${{ runner.temp }}/container-cargo
-          architecture: amd64
+          name: codex-proxy-rs-linux-amd64
+          path: dist/docker-artifacts/codex-proxy-rs-linux-amd64

-      - name: Release restored Cargo snapshot
-        run: rm -rf "$RUNNER_TEMP/container-cargo"
+      - name: Prepare prebuilt image
+        if: ${{ !inputs.source_build }}
+        env:
+          MATRIX_OS: linux
+          MATRIX_ARCH: amd64
+          MATRIX_BINARY: codex-proxy-rs
+        run: |
+          ruby -r './.github/scripts/release-metadata' -e '
+            ReleaseMetadata.seal_manifest(
+              "version" => ReleaseMetadata.version(YAML.load_file("release/version.yaml").fetch("version")),
+              "git_sha" => ReleaseMetadata.git("rev-parse", "HEAD")
+            )'
+          ruby .github/scripts/package-release.rb image

      - name: Build runtime image
        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
        with:
          context: .
          file: deploy/Dockerfile
-          target: runtime
+          target: ${{ inputs.source_build && 'runtime' || 'runtime-prebuilt' }}
+          build-args: |
+            CPR_PREBUILT_DIR=dist/docker
+            CPR_GIT_SHA=${{ inputs.ref }}
          load: true
          tags: ${{ env.CPR_IMAGE }}
          no-cache-filters: |
            runtime-base
            runtime
-          cache-from: type=gha,scope=runtime-ci
-          cache-to: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' && 'type=gha,mode=max,scope=runtime-ci' || '' }}
+            runtime-prebuilt
+          cache-from: type=gha,scope=runtime-${{ inputs.source_build && 'source' || 'prebuilt' }}
+          cache-to: ${{ (github.event_name == 'push' || github.event_name == 'schedule') && github.ref == 'refs/heads/main' && format('type=gha,mode=max,scope=runtime-{0}', inputs.source_build && 'source' || 'prebuilt') || '' }}

      - name: Verify runtime image
        uses: ./.github/actions/verify-container
@@ -72,23 +135,3 @@ jobs:
          image: ${{ env.CPR_IMAGE }}
          platform: linux/amd64
          artifact-name: container-diagnostics-${{ github.run_id }}-${{ github.run_attempt }}-amd64
-
-      # 构建层命中时 mount 仍可能为空，只有实际检查过内容的快照才允许保存。
-      - name: Export Cargo snapshot
-        if: >-
-          github.event_name == 'push' && github.ref == 'refs/heads/main' &&
-          (steps.cargo-cache.outputs.cache-hit != 'true' || steps.cargo-restore.outputs.usable != 'true')
-        id: cargo-snapshot
-        uses: ./.github/actions/cargo-cache
-        with:
-          operation: snapshot
-          builder: ${{ steps.buildx.outputs.name }}
-          path: ${{ runner.temp }}/container-cargo
-          architecture: amd64
-
-      - name: Save Cargo snapshot
-        if: steps.cargo-snapshot.outputs.usable == 'true' && steps.cargo-cache.outputs.cache-hit != 'true'
-        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: ${{ runner.temp }}/container-cargo
-          key: ${{ steps.cargo-cache.outputs.cache-primary-key }}
@@ -28,6 +28,7 @@ jobs:
    timeout-minutes: 30
    env:
      CARGO_TERM_COLOR: always
+      CARGO_PROFILE_DEV_DEBUG: '1'
      # 编译 AWS SDK 调试信息需要更大的 codegen 线程栈
      RUST_MIN_STACK: 16777216
      CPR_TEST_DATABASE_URL: postgres://codex_proxy:codex_proxy@127.0.0.1:5432/codex_proxy
@@ -111,7 +112,9 @@ jobs:
        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
        with:
          workspaces: backend -> target
-          save-if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
+          shared-key: quality
+          cache-bin: false
+          save-if: ${{ github.event_name != 'pull_request' && github.ref == 'refs/heads/main' }}

      - name: Rust format
        working-directory: backend
@@ -122,7 +125,7 @@ jobs:
        run: cargo clippy --all-targets --all-features --locked -- -D warnings

      - name: Setup nextest
-        uses: taiki-e/install-action@68a389c788b2cd04016ce8c80ee23b80d2ab3d68 # v2.88.1
+        uses: taiki-e/install-action@3a3daafd3b7f23b8f65d9f5ba2db203fb59b79e2 # v2.90.2
        with:
          tool: cargo-nextest@0.9.143
          fallback: none
@@ -131,7 +134,7 @@ jobs:
        working-directory: backend
        run: |
          cargo metadata --format-version 1 --locked > "$RUNNER_TEMP/nextest-cargo-metadata.json"
-          cargo nextest list --test main --locked --list-type binaries-only --message-format json \
+          cargo nextest list --test main --locked --timings --list-type binaries-only --message-format json \
            > "$RUNNER_TEMP/nextest-binaries.json"

      - name: Configure PostgreSQL and Redis test authentication
@@ -173,10 +176,22 @@ jobs:
      - name: Rust tests
        working-directory: backend
        run: |
-          cargo nextest run \
+          printf '[profile.ci.junit]\npath = "junit.xml"\n' > "$RUNNER_TEMP/nextest-ci.toml"
+          cargo nextest run --config-file "$RUNNER_TEMP/nextest-ci.toml" \
            --cargo-metadata "$RUNNER_TEMP/nextest-cargo-metadata.json" \
            --binaries-metadata "$RUNNER_TEMP/nextest-binaries.json" \
-            --test-threads 8 --no-tests fail
+            --test-threads 8 --no-tests fail --profile ci
+
+      - name: Upload test and build reports
+        if: always()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: backend-quality-reports
+          path: |
+            backend/target/nextest/ci/junit.xml
+            backend/target/cargo-timings/
+          if-no-files-found: ignore
+          retention-days: 7

      - name: Store tests with Redis ACL authentication
        working-directory: backend
@@ -29,6 +29,7 @@ jobs:
      backend: ${{ steps.filter.outputs.backend }}
      frontend: ${{ steps.filter.outputs.frontend }}
      container: ${{ steps.filter.outputs.container }}
+      source_container: ${{ steps.filter.outputs.source_container }}
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -67,10 +68,30 @@ jobs:
              - '.dockerignore'
              - 'release/version.yaml'
              - '.github/actions/verify-container/**'
-              - '.github/actions/cargo-cache/**'
+              - '.github/actions/build-binary/**'
+              - '.github/actions/build-frontend/**'
+              - '.github/scripts/toolchains.rb'
+              - '.github/scripts/package-release.rb'
+              - '.github/scripts/release-metadata.rb'
              - '.github/workflows/_container.yml'
              - '.github/workflows/ci.yml'
              - '!**/*.md'
+            source_container:
+              - 'deploy/Dockerfile'
+              - 'deploy/Dockerfile.dockerignore'
+              - '.dockerignore'
+              - 'backend/**/Cargo.toml'
+              - 'backend/Cargo.lock'
+              - 'backend/rust-toolchain.toml'
+              - 'backend/**/build.rs'
+              - 'backend/.cargo/**'
+              - 'frontend/package.json'
+              - 'frontend/pnpm-lock.yaml'
+              - 'frontend/pnpm-workspace.yaml'
+              - 'frontend/.npmrc'
+              - 'frontend/patches/**'
+              - '.github/workflows/_container.yml'
+              - '.github/workflows/ci.yml'

  quality:
    needs: changes
@@ -78,7 +99,8 @@ jobs:
    with:
      ref: ${{ github.event.pull_request.head.sha || github.sha }}
      run_backend: ${{ needs.changes.outputs.backend == 'true' }}
-      run_frontend: ${{ needs.changes.outputs.frontend == 'true' }}
+      # 预构建容器复用同一次前端检查产物，源码 Docker 构建仍独立验证
+      run_frontend: ${{ needs.changes.outputs.frontend == 'true' && (needs.changes.outputs.container != 'true' || needs.changes.outputs.source_container == 'true') }}

  container:
    needs: changes
@@ -89,3 +111,4 @@ jobs:
    uses: ./.github/workflows/_container.yml
    with:
      ref: ${{ github.event.pull_request.head.sha || github.sha }}
+      source_build: ${{ needs.changes.outputs.source_container == 'true' }}
@@ -7,6 +7,10 @@ on:
        description: 'Tag to release, for example v0.1.0'
        required: true
        type: string
+      index_only:
+        description: 'Recover the index for an already public release without rebuilding'
+        type: boolean
+        default: false

 permissions:
  contents: read
@@ -21,8 +25,12 @@ env:

 jobs:
  release-info:
+    if: ${{ !inputs.index_only }}
    runs-on: ubuntu-26.04
    timeout-minutes: 10
+    permissions:
+      contents: read
+      actions: read
    outputs:
      tag: ${{ steps.version.outputs.tag }}
      version: ${{ steps.version.outputs.version }}
@@ -32,12 +40,14 @@ jobs:
      platform_matrix: ${{ steps.version.outputs.platform_matrix }}
      docker_matrix: ${{ steps.version.outputs.docker_matrix }}
      non_docker_matrix: ${{ steps.version.outputs.non_docker_matrix }}
+      windows_matrix: ${{ steps.version.outputs.windows_matrix }}
      docker_platforms: ${{ steps.version.outputs.docker_platforms }}
      previous_tag: ${{ steps.version.outputs.previous_tag }}
      prerelease: ${{ steps.version.outputs.prerelease }}
      build_type: ${{ steps.version.outputs.build_type }}
      rust: ${{ steps.toolchains.outputs.rust }}
      rust_image: ${{ steps.toolchains.outputs.rust_image }}
+      run_backend: ${{ steps.quality.outputs.run_backend }}

    steps:
      - name: Checkout
@@ -56,21 +66,88 @@ jobs:
        id: toolchains
        run: ruby .github/scripts/toolchains.rb >> "$GITHUB_OUTPUT"

+      - name: Check reusable backend CI evidence
+        id: quality
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: ruby .github/scripts/release-quality.rb >> "$GITHUB_OUTPUT"
+
      - name: Upload sealed plugin assets
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: plugin-release-assets
          path: dist/plugin-release-assets
          if-no-files-found: error
-          retention-days: 1
+          retention-days: 7

  quality:
    needs: [release-info]
    uses: ./.github/workflows/_quality.yml
    with:
      ref: ${{ needs.release-info.outputs.git_sha }}
+      run_backend: ${{ needs.release-info.outputs.run_backend == 'true' }}
      run_frontend: false

+  windows:
+    needs: release-info
+    name: windows-tests (${{ matrix.arch }})
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJson(needs.release-info.outputs.windows_matrix) }}
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 30
+    env:
+      RUST_MIN_STACK: '16777216'
+      RUSTFLAGS: '-C target-feature=+crt-static'
+      CARGO_PROFILE_DEV_DEBUG: '1'
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ needs.release-info.outputs.git_sha }}
+      - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master
+        with:
+          toolchain: ${{ needs.release-info.outputs.rust }}
+          targets: ${{ matrix.target }}
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
+        with:
+          workspaces: backend -> target
+          shared-key: platform-tests-${{ matrix.target }}
+          cache-bin: false
+          save-if: ${{ github.event_name != 'pull_request' }}
+      - name: Setup nextest
+        uses: taiki-e/install-action@3a3daafd3b7f23b8f65d9f5ba2db203fb59b79e2 # v2.90.2
+        with:
+          tool: cargo-nextest@0.9.143
+          fallback: none
+      - name: Verify Windows platform behavior
+        shell: bash
+        working-directory: backend
+        env:
+          BUILD_TARGET: ${{ matrix.target }}
+        # 同一次构建统一两个 package 的依赖特性，保留原有平台用例和静态运行库
+        run: |
+          printf '[profile.ci.junit]\npath = "junit.xml"\n' > "$RUNNER_TEMP/nextest-ci.toml"
+          cargo nextest run --config-file "$RUNNER_TEMP/nextest-ci.toml" --locked --target "$BUILD_TARGET" \
+            -p gateway-admin -p gateway-host --test main --no-tests fail --profile ci \
+            -E '(package(=gateway-admin) & test(/^use_case::plugins::official::/)) | (package(=gateway-host) & test(/^system_update::/))'
+      - name: Upload test report
+        if: always()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: windows-tests-${{ matrix.arch }}
+          path: backend/target/nextest/ci/junit.xml
+          if-no-files-found: ignore
+          retention-days: 7
+
+  security:
+    needs: release-info
+    uses: ./.github/workflows/security.yml
+    permissions:
+      contents: read
+      security-events: write
+    with:
+      ref: ${{ needs.release-info.outputs.git_sha }}
+
  frontend:
    needs: release-info
    runs-on: ubuntu-26.04
@@ -103,40 +180,15 @@ jobs:
        with:
          ref: ${{ needs.release-info.outputs.git_sha }}

-      - name: Cache Cargo
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            backend/target
-          # 按目标、工具链和依赖保存，不为每个发行提交复制整个 target
-          key: cargo-v3-${{ runner.os }}-${{ matrix.target }}-${{ needs.release-info.outputs.rust_image }}-${{ hashFiles('backend/Cargo.lock', 'backend/rust-toolchain.toml', 'backend/**/Cargo.toml', 'backend/.cargo/config.toml') }}
-          restore-keys: |
-            cargo-v3-${{ runner.os }}-${{ matrix.target }}-
-
      - name: Build binary
-        shell: bash
-        run: |
-          mkdir -p "$HOME/.cargo" "../dist/binaries/${{ matrix.os }}-${{ matrix.arch }}"
-          docker run --rm \
-            --platform "${{ matrix.dockerPlatform }}" \
-            --user "$(id -u):$(id -g)" \
-            -e CARGO_HOME=/cargo \
-            -e HOME=/tmp \
-            -e CPR_VERSION="${CPR_VERSION}" \
-            -e CPR_GIT_SHA="${CPR_GIT_SHA}" \
-            -e CPR_BUILD_TIME="${CPR_BUILD_TIME}" \
-            -e CPR_BUILD_TYPE="${CPR_BUILD_TYPE}" \
-            -v "$HOME/.cargo:/cargo" \
-            -v "$PWD/..:/workspace" \
-            -w /workspace/backend \
-            "${RUST_IMAGE}" \
-            cargo build --release --locked --target "${{ matrix.target }}" --bin codex-proxy-rs
-          cp "target/${{ matrix.target }}/release/${{ matrix.binary }}" "../dist/binaries/${{ matrix.os }}-${{ matrix.arch }}/${{ matrix.binary }}"
-        working-directory: backend
+        uses: ./.github/actions/build-binary
+        with:
+          rust: ${{ needs.release-info.outputs.rust }}
+          target: ${{ matrix.target }}
+          platform: ${{ matrix.os }}-${{ matrix.arch }}
+          binary: ${{ matrix.binary }}
+          rust-image: ${{ needs.release-info.outputs.rust_image }}
        env:
-          RUST_IMAGE: ${{ needs.release-info.outputs.rust_image }}
          CPR_VERSION: ${{ needs.release-info.outputs.version }}
          CPR_GIT_SHA: ${{ needs.release-info.outputs.git_sha }}
          CPR_BUILD_TIME: ${{ needs.release-info.outputs.build_time }}
@@ -148,7 +200,7 @@ jobs:
          name: codex-proxy-rs-${{ matrix.os }}-${{ matrix.arch }}
          path: dist/binaries/${{ matrix.os }}-${{ matrix.arch }}/
          if-no-files-found: error
-          retention-days: 1
+          retention-days: 7

  build-binary:
    name: build-binary (${{ matrix.os }}-${{ matrix.arch }})
@@ -165,30 +217,13 @@ jobs:
        with:
          ref: ${{ needs.release-info.outputs.git_sha }}

-      - name: Setup Rust
-        uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master
-        with:
-          toolchain: ${{ needs.release-info.outputs.rust }}
-          targets: ${{ matrix.target }}
-
-      - name: Cache Cargo
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            backend/target
-          key: cargo-v3-${{ runner.os }}-${{ matrix.target }}-${{ hashFiles('backend/Cargo.lock', 'backend/rust-toolchain.toml', 'backend/**/Cargo.toml', 'backend/.cargo/config.toml') }}
-          restore-keys: |
-            cargo-v3-${{ runner.os }}-${{ matrix.target }}-
-
      - name: Build binary
-        shell: bash
-        run: |
-          cargo build --release --locked --target "${{ matrix.target }}" --bin codex-proxy-rs
-          mkdir -p "../dist/binaries/${{ matrix.os }}-${{ matrix.arch }}"
-          cp "target/${{ matrix.target }}/release/${{ matrix.binary }}" "../dist/binaries/${{ matrix.os }}-${{ matrix.arch }}/${{ matrix.binary }}"
-        working-directory: backend
+        uses: ./.github/actions/build-binary
+        with:
+          rust: ${{ needs.release-info.outputs.rust }}
+          target: ${{ matrix.target }}
+          platform: ${{ matrix.os }}-${{ matrix.arch }}
+          binary: ${{ matrix.binary }}
        env:
          CPR_VERSION: ${{ needs.release-info.outputs.version }}
          CPR_GIT_SHA: ${{ needs.release-info.outputs.git_sha }}
@@ -201,7 +236,7 @@ jobs:
          name: codex-proxy-rs-${{ matrix.os }}-${{ matrix.arch }}
          path: dist/binaries/${{ matrix.os }}-${{ matrix.arch }}/
          if-no-files-found: error
-          retention-days: 1
+          retention-days: 7

  package-assets:
    needs: [release-info, frontend, build-docker-binary, build-binary]
@@ -209,8 +244,6 @@ jobs:
    timeout-minutes: 20
    permissions:
      contents: read
-      id-token: write
-      attestations: write

    steps:
      - name: Checkout
@@ -244,18 +277,13 @@ jobs:
          PLATFORM_MATRIX: ${{ needs.release-info.outputs.platform_matrix }}
        run: ruby .github/scripts/package-release.rb archives

-      - name: Generate release asset provenance
-        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
-        with:
-          subject-path: dist/release/*
-
      - name: Upload release assets
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: release-assets
          path: dist/release
          if-no-files-found: error
-          retention-days: 1
+          retention-days: 7
          # tar.gz 已压缩，Actions 只负责传递原始发行字节。
          compression-level: 0

@@ -312,7 +340,7 @@ jobs:
        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1

      - name: Login to GHCR
-        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+        uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
@@ -367,14 +395,14 @@ jobs:
          name: image-digest-${{ matrix.os }}-${{ matrix.arch }}
          path: dist/digests/*.txt
          if-no-files-found: error
-          retention-days: 1
+          retention-days: 7

  publish:
    concurrency:
      group: release-publication
      queue: max
    # 产物准备可与测试重叠，版本标签和 GitHub Release 必须等全部质量与镜像验证通过
-    needs: [release-info, quality, package-assets, build-docker-image]
+    needs: [release-info, quality, windows, security, package-assets, build-docker-image]
    runs-on: ubuntu-26.04
    timeout-minutes: 20
    permissions:
@@ -406,10 +434,10 @@ jobs:
        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1

      - name: Install Cosign
-        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+        uses: sigstore/cosign-installer@756fe2d284c7292c4e9b62c8a28f1e5629c59532 # v4.1.3

      - name: Login to GHCR
-        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
+        uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
@@ -480,24 +508,12 @@ jobs:
        shell: bash
        env:
          INSTALLATION_NOTES: |
-            ## 📥 安装
+            ## Linux 一键安装（Docker Compose）

-            **Docker 部署：**
            ```bash
-            # 从 GitHub 容器镜像仓库拉取
-            docker pull ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ needs.release-info.outputs.docker_version }}
+            curl -fsSLO https://raw.githubusercontent.com/${{ github.repository }}/${{ needs.release-info.outputs.tag }}/deploy/install.sh && CPR_RELEASE_TAG=${{ needs.release-info.outputs.tag }} bash install.sh
            ```

-            请从本版本附件下载 `compose.yaml` 和 `config.example.yaml`。Compose 默认固定到本版本镜像；升级前请对比模板与已有配置。
-
-            **手动下载：**
-            请从下方附件中下载适合当前平台的归档包。
-
-            附件包含与当前宿主版本及提交绑定的 `plugin-release-manifest.json`，当前没有默认内置插件。
-            教学示例由独立的 `codex-proxy-plugins` 仓库维护和发布，不随宿主发行物分发。
-
-            发布归档提供 GitHub 构建产物证明。Docker 镜像附带软件物料清单（SBOM）、构建来源证明和 cosign 无密钥签名。
-
            ## 📚 文档

            - [GitHub 仓库](https://github.com/${{ github.repository }})
@@ -510,9 +526,20 @@ jobs:
          File.write(output, "#{notes}\n\n#{installation}\n")
          RUBY

+      - name: Check that the release is unpublished
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ needs.release-info.outputs.version }}
+        run: ruby .github/scripts/published-channels.rb check "$VERSION"
+
+      - name: Generate release asset provenance
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
+        with:
+          subject-path: dist/release/*
+
      - name: Upload GitHub Release assets
        id: release
-        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
+        uses: softprops/action-gh-release@8a0cd651e5b2365bd640854a3fa5dfc70e4875f3 # v3.0.4
        with:
          tag_name: ${{ needs.release-info.outputs.tag }}
          generate_release_notes: true
@@ -533,3 +560,25 @@ jobs:
          DIGEST: ${{ steps.manifest.outputs.digest }}
          RELEASE_ID: ${{ steps.release.outputs.id }}
        run: ruby .github/scripts/publish-release.rb
+
+      - name: Publish verified channels to main
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VERSION: ${{ needs.release-info.outputs.version }}
+        run: ruby .github/scripts/published-channels.rb publish "$VERSION"
+
+  recover-index:
+    if: inputs.index_only
+    runs-on: ubuntu-26.04
+    concurrency:
+      group: release-publication
+      queue: max
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Verify public assets and publish channels to main
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ inputs.tag }}
+        run: ruby .github/scripts/published-channels.rb publish "$TAG"
@@ -1,6 +1,12 @@
 name: Security

 on:
+  workflow_call:
+    inputs:
+      ref:
+        description: Exact commit SHA to audit
+        required: true
+        type: string
  push:
    branches:
      - main
@@ -14,7 +20,7 @@ permissions:
  contents: read

 concurrency:
-  group: security-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.head_ref || github.ref_name }}
+  group: security-${{ github.workflow }}-${{ inputs.ref || github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.head_ref || github.ref_name }}
  cancel-in-progress: true

 jobs:
@@ -25,10 +31,10 @@ jobs:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
-          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          ref: ${{ inputs.ref || github.event.pull_request.head.sha || github.sha }}

      - name: Install cargo-audit
-        uses: taiki-e/install-action@68a389c788b2cd04016ce8c80ee23b80d2ab3d68 # v2.88.1
+        uses: taiki-e/install-action@3a3daafd3b7f23b8f65d9f5ba2db203fb59b79e2 # v2.90.2
        with:
          tool: cargo-audit@0.22.2
          fallback: none
@@ -44,10 +50,10 @@ jobs:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
-          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          ref: ${{ inputs.ref || github.event.pull_request.head.sha || github.sha }}

      - name: Setup pnpm
-        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+        uses: pnpm/action-setup@73e46992e05b19abd31f2f3c20e0e7370d762115 # v6.1.1
        with:
          package_json_file: frontend/package.json

@@ -17,6 +17,9 @@
 /.runtime/
 *.log

+# Local planning documents
+/docs/plans/
+
 # Local configuration and secrets
 /deploy/config.yaml
 .env
@@ -12,9 +12,9 @@

 结合上下文识别“提交吧”“看看这个问题”等省略说法：普通 Git 提交不自动变成 PR，代码排查不自动变成 Issue；审查与发版准备不代表获准远程写入

-先完整读取命中技能的 `SKILL.md`，再读取其领域必读规范，之后按当前步骤补充实现、命令和示例。技能名称、描述或入口摘要不能代替正文与必读引用；引用中明确要求“先读”“必须读取”或“执行”的规范也要落实，其他资料按需读取
+首次命中技能时完整读取其 `SKILL.md`，再读取领域必读规范，之后按当前步骤补充实现、命令和示例。技能名称、描述或入口摘要不能代替首次读取的正文与必读引用；引用中明确要求“先读”“必须读取”或“执行”的规范也要落实，其他资料按需读取

-按用户意图、行为影响和实际文件共同匹配，跨领域叠加；确定方案或给出审查结论前完成对应领域必读，不能因改动小、路径未落在该模块或自认为熟悉而跳过。只复用当前上下文中已实际读取且仍适用的内容；输出截断、上下文压缩后缺失的必要内容须补读，范围或阶段变化时重新匹配
+按用户意图、行为影响和实际文件共同匹配，跨领域叠加；确定方案或给出审查结论前完成对应领域必读，不能因改动小、路径未落在该模块或自认为熟悉而跳过

 执行所选流程中的问题核实、自审、验证与交付要求，协作流程和审查标准见 [CONTRIBUTING.md](CONTRIBUTING.md)

@@ -23,6 +23,13 @@ Issue 和 PR 回复统一按 [GitHub 回复口吻](CONTRIBUTING.md#github-回复
 模块职责以 [系统架构](docs/architecture.md) 为准，界面约定以 [管理端主题](docs/theme.md) 为准；
 没有明确约定时保持与相邻实现一致，不把单次页面反馈扩展成全仓规则

+### 任务延续与收尾
+
+- 在任务上下文和压缩摘要中保留目标、授权、当前阶段、已读规范的路径与关键约束、验证命令与结果及对应代码状态、剩余事项
+- 同一任务可复用实际完成的读取与验证记录；仅在规范变更、进入未覆盖领域或具体决策缺少条款时补读对应内容。输出截断只补缺失部分，上下文压缩与阶段切换本身不触发重读或重验
+- 远端更新或合并冲突后，按实际变更及其依赖影响补充自审和验证，复用未受影响的证据
+- 实现、自审与必要验证完成后，按[验证停止条件](CONTRIBUTING.md#验证)停止扩围；完成已获授权的剩余交付步骤并确认结果后结束
+
 <!-- CODEGRAPH_START -->
 ## CodeGraph

@@ -126,7 +126,8 @@ PR 不接受以下协作规则文件的新增、修改、删除或重命名：
 - AI 进行 Rust 开发时，加载并使用 `$rust-best-practices` 技能。模块、可见性、依赖方向和测试目录按架构文档执行，使用现有 Rustfmt 与 Clippy 配置
 - Vue 使用 TypeScript、`<script setup>` 和现有 ESLint 配置；API 请求通过已有模块及 `request` 封装，沿用逐行请求配置格式
 - 业务数据的解析、校验和展示优先复用已有逻辑。新增抽象放在拥有该职责的模块，避免重复事实源或无实际需求的通用层
- 新增代码注释使用中文。提交信息使用英文 Conventional Commits，参考近期历史，按完整功能归并；确由 Codex 参与的提交保留 `Co-authored-by: Codex <noreply@openai.com>`
+- 新增代码注释使用中文。提交信息使用英文 Conventional Commits，参考近期历史，按完整功能归并
+- AI 参与的提交按实际助手添加 `Co-authored-by: 名称 <邮箱>`，名称与邮箱采用该助手已知的署名身份，并保留其他实际共同作者署名；PR 的 AI 使用披露不替代提交署名
 - 发布说明写入 `release/notes.md`，标题首行为目标版本的 `# vX.Y.Z`，章节标题和正文使用中文；命令、配置键、协议名等保留原文。只说明本次版本的实际变化，按影响交代升级事项
 - PR 聚焦目标；无关格式化、重构和依赖升级单独处理

@@ -232,6 +233,10 @@ git diff --check

 后端 CI 使用 nextest 执行 `main` 集成测试，默认 Redis 密码模式执行完整测试集，ACL 用户模式复用同一批构建产物执行 Store 的 Redis 测试；本地验证命令见 [架构文档](docs/architecture.md#验证命令)

+常规容器检查与发行构建共用二进制构建入口，并复用已检查的前端产物；Dockerfile、工具链、依赖或构建配置变化时执行完整源码镜像构建，定期安全检查也覆盖源码构建。两条路径均验证容器运行、安全扫描与关闭行为
+
+发行构建与质量检查并行，Windows 两种架构的插件与系统更新测试独立运行。仅当发行提交只修改版本与发布说明，且其父提交有本仓库主分支成功的后端 CI 时复用该结果；缺少证据则完整重跑。对外发布等待质量、Windows 测试、依赖审计和镜像验证全部成功，构建耗时与测试报告保留 7 天
+
 新增自动规则优先使用现有工具，要求依据明确、结果稳定、误报可控；无法可靠判定的设计与视觉问题保留审查判断，避免把具体源码写法锁成测试

 AI 自动审查需要在所用工具中单独启用。其支持的检查范围和优先级过滤以工具说明为准；即使能读取 `AGENTS.md`，也不能保证所有可维护性和视觉问题都会被报告。配置参考 [Codex GitHub 审查文档](https://learn.chatgpt.com/docs/third-party/github)
@@ -17,7 +17,7 @@
 </div>

 > [!NOTE]
-> 本项目提供 Responses API 和 Chat Completions API；Chat Completions 请求通过 Responses 链路执行，支持范围见 [API 参考](docs/api.md#chat-completions-请求)
+> 生成请求支持 [OpenAI Responses](docs/api.md#responses-请求与传输)、[Chat Completions](docs/api.md#chat-completions-请求) 和 [Anthropic Messages](docs/api.md#messages-请求) 三种协议

 ## 快速预览

@@ -40,6 +40,9 @@

 以下命令适用于 Linux amd64/arm64，需要 Docker Engine、Docker Compose Plugin、curl 和 OpenSSL

+macOS 从[发行页](https://github.com/zyycn/codex-proxy-rs/releases)下载对应的归档：Intel 机型选 `darwin_amd64`，Apple Silicon 机型选 `darwin_arm64`。
+Windows x64 / ARM64 的安装步骤见 [Windows 二进制部署](deploy/README.md#windows-二进制部署)
+
 已有部署请先看 [升级说明](deploy/README.md#镜像升级与源码构建)，不要覆盖原配置

 ### 一键安装
@@ -89,7 +92,7 @@ API Key 持有者可在登录页切换身份，查看自己的用量与额度，

 1. 在「账号」中添加账号，完成授权或导入
 2. 按需建立账号分组，再创建客户端密钥并选择可用分组，**不选分组表示可使用全部账号**
-3. 打开密钥的「使用密钥」，复制客户端配置
+3. [连接客户端](#客户端接入)

 ## 客户端接入

@@ -97,12 +100,12 @@ API Key 持有者可在登录页切换身份，查看自己的用量与额度，

 完整步骤、生图配置与排障见[客户端配置](deploy/README.md#客户端配置)

-**其他 Responses / Chat Completions API 客户端**：填写以下信息：
+**其他 API 客户端**：API Key 填写管理端创建的客户端密钥。按客户端自动追加的请求路径填写 Base URL；远程接入时将本机地址换成服务器的 HTTPS 地址

-| 配置 | 值 |
+| 客户端自动追加的路径 | Base URL（本机部署） |
 | --- | --- |
-| Base URL | `http://127.0.0.1:8080/v1`；远程接入使用服务器的 HTTPS 地址 |
-| API Key | 管理端创建的客户端密钥 |
+| OpenAI Responses：`/responses`；Chat Completions：`/chat/completions` | `http://127.0.0.1:8080/v1` |
+| Anthropic Messages：`/v1/messages` | `http://127.0.0.1:8080` |

 查询该密钥可见的模型目录：

@@ -102,6 +102,12 @@ dependencies = [
 "windows-sys 0.61.2",
 ]

+[[package]]
+name = "anyhow"
+version = "1.0.104"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
+
 [[package]]
 name = "arc-swap"
 version = "1.9.2"
@@ -147,9 +153,9 @@ dependencies = [

 [[package]]
 name = "async-compression"
-version = "0.4.51"
+version = "0.4.52"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d5755640120b24961f8231e05892e4a4f7e0d04e8aeca161508c9c397946970"
+checksum = "6ad47a740fb906fffdd891e8b6d5fde2511600f7bfaebd68939fa08a14999459"
 dependencies = [
 "compression-codecs",
 "compression-core",
@@ -286,9 +292,9 @@ dependencies = [

 [[package]]
 name = "aws-sdk-s3"
-version = "1.156.0"
+version = "1.157.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1072c9aa20159b9b417115342d38c4c53108fc98e5359fcb86b7d4575747eb59"
+checksum = "6ea9794c741520d8baec9462bcd0ad12164d4f5f78d008a8da9d6a0b7222caa8"
 dependencies = [
 "arc-swap",
 "aws-credential-types",
@@ -503,9 +509,9 @@ dependencies = [

 [[package]]
 name = "aws-smithy-schema"
-version = "1.1.0"
+version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bec8dae1015a6d959a5faf86fbdf77486cfe19e4ccb6ee009d8a46efc45028a4"
+checksum = "9543fc722ed4865ab29fb66bd7ed0bef7b029d265ba8c587144511e30006d431"
 dependencies = [
 "aws-smithy-runtime-api",
 "aws-smithy-types",
@@ -716,6 +722,17 @@ version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dc0b364ead1874514c8c2855ab558056ebfeb775653e7ae45ff72f28f8f3166c"

+[[package]]
+name = "bstr"
+version = "1.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6bb31b46c14244e20ee9984b11bf5c992b91fb6939fea616e3512c8baecdbe5f"
+dependencies = [
+ "memchr",
+ "regex-automata",
+ "serde_core",
+]
+
 [[package]]
 name = "bumpalo"
 version = "3.20.3"
@@ -942,9 +959,9 @@ dependencies = [

 [[package]]
 name = "compression-codecs"
-version = "0.4.46"
+version = "0.4.47"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cae36683101b2899f48bd31f8db9839437356188e3b1ff23096e73dab09ba8fe"
+checksum = "84f840cff84d10085260e460023934d0af699e71212b09b2a41452e8bd9cda43"
 dependencies = [
 "compression-core",
 "flate2",
@@ -966,7 +983,7 @@ dependencies = [
 "pathdiff",
 "serde_core",
 "winnow 1.0.3",
- "yaml-rust2",
+ "yaml-rust2 0.11.1",
 ]

 [[package]]
@@ -1081,9 +1098,9 @@ dependencies = [

 [[package]]
 name = "crc32fast"
-version = "1.5.3"
+version = "1.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ba106e844045ddc02c20768ac4b0b7cb45f2cc2ecbd833ac9f5dacb183c2055"
+checksum = "5f97d3416d5337d15c4b0d78c8c91df922ca143f57ec20e2d1c188333047ef04"
 dependencies = [
 "cfg-if",
 ]
@@ -1126,9 +1143,9 @@ checksum = "61803da095bee82a81bb1a452ecc25d3b2f1416d1897eb86430c6159ef717c17"

 [[package]]
 name = "crypto-bigint"
-version = "0.7.6"
+version = "0.7.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6bb08299a6046833a879ace115697f12fd2bd6c8d3e93c909ffc9e0738e7cae0"
+checksum = "914c195c4d7fbc5ed7f88d14cbf85914d5c664967658d43404b263913a477e82"
 dependencies = [
 "cpubits",
 "ctutils",
@@ -1186,9 +1203,9 @@ dependencies = [

 [[package]]
 name = "ctutils"
-version = "0.4.5"
+version = "0.4.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38d28fb6aa7dd680b3ffd1a3e64e115c177bdba63c0ae7f9cd48129ff05c4fa0"
+checksum = "261af4dc7a06ea8a527a8717d8cbba3417530d6ea14e1edb3de6b67806be474f"
 dependencies = [
 "cmov",
 "subtle",
@@ -1773,9 +1790,11 @@ dependencies = [
 "bytes",
 "chrono",
 "chrono-tz",
+ "cron",
 "event-listener",
 "futures",
 "futures-timer",
+ "gateway-protocol",
 "http",
 "http-body-util",
 "semver",
@@ -1834,6 +1853,7 @@ dependencies = [
 "tracing-appender",
 "tracing-subscriber",
 "wiremock",
+ "yaml-rust2 0.13.0",
 ]

 [[package]]
@@ -2064,6 +2084,15 @@ dependencies = [
 "hashbrown 0.16.1",
 ]

+[[package]]
+name = "hashlink"
+version = "0.12.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a596f1b20ed2cc5ecac41a164aaebc7258057060f06c0cf7a2ba3991ee7990fb"
+dependencies = [
+ "hashbrown 0.17.1",
+]
+
 [[package]]
 name = "headers"
 version = "0.4.2"
@@ -2576,9 +2605,9 @@ dependencies = [

 [[package]]
 name = "libsqlite3-sys"
-version = "0.37.0"
+version = "0.39.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1f111c8c41e7c61a49cd34e44c7619462967221a6443b0ec299e0ac30cfb9b1"
+checksum = "14a5f01b87b92705d07b433c06f96cbc764637d81a0bffb5734ce17cf0f9a2b3"
 dependencies = [
 "pkg-config",
 "vcpkg",
@@ -2729,9 +2758,9 @@ dependencies = [

 [[package]]
 name = "mio"
-version = "1.2.1"
+version = "1.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02bd0af71c67b473010cbbc60715ee815645a4dc942899111f494b4b737d6fda"
+checksum = "1788edb87fdc09c7e26304471e2f5be8cdefb1b6930d6e3985fc02ff53bf86ee"
 dependencies = [
 "libc",
 "wasi",
@@ -2935,15 +2964,14 @@ checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"

 [[package]]
 name = "openssl"
-version = "0.10.75"
+version = "0.10.80"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08838db121398ad17ab8531ce9de97b244589089e290a384c900cb9ff7434328"
+checksum = "a45fa2aa886c42762255da344f0a0d313e254066c46aad76f300c3d3da62d967"
 dependencies = [
 "bitflags",
 "cfg-if",
 "foreign-types",
 "libc",
- "once_cell",
 "openssl-macros",
 "openssl-sys",
 ]
@@ -2982,9 +3010,9 @@ dependencies = [

 [[package]]
 name = "openssl-sys"
-version = "0.9.111"
+version = "0.9.116"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "82cab2d520aa75e3c58898289429321eb788c3106963d0dc886ec7a5f4adc321"
+checksum = "f28a22dc7140cda5f096e5e7724a6962ca81a7f8bfd2979f9b18c11af56318c4"
 dependencies = [
 "cc",
 "libc",
@@ -3333,6 +3361,7 @@ dependencies = [
 "hyper",
 "hyper-rustls",
 "hyper-util",
+ "lru",
 "native-tls",
 "openssl",
 "openssl-sys",
@@ -3351,6 +3380,7 @@ dependencies = [
 "tar",
 "tempfile",
 "thiserror",
+ "tiktoken-rs",
 "tokio",
 "tokio-rustls",
 "tokio-tungstenite 0.28.0",
@@ -3578,9 +3608,9 @@ dependencies = [

 [[package]]
 name = "redis"
-version = "1.8.0"
+version = "1.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7acd809e80afa754c63f586955699d8990efe1c4b6613183ee5f027a11fbc8b5"
+checksum = "db7f3d75b5a3301746bff39a767bf4c5c42506b08513527308b3875bfb64a031"
 dependencies = [
 "arc-swap",
 "arcstr",
@@ -4217,7 +4247,7 @@ dependencies = [
 [[package]]
 name = "sqlx"
 version = "0.9.0"
-source = "git+https://github.com/transact-rs/sqlx?rev=f1e94ec34dd5f11ad6488a3a8ac7988439a3f757#f1e94ec34dd5f11ad6488a3a8ac7988439a3f757"
+source = "git+https://github.com/transact-rs/sqlx?rev=10462fa4414c6c7f1ed1d39bb31678e3b726878c#10462fa4414c6c7f1ed1d39bb31678e3b726878c"
 dependencies = [
 "sqlx-core",
 "sqlx-macros",
@@ -4229,7 +4259,7 @@ dependencies = [
 [[package]]
 name = "sqlx-core"
 version = "0.9.0"
-source = "git+https://github.com/transact-rs/sqlx?rev=f1e94ec34dd5f11ad6488a3a8ac7988439a3f757#f1e94ec34dd5f11ad6488a3a8ac7988439a3f757"
+source = "git+https://github.com/transact-rs/sqlx?rev=10462fa4414c6c7f1ed1d39bb31678e3b726878c#10462fa4414c6c7f1ed1d39bb31678e3b726878c"
 dependencies = [
 "base64 0.22.1",
 "bytes",
@@ -4244,7 +4274,7 @@ dependencies = [
 "futures-io",
 "futures-util",
 "hashbrown 0.16.1",
- "hashlink",
+ "hashlink 0.11.1",
 "indexmap",
 "log",
 "memchr",
@@ -4266,7 +4296,7 @@ dependencies = [
 [[package]]
 name = "sqlx-macros"
 version = "0.9.0"
-source = "git+https://github.com/transact-rs/sqlx?rev=f1e94ec34dd5f11ad6488a3a8ac7988439a3f757#f1e94ec34dd5f11ad6488a3a8ac7988439a3f757"
+source = "git+https://github.com/transact-rs/sqlx?rev=10462fa4414c6c7f1ed1d39bb31678e3b726878c#10462fa4414c6c7f1ed1d39bb31678e3b726878c"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -4278,7 +4308,7 @@ dependencies = [
 [[package]]
 name = "sqlx-macros-core"
 version = "0.9.0"
-source = "git+https://github.com/transact-rs/sqlx?rev=f1e94ec34dd5f11ad6488a3a8ac7988439a3f757#f1e94ec34dd5f11ad6488a3a8ac7988439a3f757"
+source = "git+https://github.com/transact-rs/sqlx?rev=10462fa4414c6c7f1ed1d39bb31678e3b726878c#10462fa4414c6c7f1ed1d39bb31678e3b726878c"
 dependencies = [
 "cfg-if",
 "dotenvy",
@@ -4303,7 +4333,7 @@ dependencies = [
 [[package]]
 name = "sqlx-mysql"
 version = "0.9.0"
-source = "git+https://github.com/transact-rs/sqlx?rev=f1e94ec34dd5f11ad6488a3a8ac7988439a3f757#f1e94ec34dd5f11ad6488a3a8ac7988439a3f757"
+source = "git+https://github.com/transact-rs/sqlx?rev=10462fa4414c6c7f1ed1d39bb31678e3b726878c#10462fa4414c6c7f1ed1d39bb31678e3b726878c"
 dependencies = [
 "bitflags",
 "byteorder",
@@ -4330,7 +4360,7 @@ dependencies = [
 [[package]]
 name = "sqlx-postgres"
 version = "0.9.0"
-source = "git+https://github.com/transact-rs/sqlx?rev=f1e94ec34dd5f11ad6488a3a8ac7988439a3f757#f1e94ec34dd5f11ad6488a3a8ac7988439a3f757"
+source = "git+https://github.com/transact-rs/sqlx?rev=10462fa4414c6c7f1ed1d39bb31678e3b726878c#10462fa4414c6c7f1ed1d39bb31678e3b726878c"
 dependencies = [
 "atoi",
 "base64 0.22.1",
@@ -4366,7 +4396,7 @@ dependencies = [
 [[package]]
 name = "sqlx-sqlite"
 version = "0.9.0"
-source = "git+https://github.com/transact-rs/sqlx?rev=f1e94ec34dd5f11ad6488a3a8ac7988439a3f757#f1e94ec34dd5f11ad6488a3a8ac7988439a3f757"
+source = "git+https://github.com/transact-rs/sqlx?rev=10462fa4414c6c7f1ed1d39bb31678e3b726878c#10462fa4414c6c7f1ed1d39bb31678e3b726878c"
 dependencies = [
 "atoi",
 "chrono",
@@ -4593,6 +4623,20 @@ dependencies = [
 "cfg-if",
 ]

+[[package]]
+name = "tiktoken-rs"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2aeff724640cfe13037336ddf35befdffd2909cbdb65cf041cc8a4cf8c584cfa"
+dependencies = [
+ "anyhow",
+ "base64 0.22.1",
+ "bstr",
+ "fancy-regex",
+ "regex",
+ "rustc-hash",
+]
+
 [[package]]
 name = "time"
 version = "0.3.53"
@@ -5518,13 +5562,24 @@ dependencies = [

 [[package]]
 name = "yaml-rust2"
-version = "0.11.0"
+version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "631a50d867fafb7093e709d75aaee9e0e0d5deb934021fcea25ac2fe09edc51e"
+checksum = "b36710ce3a279cfce8465dbab826f161675a262950b922cb2c3663852dfe9eb0"
 dependencies = [
 "arraydeque",
 "encoding_rs",
- "hashlink",
+ "hashlink 0.11.1",
+]
+
+[[package]]
+name = "yaml-rust2"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57e5b818a27a4cd30884ea380857a5e56f7ec3ba24a3990a3cc0b95af3238e18"
+dependencies = [
+ "arraydeque",
+ "encoding_rs",
+ "hashlink 0.12.2",
 ]

 [[package]]
@@ -5646,14 +5701,15 @@ dependencies = [

 [[package]]
 name = "zip"
-version = "9.1.3"
+version = "9.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1156b39d142a34b999c2310a50455e0cb3760bf7efad0122f796d813bee26ccb"
+checksum = "3cec733c9820347a592f6375c3c0089b479ba0a0b1cbf3dd1958b02959b7c033"
 dependencies = [
 "crc32fast",
 "flate2",
 "getrandom 0.4.3",
 "indexmap",
+ "libc",
 "memchr",
 "nix",
 "typed-path",
@@ -61,5 +61,5 @@ codegen-units = 1
 panic = "abort"

 [patch.crates-io]
-# 固定上游 BEGIN 取消回滚修复，避免未结束事务复用；见 transact-rs/sqlx#4394
-sqlx = { git = "https://github.com/transact-rs/sqlx", rev = "f1e94ec34dd5f11ad6488a3a8ac7988439a3f757" }
+# 固定包含 BEGIN 取消回滚及 SQLite 安全版本支持的上游提交；见 transact-rs/sqlx#4394、#4502
+sqlx = { git = "https://github.com/transact-rs/sqlx", rev = "10462fa4414c6c7f1ed1d39bb31678e3b726878c" }
@@ -146,6 +146,10 @@ async fn execute(
        providers.admin,
    );
    or_shutdown!(plugin_runtime, services.register_usage_data(&usage_data));
+    or_shutdown!(
+        plugin_runtime,
+        plugin_runtime.bind_usage_queries(&usage_data)
+    );
    let services = std::sync::Arc::new(services);
    or_shutdown!(plugin_runtime, plugin_runtime.bind_services(&services));
    let commands = or_shutdown!(plugin_runtime, plugin_runtime.prepare_command_line().await);
@@ -7,6 +7,7 @@ use gateway_admin::{
    ports::{
        plugin_accounts::PluginAccountAccess, plugin_client_keys::PluginClientKeyAccess,
        plugin_resources::PluginResourceAccess, provider::ProviderAdminRegistry,
+        proxy::PluginProxyAccess,
    },
 };
 use gateway_core::runtime::{RuntimeSnapshotHandle, SnapshotControl};
@@ -35,6 +36,7 @@ pub(super) struct ManagementPorts {
    pub(super) accounts: Arc<dyn PluginAccountAccess>,
    keys: Arc<dyn PluginClientKeyAccess>,
    resources: Arc<dyn PluginResourceAccess>,
+    proxies: Arc<dyn PluginProxyAccess>,
 }

 impl ManagementPorts {
@@ -46,6 +48,7 @@ impl ManagementPorts {
    ) -> Self {
        let ports = store.admin_ports();
        Self {
+            proxies: gateway_admin::initialize_plugin_proxies(ports.proxies()),
            accounts: gateway_admin::initialize_plugin_accounts(
                providers.clone(),
                ports.accounts(),
@@ -66,6 +69,7 @@ impl ManagementPorts {

    pub(super) fn bind(&self, runtime: &PluginRuntime) -> Result<(), AdminError> {
        runtime.bind_account_ports(&self.accounts)?;
+        runtime.bind_proxy_ports(&self.proxies)?;
        runtime.bind_client_key_ports(&self.keys)?;
        runtime.bind_resource_ports(&self.resources)
    }
@@ -128,9 +128,11 @@ pub async fn run() -> Result<(), BootstrapError> {
    let mut probes = store.health_probes();
    probes.extend(core.health_probes());
    probes.push(host.logging_health_probe());
+    let peer_node = or_shutdown!(plugin_runtime, store.peer_routing_id().await);
    let api = or_shutdown!(
        plugin_runtime,
        gateway_api::initialize(
+            peer_node,
            config.api,
            core.execution_service(),
            admin.services(),
@@ -160,6 +162,10 @@ pub async fn run() -> Result<(), BootstrapError> {
        plugin_runtime,
        plugin_runtime.bind_services(&admin.services().public_services())
    );
+    or_shutdown!(
+        plugin_runtime,
+        plugin_runtime.bind_usage_queries(&admin.services().usage_data())
+    );

    let mut plan = store.take_worker_contributions();
    plan.push(analytics_worker);
@@ -4,7 +4,7 @@ use std::{path::PathBuf, sync::Arc};

 use gateway_admin::ports::provider::ProviderAdminRegistry;
 use gateway_core::{engine::provider::ProviderRegistry, time::DeploymentTimeZone};
-use gateway_host::{ConfigError, HostBundle, HostConfig, outbound::HttpClient};
+use gateway_host::{HostBundle, HostConfig, outbound::HttpClient};
 use gateway_store::{StoreBundle, StoreConfig};

 use super::BootstrapError;
@@ -33,6 +33,8 @@ impl Environment {
        let timezone = host.timezone;
        let store = store.with_timezone(timezone);
        let plugin_cache = host.runtime_data_dir().join("plugins");
+        // 插件兼容检查只需本地运行版本，管理端版本查询还会等待远端发行服务
+        let version = host.system_update.version.clone();
        let host = match mode {
            Mode::Server => gateway_host::initialize(host).await?,
            Mode::Command | Mode::Help => gateway_host::initialize_command_line(host).await?,
@@ -44,12 +46,6 @@ impl Environment {
            Mode::Help => gateway_store::initialize_read_only(store).await?,
        };
        host.report_startup_ready("Store");
-        let version = host
-            .system_operations()
-            .version()
-            .await
-            .map_err(|_| ConfigError::InvalidField("host.version"))?
-            .version;
        let plugin_http = Arc::new(HttpClient::new()?);
        Ok(Self {
            host,
@@ -1,7 +1,6 @@
 //! 网关命令行入口，选择启动模式并创建异步运行时

 use std::{
-    env,
    error::Error,
    io::{self, Write},
    process::ExitCode,
@@ -21,7 +20,7 @@ fn main() -> ExitCode {

 fn run() -> Result<ExitCode, Box<dyn Error + Send + Sync>> {
    ensure_rustls_provider();
-    let mut arguments = env::args_os().skip(1);
+    let mut arguments = gateway_host::system_update::startup_arguments()?;
    let command = arguments
        .next()
        .map(|value| {
@@ -92,7 +91,7 @@ fn runtime() -> Result<tokio::runtime::Runtime, io::Error> {

 fn reject_extra_arguments(mut arguments: impl Iterator) -> Result<(), io::Error> {
    if arguments.next().is_some() {
-        return Err(invalid_cli("unexpected extra command arguments"));
+        return Err(invalid_cli("too many arguments"));
    }
    Ok(())
 }
@@ -509,6 +509,7 @@ const ALLOWED_INTERNAL_EDGES: &[(&str, &str)] = &[
    ("gateway-api", "gateway-admin"),
    ("gateway-api", "gateway-core"),
    ("gateway-api", "gateway-protocol"),
+    ("gateway-core", "gateway-protocol"),
    ("gateway-host", "gateway-admin"),
    ("gateway-host", "gateway-core"),
    ("gateway-host", "gateway-protocol"),
@@ -15,7 +15,7 @@ cargo +1.99.1 install --locked --path backend/apps/plugin-cli --root /path/to/lo

 ## 打包

-先构建目标平台的插件二进制；插件提供管理页面时，还需构建页面静态资源。打包命令传入作者清单、二进制和所需的资源目录映射，通过 `cpr-plugin package --help` 查看完整参数：
+先构建目标平台的二进制；有管理页面时，也构建静态资源。全部参数见 `cpr-plugin package --help`

 ```bash
 cpr-plugin package \
@@ -197,6 +197,7 @@ async fn initialize_inner(
        auth,
        accounts: accounts.clone(),
        account_groups: Arc::new(DefaultAccountGroupService::new(
+            upstream_info.clone(),
            store.account_groups(),
            store.account_runtime(),
            snapshot.clone(),
@@ -263,6 +264,14 @@ pub fn initialize_plugin_accounts(
    ))
 }

+/// 为 Runtime 创建代理目录与当前出口解析的窄端口
+#[must_use]
+pub fn initialize_plugin_proxies(
+    store: Arc<dyn ports::proxy::ProxyStore>,
+) -> Arc<dyn ports::proxy::PluginProxyAccess> {
+    Arc::new(use_case::proxies::DefaultPluginProxyAccess { store })
+}
+
 /// 为 Runtime 创建非秘密 Client Key 目录与预算重置的窄端口
 #[must_use]
 pub fn initialize_plugin_client_keys(
@@ -7,6 +7,7 @@ use std::time::{Duration, SystemTime};
 use chrono::{DateTime, Utc};
 use futures::StreamExt as _;
 use gateway_core::account::{AccountErrorProtection, ProviderAccountId};
+use gateway_core::engine::probe::AccountProbeTarget;
 use gateway_core::routing::UpstreamModelId;
 use gateway_core::task::{
    ScheduledTask, WorkerContribution, WorkerCycleContext, WorkerId, WorkerKind,
@@ -161,7 +162,7 @@ impl FreezeRecoveryTask {
        let probe_succeeded = match self
            .deps
            .accounts
-            .test_connection(account.clone(), model)
+            .test_connection(AccountProbeTarget::FreezeRecovery(account.clone()), model)
            .await
        {
            Ok(events) => drain_probe(events).await,
@@ -42,8 +42,8 @@ pub use use_case::{

 pub use bootstrap::{
    initialize, initialize_accounts, initialize_plugin_accounts, initialize_plugin_client_keys,
-    initialize_plugin_resources, initialize_settings, initialize_usage_data,
-    initialize_with_plugin_accounts,
+    initialize_plugin_proxies, initialize_plugin_resources, initialize_settings,
+    initialize_usage_data, initialize_with_plugin_accounts,
 };

 use ports::{
@@ -288,8 +288,8 @@ impl AdminServices {
    }

    #[must_use]
-    pub fn usage_data(&self) -> &dyn UsageDataService {
-        self.usage_data.as_ref()
+    pub fn usage_data(&self) -> Arc<dyn UsageDataService> {
+        self.usage_data.clone()
    }

    #[must_use]
@@ -73,6 +73,7 @@ pub struct AccountGroupUsage {
 /// 当前页账号组 membership 对应的持久账号事实；运行态在 Admin query service 合并
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct AccountGroupMemberFact {
+    pub inherited_version: Option<gateway_core::account::QuotaObservationVersion>,
    pub group_id: AccountGroupId,
    pub account_id: String,
    pub status: AccountStatusFacts,
@@ -21,6 +21,8 @@ pub use gateway_core::account::{
 /// 账号可用的管理操作
 #[derive(Debug, Default, Clone, Copy, PartialEq, Eq)]
 pub struct ProviderAccountCapabilities {
+    pub quota_limits_supported: bool,
+    pub quota_credits: bool,
    pub quota: bool,
    pub quota_refresh: bool,
    pub profile: bool,
@@ -110,6 +112,9 @@ pub enum AccountGroupFilter {
 /// 账号公共存储投影；Provider 专属字段不进入此结构
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct AccountRecord {
+    pub quota_paused: bool,
+    pub quota_limits: gateway_core::account::AccountQuotaLimits,
+    pub auto_use_quota_credits: bool,
    pub id: String,
    pub provider_kind: ProviderKind,
    pub groups: Vec<AccountGroupRef>,
@@ -219,7 +224,7 @@ pub struct AccountPageItem {
 pub struct AccountCapacity {
    /// 实时租约读取失败时为 `None`，不能当作空闲
    pub used_slots: Option<u64>,
-    /// 应用账号覆盖或全局默认值后的上限；`None` 表示不限
+    /// 应用账号覆盖或继承默认值后的普通并发上限；`None` 表示不限
    pub total_slots: Option<u64>,
 }

@@ -249,6 +254,8 @@ pub struct AccountUpdateResult {
 /// 仅修改显式字段的批量账号设置命令
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct BatchUpdateAccounts {
+    pub quota_limits: Option<gateway_core::account::AccountQuotaLimits>,
+    pub auto_use_quota_credits: Option<bool>,
    pub account_ids: Vec<String>,
    pub enabled: Option<bool>,
    pub concurrency_limit: Option<Option<AccountConcurrencyLimit>>,
@@ -258,6 +265,16 @@ pub struct BatchUpdateAccounts {
    pub outbound_proxy: Option<super::proxies::AccountProxySelection>,
 }

+/// 已按拟提交策略重算的账号暂停结果，以快照版本防止旧判断覆盖新观测
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct PreparedQuotaPause {
+    pub observed_at: Option<DateTime<Utc>>,
+    pub revision: Revision,
+    pub paused: bool,
+}
+
+pub type PreparedQuotaPauses = std::collections::BTreeMap<String, PreparedQuotaPause>;
+
 /// 批量账号更新结果
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct AccountsUpdateResult {
@@ -290,6 +307,7 @@ pub enum AccountConnectionTestEvent {
    Failed {
        source: AccountProbeErrorSource,
        gateway_error_code: GatewayErrorKind,
+        proxy_hint: Option<gateway_core::error::ProxyConnectionHint>,
        send_state: Option<UpstreamSendState>,
        message: String,
        provider_error_code: Option<String>,
@@ -16,6 +16,7 @@ pub enum MutationAuditOperation {
    AccountGroupEnabled { enabled: bool },
    AccountGroupDelete,
    ClientApiKeyResetBudget,
+    ClientApiKeySetBudgetWindow,
    ProviderAccountUpdate,
    BackupStorageUpdate,
    BackupScheduleUpdate,
@@ -76,6 +77,7 @@ impl MutationAuditOperation {
            }
            Self::AccountGroupDelete => ("delete", "account_group"),
            Self::ClientApiKeyResetBudget => ("reset_budget", "client_api_key"),
+            Self::ClientApiKeySetBudgetWindow => ("set_budget_window", "client_api_key"),
            Self::ProviderAccountUpdate => ("update", "provider_account"),
            Self::BackupStorageUpdate => ("backup.s3_config_updated", "backup_settings"),
            Self::BackupScheduleUpdate => ("backup.schedule_updated", "backup_settings"),
@@ -233,13 +233,56 @@ pub enum ClientKeyBudgetPeriod {
    All,
 }

-/// 清零所选窗口已用金额，保留限额、到期时间与历史费用
+/// 清零所选窗口并恢复日历规则，保留限额与历史费用
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct ResetClientKeyBudget {
    pub id: ClientApiKeyId,
    pub period: ClientKeyBudgetPeriod,
 }

+/// 显式窗口复用已有日／周金额上限，外部周期的选择归调用方
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum ClientKeyBudgetWindowPeriod {
+    Daily,
+    Weekly,
+}
+
+impl ClientKeyBudgetWindowPeriod {
+    #[must_use]
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::Daily => "daily",
+            Self::Weekly => "weekly",
+        }
+    }
+}
+
+/// 按请求完成时间归属的左闭右开预算窗口
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct ExplicitClientKeyBudgetWindow {
+    pub starts_at: DateTime<Utc>,
+    pub ends_at: DateTime<Utc>,
+}
+
+/// 窗口配置版本独立于费用累计与全局配置版本
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ClientKeyBudgetWindow {
+    pub revision: u64,
+    pub explicit: bool,
+    pub starts_at: Option<DateTime<Utc>>,
+    pub ends_at: Option<DateTime<Utc>>,
+    pub used_usd: gateway_core::metering::Decimal,
+}
+
+/// 当前窗口版本标识一次操作，同版本同参数可重试；None 释放显式控制
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct SetClientKeyBudgetWindow {
+    pub id: ClientApiKeyId,
+    pub period: ClientKeyBudgetWindowPeriod,
+    pub expected_revision: u64,
+    pub window: Option<ExplicitClientKeyBudgetWindow>,
+}
+
 /// 仅更新指定金额上限；省略的周期保持不变，不修改已用金额或窗口
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct UpdateClientKeyBudgetLimits {
@@ -472,6 +472,90 @@ impl CostCoverage {
    }
 }

+/// 请求健康计数与服务成功率，调用方错误和取消不计入有效样本
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
+pub struct RequestHealth {
+    pub success_requests: u64,
+    pub failed_requests: u64,
+    pub cancelled_requests: u64,
+    pub incomplete_requests: u64,
+    pub caller_error_requests: u64,
+}
+
+impl RequestHealth {
+    #[must_use]
+    pub fn from_counts(
+        success: u64,
+        failed: u64,
+        cancelled: u64,
+        incomplete: u64,
+        caller_error: u64,
+    ) -> Self {
+        Self {
+            success_requests: success,
+            failed_requests: failed.saturating_sub(caller_error),
+            cancelled_requests: cancelled,
+            incomplete_requests: incomplete,
+            caller_error_requests: caller_error,
+        }
+    }
+
+    pub(crate) fn from_metrics(metrics: &RequestMetrics) -> Self {
+        Self::from_counts(
+            metrics.success_count,
+            metrics.failure_count,
+            metrics.cancelled_count,
+            metrics.incomplete_count,
+            metrics.caller_error_count,
+        )
+    }
+
+    /// 账号与健康时间线使用百分数，洞察接口使用 0 到 1 的比例
+    #[must_use]
+    pub fn success_rate(self) -> Option<f64> {
+        self.success_ratio().map(|ratio| ratio * 100.0)
+    }
+
+    pub(crate) fn success_ratio(self) -> Option<f64> {
+        let total = self.eligible_requests();
+        (total > 0).then(|| self.success_requests as f64 / total as f64)
+    }
+
+    pub(crate) fn error_ratio(self) -> Option<f64> {
+        let total = self.eligible_requests();
+        (total > 0).then(|| self.non_success_requests() as f64 / total as f64)
+    }
+
+    // 未完成保留交付终态，但上游失败、超时和进程中断都不能视为服务成功
+    pub(crate) fn non_success_requests(self) -> u64 {
+        self.failed_requests
+            .saturating_add(self.incomplete_requests)
+    }
+
+    pub(crate) fn eligible_requests(self) -> u64 {
+        self.success_requests
+            .saturating_add(self.non_success_requests())
+    }
+
+    pub(crate) fn add_metrics(&mut self, metrics: &RequestMetrics) {
+        self.add_window(Self::from_metrics(metrics));
+    }
+
+    pub(crate) fn add_window(&mut self, other: Self) {
+        self.success_requests = self.success_requests.saturating_add(other.success_requests);
+        self.failed_requests = self.failed_requests.saturating_add(other.failed_requests);
+        self.cancelled_requests = self
+            .cancelled_requests
+            .saturating_add(other.cancelled_requests);
+        self.incomplete_requests = self
+            .incomplete_requests
+            .saturating_add(other.incomplete_requests);
+        self.caller_error_requests = self
+            .caller_error_requests
+            .saturating_add(other.caller_error_requests);
+    }
+}
+
 /// 请求级聚合指标
 #[derive(Debug, Clone, Default, PartialEq, Eq)]
 pub struct RequestMetrics {
@@ -606,11 +690,12 @@ pub struct RequestMetricPoint {
    pub costs: Vec<CurrencyCost>,
 }

-/// 账号池的统一五态统计
+/// 账号池的状态统计
 #[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
 pub struct AccountPoolMetrics {
    pub total: u64,
    pub normal: u64,
+    pub quota_paused: u64,
    pub quota_exhausted: u64,
    pub rate_limited: u64,
    pub disabled: u64,
@@ -622,7 +707,7 @@ pub struct AccountPoolMetrics {
 pub struct AccountModelUsage {
    pub model: String,
    pub request_count: u64,
-    pub success_count: u64,
+    pub health: RequestHealth,
    pub input_tokens: Option<u64>,
    pub output_tokens: Option<u64>,
    pub cached_input_tokens: Option<u64>,
@@ -635,7 +720,7 @@ pub struct AccountModelUsage {
    pub total_tokens: Option<u64>,
    pub cost_coverage: CostCoverage,
    pub costs: Vec<CurrencyCost>,
-    pub last_used_at: DateTime<Utc>,
+    pub last_used_at: Option<DateTime<Utc>>,
 }

 /// 账号在单小时窗口内的请求数
@@ -684,8 +769,10 @@ pub struct DashboardAccountUsage {
 }

 /// Dashboard 当前账号池的可重建运行时槽位事实
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[derive(Debug, Clone, PartialEq, Eq)]
 pub struct DashboardRuntimeSlots {
+    /// 仅未设置本地覆盖的账号可能继承有效互联观测
+    pub inherited_versions: Vec<gateway_core::account::QuotaObservationVersion>,
    /// 继承运行参数默认并发上限的可调度账号数
    pub inherited_accounts: u64,
    /// 已配置账号级并发上限的可调度账号槽位总数
@@ -718,13 +805,42 @@ pub struct DashboardObservation {
    pub recent_requests: Vec<UsageListRecord>,
 }

+/// 根据已记录事实推导的错误位置，不表示责任归属
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum UsageErrorOrigin {
+    Proxy,
+    Upstream,
+    Connection,
+    Unknown,
+}
+
+impl UsageErrorOrigin {
+    #[must_use]
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::Proxy => "proxy",
+            Self::Upstream => "upstream",
+            Self::Connection => "connection",
+            Self::Unknown => "unknown",
+        }
+    }
+}
+
 /// 使用记录表格的窄读模型
 #[derive(Debug, Clone, PartialEq)]
 pub struct UsageListRecord {
    pub outcome: RequestOutcome,
+    /// 已保存的上游错误对象含非空字符串 code、type 或 message
+    pub has_upstream_error: bool,
    pub error_code: Option<String>,
    pub error_message: Option<String>,
+    pub error_kind: Option<String>,
+    pub websocket_close_code: Option<u16>,
+    pub continuation_unavailable_reason: Option<String>,
+    pub upstream_connection_exit_reason: Option<String>,
+    pub recovered: bool,
    pub client_status_code: Option<u16>,
+    pub upstream_status_code: Option<u16>,
    pub client_api_key_name: Option<String>,
    pub id: String,
    pub endpoint: String,
@@ -739,6 +855,8 @@ pub struct UsageListRecord {
    /// 请求选号时冻结的账号套餐
    pub provider_account_plan_type: Option<String>,
    pub provider_account_plan_type_display: Option<String>,
+    /// 查询时的互联识别结果，缺少当前摘要时为未知
+    pub provider_account_upstream_peer: Option<bool>,
    pub provider_account_authentication_kind: Option<String>,
    pub upstream_model_id: Option<String>,
    pub upstream_transport: Option<String>,
@@ -780,6 +898,23 @@ pub struct UsageListRecord {
    pub started_at: DateTime<Utc>,
 }

+/// 受控请求详情中的上游错误字段，不参与错误分类或普通日志输出
+#[derive(Clone, PartialEq)]
+pub struct UsageUpstreamError {
+    pub code: Option<String>,
+    pub error_type: Option<String>,
+    pub message: Option<String>,
+    pub param: Option<String>,
+    pub close_reason: Option<String>,
+    pub last_event_type: Option<String>,
+}
+
+impl std::fmt::Debug for UsageUpstreamError {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter.write_str("UsageUpstreamError(<restricted>)")
+    }
+}
+
 /// 一次完整模型请求的公共观测记录
 #[derive(Debug, Clone, PartialEq)]
 pub struct UsageRecord {
@@ -818,6 +953,11 @@ pub struct UsageRecord {
    pub error_kind: Option<String>,
    pub provider_error_code: Option<String>,
    pub error_message: Option<String>,
+    pub upstream_error: Option<UsageUpstreamError>,
+    pub websocket_close_code: Option<u16>,
+    pub continuation_unavailable_reason: Option<String>,
+    pub upstream_connection_exit_reason: Option<String>,
+    pub recovered: bool,
    pub retry_after_ms: Option<u64>,
    pub input_tokens: Option<u64>,
    pub output_tokens: Option<u64>,
@@ -887,7 +1027,8 @@ pub struct UsageAttempt {
    pub upstream_transport: Option<String>,
    pub upstream_send_state: Option<String>,
    pub outcome: RequestOutcome,
-    pub downstream_committed: bool,
+    /// 未记录尝试交付边界时保持未知，不以 false 代替
+    pub downstream_committed: Option<bool>,
    pub status_code: Option<u16>,
    pub provider_error_code: Option<String>,
    pub failure_kind: Option<String>,
@@ -976,7 +1117,9 @@ pub struct DiagnosticObservation {
    pub average_latency_ms: Option<u64>,
    pub latency_p95_ms: Option<u64>,
    pub first_token_p95_ms: Option<u64>,
-    pub non_completion_count: u64,
+    pub cancelled_count: u64,
+    pub incomplete_count: u64,
+    pub caller_error_count: u64,
    pub retry_count: u64,
    pub retried_request_count: u64,
    pub cost_coverage: CostCoverage,
@@ -1064,7 +1207,7 @@ pub struct TrendPoint {
    pub bucket_start: DateTime<Utc>,
    pub granularity: Granularity,
    pub metrics: RequestMetrics,
-    pub service_failure_count: u64,
+    pub error_count: u64,
    pub average_latency_ms: Option<u64>,
    pub average_first_token_latency_ms: Option<u64>,
    pub cached_token_rate: f64,
@@ -1082,7 +1225,7 @@ pub struct TrendSummary {
    pub output_tokens: u64,
    pub cached_input_tokens: u64,
    pub total_tokens: u64,
-    pub service_failure_count: u64,
+    pub error_count: u64,
    pub average_latency_ms: Option<u64>,
    pub max_latency_ms: Option<u64>,
    pub min_latency_ms: Option<u64>,
@@ -1246,7 +1389,7 @@ pub struct UsageInsightsHealthPoint {
    pub cancelled_requests: u64,
    pub incomplete_requests: u64,
    pub caller_error_requests: u64,
-    pub error_rate: f64,
+    pub error_rate: Option<f64>,
 }

 /// 洞察健康汇总；失败数已排除调用方错误
@@ -1258,7 +1401,7 @@ pub struct UsageInsightsHealth {
    pub cancelled_requests: u64,
    pub incomplete_requests: u64,
    pub caller_error_requests: u64,
-    pub success_rate: f64,
+    pub success_rate: Option<f64>,
    pub completion_rate: f64,
    pub points: Vec<UsageInsightsHealthPoint>,
 }
@@ -1439,11 +1582,13 @@ pub struct DiagnosticsItem {
    pub name: String,
    pub account_authentication_kind: Option<String>,
    pub account_plan_type: Option<String>,
+    /// 仅账号维度补充当前互联识别结果
+    pub account_upstream_peer: Option<bool>,
    pub account_plan_type_display: Option<String>,
    pub request_count: u64,
    pub success_count: u64,
    pub error_count: u64,
-    pub error_rate: f64,
+    pub error_rate: Option<f64>,
    pub request_share: f64,
    pub average_latency_ms: Option<u64>,
    pub latency_p95_ms: Option<u64>,
@@ -17,6 +17,7 @@ pub struct PeerLinkLimits {
 pub struct PeerLinkExport {
    pub observed_at: DateTime<Utc>,
    pub expires_at: DateTime<Utc>,
+    pub key_limits: gateway_core::policy::RateLimits,
    pub budget: ClientBudgetStatus,
    pub budget_access: ClientBudgetAccess,
    pub budget_observed_at: DateTime<Utc>,
@@ -165,8 +165,9 @@ pub struct ConfigurePluginInstance {
    pub artifact_sha256: String,
    pub enabled: bool,
    pub configuration: serde_json::Value,
-    /// 缺省保留旧值；显式空对象清除全部 secret
-    pub secrets: Option<BTreeMap<String, SecretString>>,
+    /// 按字段更新，省略的字段保留，null 清除对应字段
+    #[serde(default)]
+    pub secrets: BTreeMap<String, Option<SecretString>>,
    pub bindings: Vec<PluginCapabilityBinding>,
 }

@@ -304,6 +304,12 @@ impl PendingAuthorizationMutation {
                "outbound_proxy_url".to_owned(),
                Value::String(proxy.expose_url().to_owned()),
            );
+            if proxy.max_websocket_connections() != 0 {
+                document.insert(
+                    "outbound_proxy_max_websocket_connections".to_owned(),
+                    Value::from(proxy.max_websocket_connections()),
+                );
+            }
        }
        if let Some(id) = &self.outbound_proxy_id {
            document.insert("outbound_proxy_id".to_owned(), Value::String(id.clone()));
@@ -344,6 +350,11 @@ impl PendingAuthorizationMutation {
            .map(gateway_core::account::OutboundProxy::parse)
            .transpose()
            .map_err(|_| invalid())?;
+        let proxy = match (proxy, document.outbound_proxy_max_websocket_connections) {
+            (Some(proxy), Some(limit)) => Some(proxy.with_max_websocket_connections(limit)),
+            (None, Some(_)) => return Err(invalid()),
+            (proxy, None) => proxy,
+        };
        Ok(Self::new(
            provider_kind,
            target,
@@ -367,6 +378,8 @@ struct StoredAuthorizationMutationV1 {
    #[serde(default)]
    outbound_proxy_url: Option<String>,
    #[serde(default)]
+    outbound_proxy_max_websocket_connections: Option<u32>,
+    #[serde(default)]
    outbound_proxy_id: Option<String>,
 }

@@ -806,11 +819,12 @@ pub struct ProviderQuotaWindow {
    pub provider_data: Option<ProviderDocument>,
 }

-/// 账号用量统计周期，按周优先、月次之选择；短期限流窗口不参与统计面板
+/// 账号用量统计周期，完整周/月额度优先，随后使用 Provider 提供的本地滚动日统计
 #[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]
 pub enum AccountUsagePeriod {
    Weekly,
    Monthly,
+    Daily,
 }

 /// Provider 解释 quota 所需的公共请求事实
@@ -831,6 +845,7 @@ pub struct ProviderQuotaReadRequest<'a> {
 /// Provider 已解析的 quota 结果及其不透明差异字段
 #[derive(Debug, Default, Clone, PartialEq)]
 pub struct ProviderQuota {
+    pub paused_windows: Vec<String>,
    pub upstream: Option<super::upstream_info::ProviderUpstreamInfo>,
    /// 上游额度响应明确提供的套餐，可用于补全账号展示
    pub plan_type: Option<String>,
@@ -838,7 +853,7 @@ pub struct ProviderQuota {
    pub refresh_token_expires_at: Option<DateTime<Utc>>,
    pub windows: Vec<ProviderQuotaWindow>,
    pub credits: Option<ProviderQuotaCredits>,
-    /// 展示用快照级触顶事实（顶层或任一窗口触顶）；不参与账号五态派生
+    /// 展示用快照级触顶事实（顶层或任一窗口触顶）；不参与账号状态派生
    pub limit_reached: bool,
    pub provider_data: Option<ProviderDocument>,
 }
@@ -998,16 +1013,27 @@ impl ProviderQuota {
        }
    }

-    /// 选择账号用量统计的周/月窗口，同时返回展示所需的周期事实
+    /// 选择账号用量统计窗口，同时返回展示所需的周期事实
    ///
-    /// 只使用边界完整、可归属到整个账号的窗口；周优先于月，同周期保持
-    /// Provider 投影顺序
-    /// 没有符合条件的窗口时不回退到短期或历史累计
+    /// 周/月额度使用边界完整、可归属到整个账号的窗口
+    /// 周优先于月，同周期保持 Provider 投影顺序
+    /// Provider 提供的无固定重置点的滚动日统计可独立展示
    #[must_use]
    pub fn usage_window(&self) -> Option<(&ProviderQuotaWindow, AccountUsagePeriod)> {
        self.usage_windows()
            .filter(|(window, _)| window.local_usage.is_some())
            .min_by_key(|(_, period)| *period)
+            .or_else(|| {
+                self.windows
+                    .iter()
+                    .find(|window| {
+                        window.local_usage_attribution == QuotaLocalUsageAttribution::AccountWide
+                            && window.window_seconds == Some(86_400)
+                            && window.reset_at.is_none()
+                            && window.local_usage.is_some()
+                    })
+                    .map(|window| (window, AccountUsagePeriod::Daily))
+            })
    }

    /// 互联账号按最长的 Key 消费周期统计本地用量，池内账号窗口不代表此 Key 的周期
@@ -1025,7 +1051,7 @@ impl ProviderQuota {
            .max_by_key(|window| window.window_seconds)
    }

-    /// 统计与预测共用窗口归属规则，避免把模型专属桶或短期限流当作账号容量
+    /// 周/月额度的归属规则，供额度周期统计与容量预测共用
    pub(crate) fn usage_windows(
        &self,
    ) -> impl Iterator<Item = (&ProviderQuotaWindow, AccountUsagePeriod)> {
@@ -62,14 +62,15 @@ pub fn account_quota_forecasts(
    now: DateTime<Utc>,
    samples: &[QuotaForecastSample],
 ) -> [AccountQuotaForecast; 2] {
-    [AccountUsagePeriod::Weekly, AccountUsagePeriod::Monthly].map(|period| {
+    [
+        (AccountUsagePeriod::Weekly, 7 * DAY_SECONDS),
+        (AccountUsagePeriod::Monthly, 30 * DAY_SECONDS),
+    ]
+    .map(|(period, target_seconds)| {
        let selected = quota_forecast_source_window(quota, period);
        let mut forecast = AccountQuotaForecast {
            period,
-            target_seconds: match period {
-                AccountUsagePeriod::Weekly => 7 * DAY_SECONDS,
-                AccountUsagePeriod::Monthly => 30 * DAY_SECONDS,
-            },
+            target_seconds,
            extrapolated: false,
            source: None,
            unavailable_reason: Some("缺少周/月额度窗口，请刷新账号额度"),
@@ -19,6 +19,9 @@ pub struct PendingResetCredit {
 pub struct ResetCreditAutomationState {
    pub next_discovery_at: DateTime<Utc>,
    pub credits: Vec<PlannedResetCredit>,
+    pub next_weekly_check_at: Option<DateTime<Utc>>,
+    /// 同一次低额度只消费一次，等待消费后的恢复观测再允许提前用卡
+    pub awaiting_weekly_recovery_since: Option<DateTime<Utc>>,
    pub pending: Option<PendingResetCredit>,
    pub retry_at: Option<DateTime<Utc>>,
    pub failures: u32,
@@ -39,6 +42,7 @@ pub struct ResetCreditAutomation {
 pub struct ResetCreditAutomationStatus {
    pub enabled: bool,
    pub lead_minutes: u32,
+    pub weekly_trigger_remaining_percent: Option<u32>,
    pub next_discovery_at: Option<DateTime<Utc>>,
    pub next_consume_at: Option<DateTime<Utc>>,
    pub last_result: Option<String>,
@@ -53,7 +53,9 @@ pub struct RuntimeSettingsValues {
    pub max_concurrent_per_account: u32,
    pub max_waiting_per_key: u32,
    pub max_waiting_per_account: u32,
-    pub concurrency_wait_timeout_seconds: u32,
+    pub key_queue_timeout_seconds: u32,
+    pub account_queue_timeout_seconds: u32,
+    pub switch_account_on_queue_failure: bool,
    pub max_retry_after_seconds: u32,
    pub openai_guardian_reserved_concurrency: u32,
    pub openai_account_affinity: gateway_core::account::AccountAffinity,
@@ -68,8 +70,10 @@ pub struct RuntimeSettingsValues {
    pub audit_retention_days: u32,
    pub account_error_protection: gateway_core::account::AccountErrorProtection,
    pub account_warmup_enabled: bool,
-    pub account_warmup_schedule_time: String,
+    pub account_warmup_cron: String,
    pub account_warmup_model: Option<String>,
+    #[serde(default)]
+    pub reset_credit_on_low_weekly_quota: bool,
    pub reset_credit_lead_minutes: u32,
    pub reset_credit_max_weekly_remaining_percent: Option<u32>,
 }
@@ -201,7 +205,8 @@ impl RuntimeSettingsValues {
        gateway_core::settings::validate_request_limits(
            self.max_waiting_per_key,
            self.max_waiting_per_account,
-            self.concurrency_wait_timeout_seconds,
+            self.key_queue_timeout_seconds,
+            self.account_queue_timeout_seconds,
            self.max_account_rotations,
            self.openai_session_affinity_ttl_hours,
        )?;
@@ -230,7 +235,7 @@ impl RuntimeSettingsValues {
        self.account_error_protection.validate()?;
        gateway_core::provider_ports::ProviderWarmupPolicy::validate_values(
            self.account_warmup_enabled,
-            &self.account_warmup_schedule_time,
+            &self.account_warmup_cron,
            self.account_warmup_model.as_deref(),
        )?;
        Ok(())
@@ -3,6 +3,14 @@
 use chrono::{DateTime, Utc};
 use serde::{Deserialize, Serialize};

+/// 摘要只读取发布索引，完整详情可按请求刷新
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum SystemUpdateCheck {
+    Summary,
+    Detail,
+    Refresh,
+}
+
 /// 本次检查或安装选择的更新稳定性范围，具体版本准入由 Host 判定
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Serialize)]
 #[serde(rename_all = "lowercase")]
@@ -69,6 +77,7 @@ pub struct SystemUpdateDetail {
    pub update_supported: bool,
    pub unsupported_reason: Option<String>,
    pub warning: Option<String>,
+    pub retry_at: Option<DateTime<Utc>>,
 }

 /// 系统操作类型
@@ -4,11 +4,14 @@ use chrono::{DateTime, Utc};

 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct ProviderUpstreamInfo {
+    /// 当前连接的互联识别结果，明确关闭共享或不支持协议时清除
    pub discovered: bool,
    pub observed_at: Option<DateTime<Utc>>,
    pub stale: bool,
    pub connection_revision: String,
    pub last_error: Option<String>,
+    pub max_concurrency: Option<u64>,
+    pub requests_per_minute: Option<u64>,
    pub pool: Option<UpstreamPool>,
 }

@@ -10,6 +10,8 @@ pub enum UsageErrorKind {
    Conflict,
    CapacityExceeded,
    Unavailable,
+    Cancelled,
+    Timeout,
 }

 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
@@ -20,3 +20,6 @@ pub use actor::*;

 mod aggregate;
 pub use aggregate::*;
+
+mod read;
+pub use read::*;
@@ -0,0 +1,162 @@
+//! 历史用量的窄事实、分组统计与调用内分批读取合同
+
+use super::{UsageCount, UsageMetric, UsageRecordData, UsageRecordFilter};
+use serde::{Deserialize, Serialize};
+use std::collections::BTreeMap;
+
+pub const USAGE_READ_MAX_BATCH_ROWS: u16 = 1024;
+pub const USAGE_READ_MAX_BATCH_BYTES: usize = 2 * 1024 * 1024;
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct UsageReadFilter {
+    pub records: UsageRecordFilter,
+    pub routing_group_ref: Option<String>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct ScanUsageRecords {
+    pub filter: UsageReadFilter,
+    pub batch_size: Option<u16>,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum UsageGrouping {
+    Model,
+    Key,
+    KeyModel,
+    RoutingGroup,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct QueryUsageStatistics {
+    pub filter: UsageReadFilter,
+    pub group_by: UsageGrouping,
+    pub batch_size: Option<u16>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(tag = "kind", rename_all = "snake_case")]
+pub enum UsageReadQuery {
+    Records(ScanUsageRecords),
+    Statistics(QueryUsageStatistics),
+}
+
+impl UsageReadQuery {
+    pub fn filter(&self) -> &UsageReadFilter {
+        match self {
+            Self::Records(query) => &query.filter,
+            Self::Statistics(query) => &query.filter,
+        }
+    }
+
+    pub fn batch_size(&self) -> u16 {
+        match self {
+            Self::Records(query) => query.batch_size,
+            Self::Statistics(query) => query.batch_size,
+        }
+        .unwrap_or(USAGE_READ_MAX_BATCH_ROWS)
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct UsageRecordFact {
+    pub id: String,
+    pub data: UsageRecordData,
+    pub user_agent: Option<String>,
+    pub reasoning_effort: Option<String>,
+    pub subagent_kind: Option<String>,
+    pub request_kind: Option<String>,
+    pub routing_scope: Option<String>,
+    pub routing_group_refs: Vec<String>,
+    pub recovered: bool,
+    /// 由宿主现行规则派生，原始审计中的恢复请求仍可读取
+    pub request_counted: bool,
+    /// 包含完整交付、预热排除及恢复关联规则
+    pub usage_counted: bool,
+}
+
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub struct UsageStatisticsGroup {
+    pub client_key_ref: Option<String>,
+    pub model: Option<String>,
+    pub routing_group_ref: Option<String>,
+    pub unassigned_contribution: bool,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct UsageStatisticsCost {
+    pub currency: String,
+    pub amount: String,
+    pub native_amount: Option<String>,
+    /// 外部修正允许负值，原生费用来源覆盖单独返回
+    pub contribution_amount: Option<String>,
+}
+
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub struct UsageStatisticsCostCoverage {
+    pub provider_reported: UsageCount,
+    pub calculated: UsageCount,
+    pub unavailable: UsageCount,
+}
+
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub struct UsageStatisticsMetrics {
+    /// 缺失的 Token 指标表示未知，计数指标始终返回
+    pub values: BTreeMap<UsageMetric, UsageCount>,
+    pub native_request_count: UsageCount,
+    pub contribution_count: UsageCount,
+    pub native_token_samples: BTreeMap<UsageMetric, UsageCount>,
+    /// 数量表示提供该指标的贡献记录数，不能用作请求覆盖率的分母
+    pub contribution_token_samples: BTreeMap<UsageMetric, UsageCount>,
+    pub cost_coverage: UsageStatisticsCostCoverage,
+    pub costs: Vec<UsageStatisticsCost>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct UsageStatisticsRow {
+    /// null 表示全局总计，分组重叠不会重复计入该行
+    pub group: Option<UsageStatisticsGroup>,
+    pub metrics: UsageStatisticsMetrics,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(tag = "kind", content = "value", rename_all = "snake_case")]
+pub enum UsageReadItem {
+    Record(Box<UsageRecordFact>),
+    Statistics(Box<UsageStatisticsRow>),
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct UsageReadAnalytics {
+    pub coverage_start_ms: Option<i64>,
+    pub coverage_end_ms: Option<i64>,
+    pub lag_seconds: u64,
+    pub state: String,
+    pub generation: u64,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct UsageReadObservation {
+    pub generated_at_ms: i64,
+    pub analytics: Option<UsageReadAnalytics>,
+    pub total_groups: Option<UsageCount>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct UsageReadBatch {
+    pub observation: UsageReadObservation,
+    pub items: Vec<UsageReadItem>,
+    pub complete: bool,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct UsageReadOpened {
+    pub reader: Option<String>,
+    pub batch: UsageReadBatch,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct UsageReadHandle {
+    pub reader: String,
+}
@@ -38,6 +38,13 @@ pub trait PeerTransport: Send + Sync {
 /// 账号用例读取公共互联观测，显式刷新等待额度查询完成
 #[async_trait]
 pub trait PeerUpstreamService: gateway_core::account::UpstreamInfoSource {
+    /// 仅在指定持久观测与当前调度缓存一致时估算容量
+    fn observed_concurrency_limit(
+        &self,
+        version: &gateway_core::account::QuotaObservationVersion,
+        now: std::time::SystemTime,
+    ) -> Option<gateway_core::account::AccountConcurrencyLimit>;
+
    async fn account_changed(
        &self,
        id: &gateway_core::account::ProviderAccountId,
@@ -5,13 +5,28 @@ use gateway_core::{engine::budget::ClientBudgetStatus, policy::ClientApiKeyId};

 use crate::model::{
    AdminError, MutationContext,
-    client_keys::{ResetClientKeyBudget, UpdateClientKeyBudgetLimits},
+    client_keys::{
+        ClientKeyBudgetWindow, ClientKeyBudgetWindowPeriod, ResetClientKeyBudget,
+        SetClientKeyBudgetWindow, UpdateClientKeyBudgetLimits,
+    },
    plugin_client_keys::{PluginClientKeyFacts, PluginClientKeyListQuery, PluginClientKeyPage},
    plugin_resources::PluginResourceOwner,
 };

 #[async_trait]
 pub trait PluginClientKeyAccess: Send + Sync {
+    async fn budget_window(
+        &self,
+        id: &ClientApiKeyId,
+        period: ClientKeyBudgetWindowPeriod,
+    ) -> Result<ClientKeyBudgetWindow, AdminError>;
+    async fn set_budget_window(
+        &self,
+        owner: &PluginResourceOwner,
+        command: SetClientKeyBudgetWindow,
+        context: &MutationContext,
+    ) -> Result<u64, AdminError>;
+
    async fn facts(&self, id: &ClientApiKeyId) -> Result<PluginClientKeyFacts, AdminError>;

    async fn budget(&self, id: &ClientApiKeyId) -> Result<ClientBudgetStatus, AdminError>;
@@ -222,6 +222,15 @@ pub trait ProviderAdmin: Send + Sync {
        Err(ProviderAdminError::new(ProviderAdminErrorKind::Unsupported))
    }

+    /// Key 可以继承当前全局画像；额外字段的合法性由对应 Provider 判定
+    fn preview_key_client_profile(
+        &self,
+        key: &gateway_core::account::OpaqueProviderData,
+        _global: Option<&gateway_core::account::OpaqueProviderData>,
+    ) -> Result<gateway_core::account::OpaqueProviderData, ProviderAdminError> {
+        self.preview_client_profile(key)
+    }
+
    /// 提供最终套餐展示名称；未覆盖时采用通用的大驼峰格式
    fn plan_type_display(&self, plan_type: &str) -> String {
        default_plan_type_display(plan_type)
@@ -5,13 +5,20 @@ use gateway_core::account::{OutboundProxy, ProviderAccountId};

 use super::store::AdminStoreResult;
 use crate::model::{
-    MutationContext, Revision,
+    AdminError, MutationContext, Revision,
    proxies::{
        ImportProxyBinding, NewProxy, ProxyAccountListQuery, ProxyAccountPage, ProxyListQuery,
        ProxyMutation, ProxyPage, ProxyRecord, ProxyTestResult, UpdateProxy,
    },
 };

+/// 插件受管网络读取代理的窄端口，连接配置仅供宿主发送请求
+#[async_trait]
+pub trait PluginProxyAccess: Send + Sync {
+    async fn list(&self, query: ProxyListQuery) -> Result<ProxyPage, AdminError>;
+    async fn resolve(&self, id: &str) -> Result<OutboundProxy, AdminError>;
+}
+
 #[async_trait]
 pub trait ProxyStore: Send + Sync {
    /// 在凭据交换到提交期间保护选定代理的连接配置和测试结果
@@ -22,8 +22,9 @@ use crate::model::{
    },
    auth::{AdminAuditEvent, AuthSession},
    client_keys::{
-        ClientKeyBudgetMutationOrigin, ClientKeyListQuery, ClientKeyPage, ClientKeyRecord,
-        ClientKeySecret, DeleteClientKey, NewClientKey, ResetClientKeyBudget, SetClientKeyEnabled,
+        ClientKeyBudgetMutationOrigin, ClientKeyBudgetWindow, ClientKeyBudgetWindowPeriod,
+        ClientKeyListQuery, ClientKeyPage, ClientKeyRecord, ClientKeySecret, DeleteClientKey,
+        NewClientKey, ResetClientKeyBudget, SetClientKeyBudgetWindow, SetClientKeyEnabled,
        UpdateClientKey, UpdateClientKeyBudgetLimits,
    },
    observability::{
@@ -254,6 +255,7 @@ pub trait AccountStore:
    async fn batch_update_accounts(
        &self,
        command: BatchUpdateAccounts,
+        pauses: crate::model::accounts::PreparedQuotaPauses,
        context: &MutationContext,
    ) -> AdminStoreResult<AccountsUpdateResult>;

@@ -365,6 +367,19 @@ pub trait AuthStore: Send + Sync {
 /// Client API Key 资料读取与管理写入
 #[async_trait]
 pub trait ClientKeyStore: Send + Sync {
+    async fn client_key_budget_window(
+        &self,
+        id: &gateway_core::policy::ClientApiKeyId,
+        period: ClientKeyBudgetWindowPeriod,
+    ) -> AdminStoreResult<ClientKeyBudgetWindow>;
+
+    async fn set_client_key_budget_window(
+        &self,
+        command: SetClientKeyBudgetWindow,
+        origin: ClientKeyBudgetMutationOrigin,
+        context: &MutationContext,
+    ) -> AdminStoreResult<u64>;
+
    /// 按已验证的 ID 读取资料，不读取完整明文 Key
    async fn get_client_key(
        &self,
@@ -3,12 +3,13 @@
 use std::{pin::Pin, sync::Arc};

 use async_trait::async_trait;
+use chrono::{DateTime, Utc};
 use futures::Stream;

 use crate::model::Revision;
 use crate::model::system::{
-    SystemOperationAccepted, SystemUpdateChannel, SystemUpdateDetail, SystemUpdateEvent,
-    SystemUpdateStatus, SystemVersion,
+    SystemOperationAccepted, SystemUpdateChannel, SystemUpdateCheck, SystemUpdateDetail,
+    SystemUpdateEvent, SystemUpdateStatus, SystemVersion,
 };

 /// Host 已校验并解包的同一更新候选；字节只含发行清单，不含运行配置或凭据
@@ -43,6 +44,7 @@ pub enum SystemOperationErrorKind {
 pub struct SystemOperationError {
    kind: SystemOperationErrorKind,
    message: String,
+    retry_at: Option<DateTime<Utc>>,
    source: Option<gateway_core::error::ErrorSource>,
    sensitive_context_redacted: bool,
 }
@@ -53,11 +55,23 @@ impl SystemOperationError {
        Self {
            kind,
            message: message.into(),
+            retry_at: None,
            source: None,
            sensitive_context_redacted: false,
        }
    }

+    #[must_use]
+    pub fn with_retry_at(mut self, retry_at: DateTime<Utc>) -> Self {
+        self.retry_at = Some(retry_at);
+        self
+    }
+
+    #[must_use]
+    pub const fn retry_at(&self) -> Option<DateTime<Utc>> {
+        self.retry_at
+    }
+
    #[must_use]
    pub fn with_source(mut self, source: impl Into<gateway_core::error::ErrorSource>) -> Self {
        self.source = Some(source.into());
@@ -135,7 +149,7 @@ pub trait SystemOperations: Send + Sync {

    async fn update_detail(
        &self,
-        refresh: bool,
+        check: SystemUpdateCheck,
        channel: Option<SystemUpdateChannel>,
    ) -> Result<SystemUpdateDetail, SystemOperationError>;

@@ -2,6 +2,14 @@

 use crate::model::{auth::AdminAuditEvent, usage_data::*};
 use async_trait::async_trait;
+use gateway_core::lifecycle::CancellationToken;
+
+#[async_trait]
+pub trait UsageReadSession: Send {
+    async fn next_batch(&mut self) -> UsageDataResult<UsageReadBatch>;
+    fn is_finished(&self) -> bool;
+    async fn close(&mut self);
+}

 pub struct StoredUsageWrite {
    pub changes: Vec<(UsageRecordChange, AdminAuditEvent)>,
@@ -13,6 +21,11 @@ pub struct StoredAggregateWrite {

 #[async_trait]
 pub trait UsageDataStore: Send + Sync {
+    async fn open_read(
+        &self,
+        query: UsageReadQuery,
+        cancellation: CancellationToken,
+    ) -> UsageDataResult<Box<dyn UsageReadSession>>;
    async fn list_aggregates(
        &self,
        request: ListUsageAggregates,
@@ -60,6 +60,7 @@ pub trait AccountGroupService: Send + Sync {
 }

 pub(crate) struct DefaultAccountGroupService {
+    upstream_info: Option<Arc<dyn crate::ports::peer::PeerUpstreamService>>,
    store: Arc<dyn AccountGroupStore>,
    runtime: Arc<dyn AccountRuntimeStore>,
    snapshot: Arc<dyn SnapshotControl>,
@@ -68,11 +69,13 @@ pub(crate) struct DefaultAccountGroupService {
 impl DefaultAccountGroupService {
    #[must_use]
    pub(crate) fn new(
+        upstream_info: Option<Arc<dyn crate::ports::peer::PeerUpstreamService>>,
        store: Arc<dyn AccountGroupStore>,
        runtime: Arc<dyn AccountRuntimeStore>,
        snapshot: Arc<dyn SnapshotControl>,
    ) -> Self {
        Self {
+            upstream_info,
            store,
            runtime,
            snapshot,
@@ -105,7 +108,7 @@ impl DefaultAccountGroupService {
                Default::default()
            }
        };
-        project_group_runtime(records, &members, &runtime);
+        project_group_runtime(records, &members, &runtime, self.upstream_info.as_deref());
        Ok(())
    }

@@ -215,6 +218,7 @@ fn project_group_runtime(
    records: &mut [AccountGroupRecord],
    members: &[AccountGroupMemberFact],
    runtime: &crate::model::accounts::AccountRuntimeSnapshot,
+    upstream: Option<&dyn crate::ports::peer::PeerUpstreamService>,
 ) {
    let now = SystemTime::now();
    let mut status_by_account = BTreeMap::new();
@@ -228,7 +232,14 @@ fn project_group_runtime(
            .or_insert_with(|| resolve_account_status(&status, now).status);
        slots_by_account
            .entry(member.account_id.as_str())
-            .or_insert(member.total_slots);
+            .or_insert_with(|| {
+                member
+                    .inherited_version
+                    .as_ref()
+                    .and_then(|version| upstream?.observed_concurrency_limit(version, now))
+                    .map(|limit| u64::from(limit.get()))
+                    .or(member.total_slots)
+            });
        accounts_by_group
            .entry(member.group_id.as_str())
            .or_default()
@@ -12,7 +12,7 @@ use chrono::{Duration, Utc};
 use futures::StreamExt as _;
 use gateway_core::{
    account::ProviderAccountId,
-    engine::probe::{AccountProbe, AccountProbeRequest},
+    engine::probe::{AccountProbe, AccountProbeRequest, AccountProbeTarget},
    routing::{ProviderKind, UpstreamModelId},
    runtime::SnapshotControl,
 };
@@ -178,7 +178,7 @@ pub trait AccountsService: Send + Sync {

    async fn test_connection(
        &self,
-        account_id: ProviderAccountId,
+        target: AccountProbeTarget,
        upstream_model: UpstreamModelId,
    ) -> Result<AccountConnectionTestEventStream, AdminError>;
 }
@@ -504,7 +504,11 @@ impl DefaultAccountsService {
            });
        Ok(AccountDirectoryItem {
            protection_rules: stored.protection_rules,
-            capacity: stored.capacity,
+            capacity: super::peer_link::upstream::account_capacity(
+                &stored.account,
+                stored.capacity,
+                &quota,
+            ),
            capabilities: provider
                .account_capabilities(account_id, &stored.account.authentication_kind),
            plan_type_display: self.providers.resolve_account_plan(
@@ -618,7 +622,11 @@ impl AccountsService for DefaultAccountsService {
                        used_slots: in_flight
                            .as_ref()
                            .map(|counts| counts.get(&item.account.id).copied().unwrap_or(0)),
-                        ..item.capacity
+                        ..super::peer_link::upstream::account_capacity(
+                            &item.account,
+                            item.capacity,
+                            &quota,
+                        )
                    },
                    capabilities,
                    plan_type_display: providers.resolve_account_plan(
@@ -751,6 +759,8 @@ impl AccountsService for DefaultAccountsService {
            self.accounts
                .batch_update_accounts(
                    BatchUpdateAccounts {
+                        quota_limits: None,
+                        auto_use_quota_credits: None,
                        account_ids: vec![account_id.to_string()],
                        enabled: Some(true),
                        concurrency_limit: None,
@@ -759,6 +769,7 @@ impl AccountsService for DefaultAccountsService {
                        group_ids: None,
                        outbound_proxy: None,
                    },
+                    Default::default(),
                    context,
                )
                .await
@@ -829,23 +840,80 @@ impl AccountsService for DefaultAccountsService {
            (
                std::sync::Arc<dyn crate::ports::provider::ProviderAdmin>,
                Vec<ProviderAccountId>,
+                Vec<ProviderAccountId>,
            ),
        >::new();
+        let mut pauses = BTreeMap::new();
        for account_id in &account_ids {
-            let (item, provider) = self.provider_for_account(account_id).await?;
-            providers
+            let (mut item, provider) = self.provider_for_account(account_id).await?;
+            if let Some(limits) = &command.quota_limits {
+                if !provider
+                    .account_capabilities(account_id, &item.account.authentication_kind)
+                    .quota_limits_supported
+                {
+                    return Err(AdminError::invalid("该账号不支持通用额度窗口上限"));
+                }
+                let new_keys = limits
+                    .keys()
+                    .filter(|key| !item.account.quota_limits.contains(key))
+                    .map(str::to_owned)
+                    .collect::<Vec<_>>();
+                if !limits.is_empty() {
+                    item.account.quota_limits = limits.clone();
+                    let quota = provider
+                        .read_quotas(&[ProviderQuotaReadRequest {
+                            account: &item.account,
+                            rolling_usage: None,
+                        }])
+                        .await
+                        .into_iter()
+                        .next()
+                        .ok_or_else(|| AdminError::invalid("缺少账号额度观测结果"))?
+                        .map_err(|error| map_provider_error(error, "provider quota"))?;
+                    if new_keys.iter().any(|key| {
+                        !quota.windows.iter().any(|window| {
+                            window.key == *key
+                                && window.local_usage_attribution
+                                    == QuotaLocalUsageAttribution::AccountWide
+                        })
+                    }) {
+                        return Err(AdminError::invalid("只能设置已观测的通用额度窗口"));
+                    }
+                    pauses.insert(
+                        item.account.id.clone(),
+                        crate::model::accounts::PreparedQuotaPause {
+                            revision: item.account.credential_revision,
+                            observed_at: quota.observed_at,
+                            paused: !quota.paused_windows.is_empty(),
+                        },
+                    );
+                }
+            }
+            if command.auto_use_quota_credits.is_some()
+                && !provider
+                    .account_capabilities(account_id, &item.account.authentication_kind)
+                    .quota_credits
+            {
+                return Err(AdminError::invalid("该账号不支持使用额度点数"));
+            }
+            let (_, selected, exhausted) = providers
                .entry(item.account.provider_kind)
-                .or_insert_with(|| (provider, Vec::new()))
-                .1
-                .push(account_id.clone());
+                .or_insert_with(|| (provider, Vec::new(), Vec::new()));
+            selected.push(account_id.clone());
+            if command.auto_use_quota_credits == Some(true)
+                && !item.account.auto_use_quota_credits
+                && item.account.quota.is_exhausted()
+            {
+                exhausted.push(account_id.clone());
+            }
        }
        let enabled = command.enabled;
        let result = self
            .accounts
-            .batch_update_accounts(command, context)
+            .batch_update_accounts(command, pauses, context)
            .await
            .map_err(|error| map_store_error(error, "provider accounts"))?;
-        for (provider, provider_ids) in providers.values() {
+        for (provider, provider_ids, _) in providers.values() {
            if enabled == Some(false) {
                for account_id in provider_ids {
                    super::notify_account_unavailable(
@@ -864,6 +932,18 @@ impl AccountsService for DefaultAccountsService {
            .await;
        }
        publish_committed(self.snapshot.as_ref(), result.config_revision).await?;
+        for (provider, _, exhausted) in providers.into_values() {
+            if exhausted.is_empty() {
+                continue;
+            }
+            super::credential_mutation::observe_account_quotas(
+                self.upstream_info.as_ref(),
+                &provider,
+                &self.accounts,
+                &exhausted,
+                context.request_id.as_str(),
+            );
+        }
        Ok(result)
    }

@@ -1123,10 +1203,10 @@ impl AccountsService for DefaultAccountsService {

    async fn test_connection(
        &self,
-        account_id: ProviderAccountId,
+        target: AccountProbeTarget,
        upstream_model: UpstreamModelId,
    ) -> Result<AccountConnectionTestEventStream, AdminError> {
-        let (stored, provider) = self.provider_for_account(&account_id).await?;
+        let (stored, provider) = self.provider_for_account(target.account_id()).await?;
        let account = stored.account;
        let model = upstream_model.as_str().to_owned();
        let operation = provider
@@ -1149,7 +1229,7 @@ impl AccountsService for DefaultAccountsService {
            let result = probe
                .probe(
                    AccountProbeRequest {
-                        account_id,
+                        target,
                        provider_kind: account.provider_kind,
                        upstream_model,
                        operation,
@@ -1180,6 +1260,7 @@ impl AccountsService for DefaultAccountsService {
                    vec![AccountConnectionTestEvent::Failed {
                        source: error.source(),
                        gateway_error_code: error.kind(),
+                        proxy_hint: error.proxy_hint(),
                        send_state: error.send_state(),
                        message,
                        provider_error_code: error.client_error_code().map(ToOwned::to_owned),
@@ -2,12 +2,66 @@

 use super::*;

-use crate::model::{MutationActor, reset_credit_automation::*};
+use crate::model::{MutationActor, reset_credit_automation::*, settings::RuntimeSettingsValues};
 use chrono::{DateTime, Utc};
 use gateway_core::time::DeploymentTimeZone;
 use rand_core::{OsRng, RngCore as _};
 use sha2::{Digest as _, Sha256};

+#[derive(Clone, Copy)]
+enum Trigger {
+    Expiry {
+        lead: u32,
+        max_remaining: Option<u32>,
+    },
+    Weekly {
+        max_remaining: u32,
+    },
+}
+
+impl Trigger {
+    fn from_settings(settings: &RuntimeSettingsValues) -> Self {
+        if settings.reset_credit_on_low_weekly_quota {
+            Self::Weekly {
+                max_remaining: settings
+                    .reset_credit_max_weekly_remaining_percent
+                    .unwrap_or(0),
+            }
+        } else {
+            Self::Expiry {
+                lead: settings.reset_credit_lead_minutes,
+                max_remaining: settings.reset_credit_max_weekly_remaining_percent,
+            }
+        }
+    }
+
+    fn weekly_trigger(self) -> Option<u32> {
+        match self {
+            Self::Expiry { .. } => None,
+            Self::Weekly { max_remaining } => Some(max_remaining),
+        }
+    }
+
+    fn quota_limit(self) -> Option<u32> {
+        match self {
+            Self::Expiry { max_remaining, .. } => max_remaining,
+            Self::Weekly { max_remaining } => Some(max_remaining),
+        }
+    }
+
+    fn eligible(self, remaining: f64, limit: u32) -> bool {
+        // 周额度模式即使配置 100% 也不消耗卡片重置满额窗口
+        match self {
+            Self::Expiry { .. } => remaining <= f64::from(limit),
+            Self::Weekly { .. } => weekly_low(remaining, limit),
+        }
+    }
+
+    fn expiry_due(self, account_id: &str, credit: &PlannedResetCredit, now: DateTime<Utc>) -> bool {
+        matches!(self, Self::Expiry { lead, .. } if consume_at(account_id, credit, lead) <= now)
+    }
+}
+
 impl DefaultAccountsService {
    pub(super) async fn reset_credits_upstream(
        &self,
@@ -74,7 +128,9 @@ impl DefaultAccountsService {
        account_id: &ProviderAccountId,
    ) -> Result<ResetCreditAutomationStatus, AdminError> {
        self.require_reset_credit_automation(account_id).await?;
-        let lead_minutes = self.automation_settings().await?.reset_credit_lead_minutes;
+        let settings = self.automation_settings().await?;
+        let lead_minutes = settings.reset_credit_lead_minutes;
+        let weekly_trigger_remaining_percent = Trigger::from_settings(&settings).weekly_trigger();
        let record = self
            .accounts
            .reset_credit_automation(account_id.as_str())
@@ -83,20 +139,23 @@ impl DefaultAccountsService {
        Ok(ResetCreditAutomationStatus {
            enabled: record.as_ref().is_some_and(|r| r.enabled),
            lead_minutes,
+            weekly_trigger_remaining_percent,
            next_discovery_at: record
                .as_ref()
                .filter(|r| r.enabled)
                .map(|r| r.state.next_discovery_at),
-            next_consume_at: record.as_ref().filter(|r| r.enabled).and_then(|r| {
-                next_consumption(r, lead_minutes)
-                    .or_else(|| {
-                        r.state
-                            .pending
-                            .as_ref()
-                            .map(|pending| consume_at(&r.account_id, &pending.credit, lead_minutes))
-                    })
-                    .map(|due| r.state.retry_at.map_or(due, |retry| due.max(retry)))
-            }),
+            next_consume_at: record
+                .as_ref()
+                .filter(|r| r.enabled && weekly_trigger_remaining_percent.is_none())
+                .and_then(|r| {
+                    next_consumption(r, lead_minutes)
+                        .or_else(|| {
+                            r.state.pending.as_ref().map(|pending| {
+                                consume_at(&r.account_id, &pending.credit, lead_minutes)
+                            })
+                        })
+                        .map(|due| r.state.retry_at.map_or(due, |retry| due.max(retry)))
+                }),
            last_result: record.and_then(|r| {
                if r.state
                    .pending
@@ -104,6 +163,15 @@ impl DefaultAccountsService {
                    .is_some_and(|pending| pending.credit.expires_at <= Utc::now())
                {
                    Some("expired_unknown".to_owned())
+                } else if r.enabled
+                    && weekly_trigger_remaining_percent.is_some()
+                    && r.state.awaiting_weekly_recovery_since.is_some()
+                    && matches!(
+                        r.state.last_result.as_deref(),
+                        Some("reset" | "already_redeemed")
+                    )
+                {
+                    Some("awaiting_weekly_recovery".to_owned())
                } else {
                    r.state.last_result
                }
@@ -145,6 +213,8 @@ impl DefaultAccountsService {
                revision: 0,
                next_run_at: now,
                state: ResetCreditAutomationState {
+                    next_weekly_check_at: None,
+                    awaiting_weekly_recovery_since: None,
                    next_discovery_at: now,
                    credits: vec![],
                    pending: None,
@@ -160,8 +230,8 @@ impl DefaultAccountsService {
                record.state.next_discovery_at =
                    now + chrono::Duration::seconds(i64::from(OsRng.next_u32() % 60));
            }
-            let lead = self.automation_settings().await?.reset_credit_lead_minutes;
-            reschedule(&mut record, lead, now);
+            let trigger = Trigger::from_settings(&self.automation_settings().await?);
+            reschedule(&mut record, trigger, now);
            self.save_automation(&mut record, Some(context)).await?;
            let settings = self
                .settings
@@ -246,7 +316,7 @@ impl DefaultAccountsService {
        self.observe_reset_credits(&mut record, credits, now)?;
        reschedule(
            &mut record,
-            self.automation_settings().await?.reset_credit_lead_minutes,
+            Trigger::from_settings(&self.automation_settings().await?),
            now,
        );
        self.save_automation(&mut record, None).await
@@ -255,18 +325,16 @@ impl DefaultAccountsService {
    async fn automation_failed(
        &self,
        record: &mut ResetCreditAutomation,
-        lead: u32,
+        trigger: Trigger,
        now: DateTime<Utc>,
    ) -> Result<(), AdminError> {
-        if record.state.pending.is_none()
-            && !next_consumption(record, lead).is_some_and(|due| due <= now)
-        {
+        if record.state.pending.is_none() && record.state.retry_at.is_none() {
            record.state.next_discovery_at =
                next_discovery(now, self.timezone, OsRng.next_u64())
                    .ok_or_else(|| AdminError::internal("无法计算重置卡发现时间"))?;
            record.state.retry_at = None;
            record.state.last_result = Some("discovery_failed".to_owned());
-            reschedule(record, lead, now);
+            reschedule(record, trigger, now);
            return self.save_automation(record, None).await;
        }
        record.state.failures = record.state.failures.saturating_add(1);
@@ -281,7 +349,7 @@ impl DefaultAccountsService {
            }
            .to_owned(),
        );
-        reschedule(record, lead, now);
+        reschedule(record, trigger, now);
        self.save_automation(record, None).await
    }

@@ -289,7 +357,7 @@ impl DefaultAccountsService {
    async fn defer_automation(
        &self,
        record: &mut ResetCreditAutomation,
-        lead: u32,
+        trigger: Trigger,
        reason: &str,
    ) -> Result<(), AdminError> {
        let now = Utc::now();
@@ -305,38 +373,24 @@ impl DefaultAccountsService {
        );
        record.state.last_result = Some(reason.to_owned());
        record.state.failures = 0;
-        reschedule(record, lead, now);
+        reschedule(record, trigger, now);
        self.save_automation(record, None).await
    }

-    async fn weekly_reset_credit_gate(
+    async fn reset_credit_quota(
        &self,
        account_id: &ProviderAccountId,
-        max_remaining: u32,
-    ) -> Result<Option<&'static str>, AdminError> {
+        refresh: bool,
+    ) -> Result<ProviderQuota, AdminError> {
        let (_, provider) = self.provider_for_account(account_id).await?;
-        let quota = provider
+        provider
            .quota(ProviderQuotaRequest {
                account_id: account_id.clone(),
-                refresh: true,
+                refresh,
                rolling_usage: None,
            })
            .await
-            .map_err(|error| map_provider_error(error, "reset-credit weekly quota"))?;
-        // 复用账号周窗口归属，不把短期、月度或模型专属桶当作剩余周额度
-        let remaining = quota
-            .usage_windows()
-            .find(|(_, period)| *period == AccountUsagePeriod::Weekly)
-            .and_then(|(window, _)| window.used_percent)
-            .filter(|used| used.is_finite())
-            .map(|used| 100.0 - used.clamp(0.0, 100.0));
-        Ok(match remaining {
-            Some(remaining) if remaining > f64::from(max_remaining) => {
-                Some("weekly_quota_above_threshold")
-            }
-            Some(_) => None,
-            None => Some("weekly_quota_unavailable"),
-        })
+            .map_err(|error| map_provider_error(error, "reset-credit weekly quota"))
    }

    pub(super) async fn reconcile_automation(
@@ -368,7 +422,7 @@ impl DefaultAccountsService {
        }
        let now = Utc::now();
        let settings = self.automation_settings().await?;
-        let lead = settings.reset_credit_lead_minutes;
+        let trigger = Trigger::from_settings(&settings);
        record
            .state
            .credits
@@ -382,18 +436,51 @@ impl DefaultAccountsService {
            record.state.pending = None;
            record.state.retry_at = None;
            record.state.last_result = Some("expired_unknown".to_owned());
+            record.state.awaiting_weekly_recovery_since = Some(now);
        }
        if record.state.retry_at.is_some_and(|retry| retry > now) {
-            reschedule(&mut record, lead, now);
+            reschedule(&mut record, trigger, now);
            return self.save_automation(&mut record, None).await;
        }
        let context = MutationContext {
            actor: MutationActor::System,
            request_id: "reset-credit-automation".to_owned(),
        };
-        let due_credit = next_consumption(&record, lead).is_some_and(|due| due <= now);
+        let due_credit = record
+            .state
+            .credits
+            .iter()
+            .any(|credit| trigger.expiry_due(account_id.as_str(), credit, now));
+        let early_limit = trigger.weekly_trigger();
+        // 错峰读取本地快照，等待恢复期间不因卡片用完而漏过下一轮额度
+        record.state.next_weekly_check_at = early_limit
+            .map(|_| now + chrono::Duration::seconds(60 + i64::from(OsRng.next_u32() % 30)));
+        let mut early_due = false;
+        if let Some(limit) = early_limit
+            && record.state.pending.is_none()
+            && needs_weekly_observation(&record.state)
+        {
+            match self.reset_credit_quota(account_id, false).await {
+                Ok(quota) => {
+                    observe_weekly_recovery(&mut record.state, &quota, limit);
+                    early_due = !record.state.credits.is_empty()
+                        && record.state.awaiting_weekly_recovery_since.is_none()
+                        && weekly_remaining(&quota)
+                            .is_some_and(|remaining| trigger.eligible(remaining, limit));
+                }
+                Err(error) => {
+                    // 额度读取失败不能阻塞独立的卡片发现计划
+                    tracing::warn!(
+                        account_id = account_id.as_str(),
+                        error_kind = error.kind().as_str(),
+                        "重置卡周额度快照读取失败"
+                    );
+                }
+            }
+        }
        if record.state.pending.is_none()
            && (due_credit
+                || early_due
                || record.state.next_discovery_at <= now
                || record.state.retry_at.is_some())
        {
@@ -403,10 +490,10 @@ impl DefaultAccountsService {
                    next_discovery(now, self.timezone, OsRng.next_u64())
                        .ok_or_else(|| AdminError::internal("无法计算重置卡发现时间"))?;
            }
-            if due_credit || record.state.retry_at.is_some() {
+            if due_credit || early_due || record.state.retry_at.is_some() {
                record.state.retry_at = Some(now + chrono::Duration::seconds(30));
            }
-            reschedule(&mut record, lead, now);
+            reschedule(&mut record, trigger, now);
            self.save_automation(&mut record, None).await?;
            // 真正消费前重新核对卡片；每日发现结果也可直接承担本次核对
            match self
@@ -415,7 +502,7 @@ impl DefaultAccountsService {
            {
                Ok(credits) => self.observe_reset_credits(&mut record, &credits, Utc::now())?,
                Err(error) => {
-                    self.automation_failed(&mut record, lead, Utc::now())
+                    self.automation_failed(&mut record, trigger, Utc::now())
                        .await?;
                    return Err(error);
                }
@@ -424,24 +511,28 @@ impl DefaultAccountsService {
                .state
                .credits
                .iter()
-                .find(|credit| consume_at(account_id.as_str(), credit, lead) <= Utc::now())
+                .find(|credit| {
+                    early_due || trigger.expiry_due(account_id.as_str(), credit, Utc::now())
+                })
                .cloned()
            {
-                if let Some(max_remaining) = settings.reset_credit_max_weekly_remaining_percent {
-                    // 已发出的未决请求跳过此检查，继续沿原幂等键确认结果
-                    match self
-                        .weekly_reset_credit_gate(account_id, max_remaining)
-                        .await
-                    {
-                        Ok(Some(reason)) => {
-                            return self.defer_automation(&mut record, lead, reason).await;
-                        }
-                        Ok(None) => {}
+                if let Some(limit) = trigger.quota_limit() {
+                    // 缓存只能唤醒检查，实际选中的卡片与额度都要重新核实
+                    let quota = match self.reset_credit_quota(account_id, true).await {
+                        Ok(quota) => quota,
                        Err(error) => {
-                            self.defer_automation(&mut record, lead, "weekly_quota_unavailable")
+                            self.defer_automation(&mut record, trigger, "weekly_quota_unavailable")
                                .await?;
                            return Err(error);
                        }
+                    };
+                    let reason = match weekly_remaining(&quota) {
+                        Some(remaining) if trigger.eligible(remaining, limit) => None,
+                        Some(_) => Some("weekly_quota_above_threshold"),
+                        None => Some("weekly_quota_unavailable"),
+                    };
+                    if let Some(reason) = reason {
+                        return self.defer_automation(&mut record, trigger, reason).await;
                    }
                }
                // 刷新额度期间卡片可能到期，不能把已过期卡片持久化为待消费
@@ -450,7 +541,7 @@ impl DefaultAccountsService {
                        .state
                        .credits
                        .retain(|credit| credit.expires_at > Utc::now());
-                    reschedule(&mut record, lead, Utc::now());
+                    reschedule(&mut record, trigger, Utc::now());
                    return self.save_automation(&mut record, None).await;
                }
                record.state.pending = Some(PendingResetCredit {
@@ -459,13 +550,13 @@ impl DefaultAccountsService {
                });
                record.state.last_result = Some("pending".to_owned());
                record.state.retry_at = Some(Utc::now() + chrono::Duration::seconds(30));
-                reschedule(&mut record, lead, Utc::now());
+                reschedule(&mut record, trigger, Utc::now());
                // 必须在发送消费请求前落盘，进程退出或响应丢失继续使用相同幂等键
                self.save_automation(&mut record, None).await?;
            }
        }
        let Some(pending) = record.state.pending.clone() else {
-            reschedule(&mut record, lead, Utc::now());
+            reschedule(&mut record, trigger, Utc::now());
            return self.save_automation(&mut record, None).await;
        };
        let command = ConsumeProviderResetCredit {
@@ -478,9 +569,12 @@ impl DefaultAccountsService {
            Ok(result) => {
                let confirmed = matches!(result.code.as_str(), "reset" | "already_redeemed");
                record.state.pending = None;
+                if confirmed {
+                    record.state.awaiting_weekly_recovery_since = Some(Utc::now());
+                }
                if result.code == "nothing_to_reset" {
                    return self
-                        .defer_automation(&mut record, lead, "nothing_to_reset")
+                        .defer_automation(&mut record, trigger, "nothing_to_reset")
                        .await;
                }
                record
@@ -494,15 +588,20 @@ impl DefaultAccountsService {
                } else {
                    "not_redeemed".to_owned()
                });
-                reschedule(&mut record, lead, Utc::now());
+                reschedule(&mut record, trigger, Utc::now());
                // 已确认的结果先落盘，再刷新额度；观测失败不能重放已完成的消费
                self.save_automation(&mut record, None).await?;
-                if confirmed {
-                    let _ = self.quota(account_id, true).await;
+                if confirmed
+                    && let Ok(account) = self.quota(account_id, true).await
+                    && let Some(limit) = early_limit
+                    && observe_weekly_recovery(&mut record.state, &account.quota, limit)
+                {
+                    reschedule(&mut record, trigger, Utc::now());
+                    self.save_automation(&mut record, None).await?;
                }
            }
            Err(error) => {
-                self.automation_failed(&mut record, lead, Utc::now())
+                self.automation_failed(&mut record, trigger, Utc::now())
                    .await?;
                return Err(error);
            }
@@ -511,6 +610,42 @@ impl DefaultAccountsService {
    }
 }

+/// 复用账号周窗口归属，忽略短期、模型专属和过期窗口
+fn weekly_remaining(quota: &ProviderQuota) -> Option<f64> {
+    quota
+        .usage_windows()
+        .find(|(window, period)| {
+            *period == AccountUsagePeriod::Weekly
+                && window.reset_at.is_some_and(|end| end > Utc::now())
+        })
+        .and_then(|(window, _)| window.used_percent)
+        .filter(|used| used.is_finite())
+        .map(|used| 100.0 - used.clamp(0.0, 100.0))
+}
+
+fn weekly_low(remaining: f64, limit: u32) -> bool {
+    remaining < 100.0 && remaining <= f64::from(limit)
+}
+
+fn needs_weekly_observation(state: &ResetCreditAutomationState) -> bool {
+    !state.credits.is_empty() || state.awaiting_weekly_recovery_since.is_some()
+}
+
+fn observe_weekly_recovery(
+    state: &mut ResetCreditAutomationState,
+    quota: &ProviderQuota,
+    limit: u32,
+) -> bool {
+    if let Some(since) = state.awaiting_weekly_recovery_since
+        && quota.observed_at.is_some_and(|at| at > since)
+        && weekly_remaining(quota).is_some_and(|remaining| !weekly_low(remaining, limit))
+    {
+        state.awaiting_weekly_recovery_since = None;
+        return true;
+    }
+    false
+}
+
 /// 当地次日随机发现时间；随机数由调用者提供，结果持久化后不会因重启重抽
 fn next_discovery(
    now: DateTime<Utc>,
@@ -550,14 +685,21 @@ fn next_consumption(record: &ResetCreditAutomation, lead_minutes: u32) -> Option
        .min()
 }

-fn reschedule(record: &mut ResetCreditAutomation, lead_minutes: u32, now: DateTime<Utc>) {
+fn reschedule(record: &mut ResetCreditAutomation, trigger: Trigger, now: DateTime<Utc>) {
    record.next_run_at = if let Some(retry) = record.state.retry_at {
        retry
    } else if record.state.pending.is_some() {
        now
    } else {
-        next_consumption(record, lead_minutes).map_or(record.state.next_discovery_at, |due| {
-            due.min(record.state.next_discovery_at)
+        let scheduled = match trigger {
+            Trigger::Expiry { lead, .. } => next_consumption(record, lead),
+            Trigger::Weekly { .. } if needs_weekly_observation(&record.state) => {
+                Some(record.state.next_weekly_check_at.unwrap_or(now))
+            }
+            Trigger::Weekly { .. } => None,
+        };
+        scheduled.map_or(record.state.next_discovery_at, |at| {
+            at.min(record.state.next_discovery_at)
        })
    };
 }
@@ -162,7 +162,7 @@ impl BackupService for DefaultBackupService {
                ok: false,
                stage: "putObject",
                code: Some(code::INVALID_CONFIG),
-                message: "备份存储配置不完整，无法执行连接测试".to_owned(),
+                message: "备份存储配置不完整".to_owned(),
            });
        };
        let result = self
@@ -198,14 +198,10 @@ impl BackupService for DefaultBackupService {
            .await
            .map_err(|error| map_store_error(error, "backup settings"))?;
        if !settings.storage_configured() {
-            return Err(AdminError::bad_request(
-                "备份存储配置不完整，请先保存存储配置",
-            ));
+            return Err(AdminError::bad_request("请先补全并保存备份存储配置"));
        }
        if !settings.storage_verified() {
-            return Err(AdminError::bad_request(
-                "备份存储尚未通过连接测试，请先测试存储配置",
-            ));
+            return Err(AdminError::bad_request("请先通过备份存储连接测试"));
        }
        let prefix = settings.prefix.as_deref().unwrap_or_default();
        let seed = build_backup_seed(
@@ -241,9 +237,7 @@ impl BackupService for DefaultBackupService {
    ) -> Result<DownloadUrlResult, AdminError> {
        let record = self.require_record(backup_id).await?;
        if record.status != BackupStatus::Completed {
-            return Err(AdminError::conflict(
-                "只有 completed 的备份才能创建下载地址",
-            ));
+            return Err(AdminError::conflict("只能下载已完成的备份"));
        }
        let settings = self
            .repository
@@ -280,9 +274,7 @@ impl BackupService for DefaultBackupService {
    ) -> Result<BackupRecord, AdminError> {
        let record = self.require_record(backup_id).await?;
        if !record.status.can_be_deleted() {
-            return Err(AdminError::conflict(
-                "只有 completed 或 failed 的备份才能删除",
-            ));
+            return Err(AdminError::conflict("只能删除已完成或失败的备份"));
        }
        let now = Utc::now();
        let deleting = self
@@ -290,7 +282,7 @@ impl BackupService for DefaultBackupService {
            .transition_to_deleting(backup_id, now, Some(context))
            .await
            .map_err(|error| map_store_error(error, "backup record"))?
-            .ok_or_else(|| AdminError::conflict("备份记录已进入删除流程"))?;
+            .ok_or_else(|| AdminError::conflict("备份状态已变更，请刷新列表"))?;
        Ok(deleting)
    }
 }
@@ -14,10 +14,12 @@ use crate::{
    model::{
        AdminError, MutationContext,
        client_keys::{
-            ClientKeyBudgetMutationOrigin, ClientKeyCursorValue, ClientKeyListQuery,
-            ClientKeyMutation, ClientKeyPage, ClientKeyRecord, ClientKeySecret, ClientKeySortField,
-            CreateClientKey, CreatedClientKey, DeleteClientKey, NewClientKey, ResetClientKeyBudget,
-            SetClientKeyEnabled, UpdateClientKey, UpdateClientKeyBudgetLimits,
+            ClientKeyBudgetMutationOrigin, ClientKeyBudgetWindow, ClientKeyBudgetWindowPeriod,
+            ClientKeyCursorValue, ClientKeyListQuery, ClientKeyMutation, ClientKeyPage,
+            ClientKeyRecord, ClientKeySecret, ClientKeySortField, CreateClientKey,
+            CreatedClientKey, DeleteClientKey, NewClientKey, ResetClientKeyBudget,
+            SetClientKeyBudgetWindow, SetClientKeyEnabled, UpdateClientKey,
+            UpdateClientKeyBudgetLimits,
        },
    },
    ports::store::{AdminStoreError, AdminStoreErrorKind, ClientKeyStore},
@@ -28,6 +30,18 @@ use super::{map_store_error, publish_committed};
 /// API 消费的 Client Key 管理服务
 #[async_trait]
 pub trait ClientKeyService: Send + Sync {
+    async fn budget_window(
+        &self,
+        id: &ClientApiKeyId,
+        period: ClientKeyBudgetWindowPeriod,
+    ) -> Result<ClientKeyBudgetWindow, AdminError>;
+    async fn set_budget_window(
+        &self,
+        context: &MutationContext,
+        command: SetClientKeyBudgetWindow,
+        origin: ClientKeyBudgetMutationOrigin,
+    ) -> Result<u64, AdminError>;
+
    async fn get(&self, id: &ClientApiKeyId) -> Result<ClientKeyRecord, AdminError>;
    async fn list(&self, query: ClientKeyListQuery) -> Result<ClientKeyPage, AdminError>;
    async fn reveal(&self, id: &ClientApiKeyId) -> Result<ClientKeySecret, AdminError>;
@@ -89,6 +103,35 @@ impl DefaultClientKeyService {

 #[async_trait]
 impl ClientKeyService for DefaultClientKeyService {
+    async fn budget_window(
+        &self,
+        id: &ClientApiKeyId,
+        period: ClientKeyBudgetWindowPeriod,
+    ) -> Result<ClientKeyBudgetWindow, AdminError> {
+        self.store
+            .client_key_budget_window(id, period)
+            .await
+            .map_err(|error| map_store_error(error, "client API key"))
+    }
+
+    async fn set_budget_window(
+        &self,
+        context: &MutationContext,
+        command: SetClientKeyBudgetWindow,
+        origin: ClientKeyBudgetMutationOrigin,
+    ) -> Result<u64, AdminError> {
+        if command
+            .window
+            .is_some_and(|window| window.starts_at >= window.ends_at)
+        {
+            return Err(AdminError::invalid("预算窗口结束时间必须晚于开始时间"));
+        }
+        self.store
+            .set_client_key_budget_window(command, origin, context)
+            .await
+            .map_err(|error| map_store_error(error, "client API key"))
+    }
+
    async fn get(&self, id: &ClientApiKeyId) -> Result<ClientKeyRecord, AdminError> {
        self.store
            .get_client_key(id)
@@ -162,7 +205,7 @@ impl ClientKeyService for DefaultClientKeyService {
        for (provider, profile) in &command.request_profile_overrides {
            self.providers
                .require(provider)
-                .and_then(|provider| provider.preview_client_profile(profile))
+                .and_then(|provider| provider.preview_key_client_profile(profile, None))
                .map_err(|error| super::map_provider_error(error, "client profile"))?;
        }
        validate_peer_sharing(command.peer_sharing, &command.group_ids)?;
@@ -209,7 +252,7 @@ impl ClientKeyService for DefaultClientKeyService {
            if let Some(profile) = profile {
                self.providers
                    .require(provider)
-                    .and_then(|provider| provider.preview_client_profile(profile))
+                    .and_then(|provider| provider.preview_key_client_profile(profile, None))
                    .map_err(|error| super::map_provider_error(error, "client profile"))?;
            }
        }
@@ -30,7 +30,18 @@ pub(super) async fn publish_credentials_and_observe_quota(
    notify_account_facts_changed(peer.map(AsRef::as_ref), provider.as_ref(), account_ids).await;
    publish_committed(snapshot, revision).await?;

-    // 凭据已经提交；额度只是可重建的观察，不能拖住管理请求或回滚提交结果
+    observe_account_quotas(peer, provider, accounts, account_ids, request_id);
+    Ok(())
+}
+
+pub(super) fn observe_account_quotas(
+    peer: Option<&std::sync::Arc<dyn crate::ports::peer::PeerUpstreamService>>,
+    provider: &std::sync::Arc<dyn ProviderAdmin>,
+    accounts: &std::sync::Arc<dyn AccountStore>,
+    account_ids: &[ProviderAccountId],
+    request_id: &str,
+) {
+    // 配置已提交，额度查询失败不回滚配置
    let provider = provider.clone();
    let peer = peer.cloned();
    let accounts = accounts.clone();
@@ -48,14 +59,14 @@ pub(super) async fn publish_credentials_and_observe_quota(
                    Ok(Some(account)) => account,
                    Ok(None) => continue,
                    Err(error) => {
-                        tracing::warn!(request_id, account_id = %account_id, error = %error, "initial quota account lookup failed");
+                        tracing::warn!(request_id, account_id = %account_id, error = %error, "quota observation account lookup failed");
                        continue;
                    }
                };
                if !account.enabled || &account.provider_kind != provider.provider_kind() {
                    continue;
                }
-                // 首查与手动刷新共用认证能力分派，互联协议由 Admin 解释
+                // 后台查询与手动刷新共用认证能力分派，互联协议由 Admin 解释
                super::peer_link::upstream::read_quota(
                    Some(peer),
                    provider.as_ref(),
@@ -72,12 +83,11 @@ pub(super) async fn publish_credentials_and_observe_quota(
                    provider = %provider.provider_kind().as_str(),
                    account_id = %account_id.as_str(),
                    quota_error = ?error.kind(),
-                    "initial quota observation failed"
+                    "account quota observation failed"
                );
            }
        }
    });
-    Ok(())
 }

 pub(super) async fn required_credential(
@@ -207,7 +207,7 @@ impl DefaultImportTasksService {
            }
            Err(_) => {
                item.status = ImportItemStatus::Unknown;
-                item.message = Some("执行中断，请先核对账号列表再决定是否重新导入".to_owned());
+                item.message = Some("导入结果未知，重新导入前请核对账号列表".to_owned());
            }
        }
        entry.finish_if_done();
@@ -0,0 +1,153 @@
+//! 从已保存的错误事实投影管理端来源，不参与执行错误分类或重试
+
+use crate::model::observability::{UsageErrorOrigin, UsageListRecord, UsageRecord};
+
+impl UsageListRecord {
+    #[must_use]
+    pub fn error_origin(&self) -> UsageErrorOrigin {
+        error_origin(
+            self.has_upstream_error,
+            self.error_code.as_deref(),
+            self.websocket_close_code,
+            self.upstream_status_code,
+            self.error_kind.as_deref(),
+            self.continuation_unavailable_reason.as_deref(),
+            self.upstream_connection_exit_reason.as_deref(),
+        )
+    }
+}
+
+impl UsageRecord {
+    #[must_use]
+    pub fn error_origin(&self) -> UsageErrorOrigin {
+        let has_upstream_error = self.upstream_error.as_ref().is_some_and(|error| {
+            [&error.message, &error.code, &error.error_type]
+                .into_iter()
+                .any(|value| value.as_ref().is_some_and(|value| !value.is_empty()))
+        });
+        error_origin(
+            has_upstream_error,
+            self.provider_error_code.as_deref(),
+            self.websocket_close_code,
+            self.upstream_status_code,
+            self.error_kind.as_deref(),
+            self.continuation_unavailable_reason.as_deref(),
+            self.upstream_connection_exit_reason.as_deref(),
+        )
+    }
+}
+
+// 上游原始事实优先；客户端 HTTP 状态和任意错误文案不能证明错误来源
+fn error_origin(
+    has_upstream_error: bool,
+    upstream_code: Option<&str>,
+    websocket_close_code: Option<u16>,
+    upstream_status_code: Option<u16>,
+    error_kind: Option<&str>,
+    continuation_reason: Option<&str>,
+    connection_exit_reason: Option<&str>,
+) -> UsageErrorOrigin {
+    if has_upstream_error
+        || upstream_code.is_some_and(|code| !code.is_empty())
+        || websocket_close_code.is_some()
+        || upstream_status_code.is_some_and(|status| status >= 400)
+        || matches!(
+            continuation_reason,
+            Some("upstream_rejected" | "quota_exhausted")
+        )
+        || matches!(
+            error_kind,
+            // 这里匹配内部 errorKind；message_too_big 只由收到的上游 close 1009 产生
+            Some("permission_denied" | "message_too_big" | "upstream_capacity_unavailable")
+        )
+    {
+        return UsageErrorOrigin::Upstream;
+    }
+    if matches!(
+        continuation_reason,
+        Some(
+            "scope_unavailable"
+                | "pool_unavailable"
+                | "fresh_connection_required"
+                | "connection_busy"
+                | "latest_response_mismatch"
+                | "reused_connection_lost"
+                | "transport_payload_too_large"
+        )
+    ) || matches!(
+        error_kind,
+        Some(
+            "process_interrupted"
+                | "process_terminated"
+                | "internal_error"
+                | "model_not_found"
+                | "no_available_provider"
+                | "no_eligible_account"
+                | "account_capacity_unavailable"
+                | "middleware_capacity_unavailable"
+                | "concurrency_queue_full"
+                | "concurrency_queue_timeout"
+                | "provider_infrastructure_unavailable"
+                | "session_policy_restricted"
+                | "request_policy_denied"
+                | "policy_denied"
+                | "budget_exhausted"
+        )
+    ) || matches!(
+        connection_exit_reason,
+        Some(
+            "command_channel_closed"
+                | "local_close"
+                | "message_receiver_closed"
+                | "client_cancelled"
+                | "downstream_send_failed"
+                | "downstream_connection_closed"
+                | "downstream_rebound"
+                | "pool_shutdown"
+                | "max_age_expired"
+                | "idle_timeout_expired"
+                | "proxy_capacity_evicted"
+                | "search_activation_required"
+        )
+    ) {
+        return UsageErrorOrigin::Proxy;
+    }
+    if matches!(
+        connection_exit_reason,
+        Some(
+            "upstream_close"
+                | "normal_close"
+                | "unexpected_binary_event"
+                | "incomplete_response"
+                | "failed_response"
+        )
+    ) {
+        return UsageErrorOrigin::Upstream;
+    }
+    if error_kind == Some("transport")
+        || matches!(
+            connection_exit_reason,
+            Some(
+                "eof"
+                    | "unexpected_eof"
+                    | "transport_error"
+                    | "connection_reset"
+                    | "connection_aborted"
+                    | "broken_pipe"
+                    | "tcp_reset"
+                    | "reset_without_closing_handshake"
+                    | "transport_timeout"
+                    | "outbound_transport_error"
+                    | "receive_idle_timeout"
+                    | "pong_timeout"
+                    | "ping_write_timeout"
+                    | "pong_write_timeout"
+            )
+        )
+    {
+        return UsageErrorOrigin::Connection;
+    }
+    // invalid_request、protocol、rate_limited 等分类同时用于本地和上游失败
+    // 发送状态与笼统的连接退出摘要也不能替代缺失的来源事实
+    UsageErrorOrigin::Unknown
+}
@@ -8,6 +8,7 @@ use std::{

 use async_trait::async_trait;
 use chrono::{DateTime, Duration, Utc};
+use futures::StreamExt as _;
 use gateway_core::{account::ProviderAccountId, routing::ProviderKind};

 use crate::{
@@ -18,8 +19,8 @@ use crate::{
            DashboardPeriodMetrics, DashboardQuery, DashboardResult, DecimalAmount,
            DiagnosticDimension, DiagnosticsItem, DiagnosticsResult, Granularity, HealthStatus,
            HealthTimeline, HealthTimelinePoint, OpsErrorPage, OpsErrorQuery, ProviderBillingInput,
-            RequestMetricPoint, RequestMetrics, TimeRange, Trend, TrendKind, TrendPoint,
-            TrendSummary, UsageBilling, UsageBillingProjection, UsageCacheEfficiency,
+            RequestHealth, RequestMetricPoint, RequestMetrics, TimeRange, Trend, TrendKind,
+            TrendPoint, TrendSummary, UsageBilling, UsageBillingProjection, UsageCacheEfficiency,
            UsageCalculatedBillingFact, UsageConcurrencyPoint, UsageCostComparison,
            UsageCostSummary, UsageDetail, UsageFilter, UsageInsight, UsageInsightData,
            UsageInsightMetric, UsageInsights, UsageInsightsCost, UsageInsightsCostPoint,
@@ -42,6 +43,7 @@ const HEALTH_TIMELINE_SLOT_MINUTES: i64 = 15;
 const HEALTH_TIMELINE_MIN_SAMPLE_SIZE: u64 = 10;
 const HEALTH_TIMELINE_UNAVAILABLE_FAILURE_THRESHOLD: u64 = 3;
 const HEALTH_TIMELINE_STABLE_RELIABILITY: f64 = 95.0;
+mod errors;
 mod export;
 mod store_cache;
 pub(crate) use store_cache::CachedObservabilityStore;
@@ -132,8 +134,9 @@ impl DefaultObservabilityService {
            self.settings.load_runtime_settings(),
        )
        .map_err(|error| map_store_error(error, "dashboard"))?;
-        let runtime_slots = observation.runtime_slots;
-        self.enrich_list_records(&mut observation.recent_requests);
+        let runtime_slots = observation.runtime_slots.as_ref();
+        self.enrich_list_records(&mut observation.recent_requests)
+            .await;
        self.enrich_dashboard_quotas(&mut observation.account_usage)
            .await;
        for account in &mut observation.account_usage {
@@ -178,11 +181,19 @@ impl DefaultObservabilityService {
            .providers
            .dashboard_wire_profiles(&settings.request_profiles);
        let max_concurrent_per_account = u64::from(settings.values.max_concurrent_per_account);
-        let (inherited_accounts, overridden_slots) = runtime_slots
-            .as_ref()
+        let (mut inherited_accounts, mut overridden_slots) = runtime_slots
            .map_or((observation.provider_accounts.normal, 0), |slots| {
                (slots.inherited_accounts, slots.overridden_slots)
            });
+        if let (Some(peer), Some(slots)) = (&self.upstream_info, runtime_slots) {
+            let now = std::time::SystemTime::now();
+            for version in &slots.inherited_versions {
+                if let Some(limit) = peer.observed_concurrency_limit(version, now) {
+                    inherited_accounts -= 1;
+                    overridden_slots = overridden_slots.saturating_add(u64::from(limit.get()));
+                }
+            }
+        }
        let total_slots = (max_concurrent_per_account > 0 || inherited_accounts == 0).then(|| {
            inherited_accounts
                .saturating_mul(max_concurrent_per_account)
@@ -259,7 +270,7 @@ impl ObservabilityService for DefaultObservabilityService {
            .list_usage_records(query)
            .await
            .map_err(|error| map_store_error(error, "usage records"))?;
-        self.enrich_list_records(&mut page.items);
+        self.enrich_list_records(&mut page.items).await;
        Ok(page)
    }

@@ -336,15 +347,29 @@ impl ObservabilityService for DefaultObservabilityService {
            .usage_diagnostics(range, filter, dimension, 100)
            .await
            .map_err(|error| map_store_error(error, "usage diagnostics"))?;
+        let peers = if dimension == DiagnosticDimension::Account {
+            self.current_upstream_peers(observation.items.iter().map(|item| item.key.as_str()))
+                .await
+        } else {
+            HashMap::new()
+        };
        let items = observation
            .items
            .into_iter()
            .map(|item| {
-                let error_rate = rate_or_zero(item.failure_count, item.request_count);
-                let non_completion_rate =
-                    rate_or_zero(item.non_completion_count, item.request_count);
+                let health = RequestHealth::from_counts(
+                    item.success_count,
+                    item.failure_count,
+                    item.cancelled_count,
+                    item.incomplete_count,
+                    item.caller_error_count,
+                );
+                let non_completion_count =
+                    item.cancelled_count.saturating_add(item.incomplete_count);
+                let non_completion_rate = rate_or_zero(non_completion_count, item.request_count);
                let retry_rate = rate_or_zero(item.retried_request_count, item.request_count);
                DiagnosticsItem {
+                    account_upstream_peer: peers.get(&item.key).copied(),
                    key: item.key,
                    name: item.name,
                    account_authentication_kind: item.account_authentication_kind,
@@ -357,8 +382,8 @@ impl ObservabilityService for DefaultObservabilityService {
                    account_plan_type: item.account_plan_type,
                    request_count: item.request_count,
                    success_count: item.success_count,
-                    error_count: item.failure_count,
-                    error_rate,
+                    error_count: health.non_success_requests(),
+                    error_rate: health.error_ratio(),
                    request_share: rate_or_zero(
                        item.request_count,
                        observation.total_request_count,
@@ -366,7 +391,7 @@ impl ObservabilityService for DefaultObservabilityService {
                    average_latency_ms: item.average_latency_ms,
                    latency_p95_ms: item.latency_p95_ms,
                    first_token_p95_ms: item.first_token_p95_ms,
-                    non_completion_count: item.non_completion_count,
+                    non_completion_count,
                    non_completion_rate,
                    retry_count: item.retry_count,
                    retry_rate,
@@ -557,9 +582,8 @@ fn build_usage_insights(
    }

    let requests = &overview.requests;
-    let health_window = HealthWindow::from_metrics(requests);
+    let health_window = RequestHealth::from_metrics(requests);
    let failed_requests = health_window.failed_requests;
-    let health_requests = health_window.eligible_requests();
    let health = UsageInsightsHealth {
        total_requests: requests.request_count,
        success_requests: requests.success_count,
@@ -567,7 +591,7 @@ fn build_usage_insights(
        cancelled_requests: requests.cancelled_count,
        incomplete_requests: requests.incomplete_count,
        caller_error_requests: requests.caller_error_count,
-        success_rate: rate_or_zero(requests.success_count, health_requests),
+        success_rate: health_window.success_ratio(),
        completion_rate: rate_or_zero(
            requests
                .success_count
@@ -577,7 +601,7 @@ fn build_usage_insights(
        points: trend
            .iter()
            .map(|point| {
-                let health_window = HealthWindow::from_metrics(&point.metrics);
+                let health_window = RequestHealth::from_metrics(&point.metrics);
                UsageInsightsHealthPoint {
                    total_requests: point.metrics.request_count,
                    bucket_start: point.bucket_start,
@@ -586,10 +610,7 @@ fn build_usage_insights(
                    cancelled_requests: point.metrics.cancelled_count,
                    incomplete_requests: point.metrics.incomplete_count,
                    caller_error_requests: point.metrics.caller_error_count,
-                    error_rate: rate_or_zero(
-                        health_window.non_success_requests(),
-                        health_window.eligible_requests(),
-                    ),
+                    error_rate: health_window.error_ratio(),
                }
            })
            .collect(),
@@ -912,6 +933,29 @@ fn usd_cost(costs: &[CurrencyCost]) -> Option<DecimalAmount> {
 }

 impl DefaultObservabilityService {
+    async fn current_upstream_peers<'a>(
+        &self,
+        ids: impl Iterator<Item = &'a str>,
+    ) -> HashMap<String, bool> {
+        let Some(peer) = self.upstream_info.as_deref() else {
+            return HashMap::new();
+        };
+        let ids = ids
+            .map(str::to_owned)
+            .collect::<std::collections::BTreeSet<_>>();
+        // 同一页重复账号只读取一次摘要，单个账号不存在或读取失败不阻断历史记录
+        futures::stream::iter(ids)
+            .map(|id: String| async move {
+                let account_id = ProviderAccountId::new(id.clone()).ok()?;
+                let upstream = peer.read_summary(&account_id).await.ok()??.upstream?;
+                Some((id, upstream.discovered && upstream.observed_at.is_some()))
+            })
+            .buffer_unordered(8)
+            .filter_map(|value| async move { value })
+            .collect()
+            .await
+    }
+
    async fn enrich_dashboard_quotas(&self, accounts: &mut [DashboardAccountUsage]) {
        if accounts.is_empty() {
            return;
@@ -976,8 +1020,22 @@ impl DefaultObservabilityService {

    /// 补充当前套餐展示名称，逐条尽力把可校验的总额升级为完整分解；单条脏数据（非法 Provider kind、
    /// 不支持的来源或费用规则失败）只保留该条已存的总额，不影响整页返回
-    fn enrich_list_records(&self, records: &mut [crate::model::observability::UsageListRecord]) {
+    async fn enrich_list_records(
+        &self,
+        records: &mut [crate::model::observability::UsageListRecord],
+    ) {
+        let peers = self
+            .current_upstream_peers(
+                records
+                    .iter()
+                    .filter_map(|record| record.provider_account_ref.as_deref()),
+            )
+            .await;
        for record in records {
+            record.provider_account_upstream_peer = record
+                .provider_account_ref
+                .as_ref()
+                .and_then(|id| peers.get(id).copied());
            record.provider_account_plan_type_display =
                record.provider_kind.as_deref().and_then(|provider| {
                    self.providers
@@ -1071,7 +1129,7 @@ pub(super) fn health_timeline_at(
        .map(|index| {
            (
                start + Duration::minutes(HEALTH_TIMELINE_SLOT_MINUTES * index),
-                HealthWindow::default(),
+                RequestHealth::default(),
            )
        })
        .collect::<Vec<_>>();
@@ -1097,7 +1155,7 @@ pub(super) fn health_timeline_at(
    let totals = buckets
        .iter()
        .filter(|(bucket_start, _)| *bucket_start <= current_slot)
-        .fold(HealthWindow::default(), |mut totals, (_, bucket)| {
+        .fold(RequestHealth::default(), |mut totals, (_, bucket)| {
            totals.add_window(*bucket);
            totals
        });
@@ -1161,11 +1219,9 @@ fn trend(
        }
    }
    let average_latency_ms = average(metrics.latency_sum_ms, metrics.latency_count);
-    let service_failure_count = service_failure_count(&metrics);
-    let success_rate = ratio(
-        metrics.success_count,
-        HealthWindow::from_metrics(&metrics).eligible_requests(),
-    );
+    let health = RequestHealth::from_metrics(&metrics);
+    let error_count = health.non_success_requests();
+    let success_rate = health.success_ratio();
    let cache_hit_request_rate = ratio(
        metrics.cache_hit_request_count,
        metrics.cache_eligible_request_count,
@@ -1194,7 +1250,7 @@ fn trend(
            output_tokens: metrics.output_tokens,
            cached_input_tokens: metrics.cached_input_tokens,
            total_tokens: metrics.total_tokens,
-            service_failure_count,
+            error_count,
            average_latency_ms,
            max_latency_ms: metrics.max_latency_ms,
            min_latency_ms: metrics.min_latency_ms,
@@ -1213,11 +1269,11 @@ fn trend(
 }

 fn trend_point(point: RequestMetricPoint) -> TrendPoint {
-    let service_failure_count = service_failure_count(&point.metrics);
+    let health = RequestHealth::from_metrics(&point.metrics);
    TrendPoint {
        bucket_start: point.bucket_start,
        granularity: point.granularity,
-        service_failure_count,
+        error_count: health.non_success_requests(),
        average_latency_ms: average(point.metrics.latency_sum_ms, point.metrics.latency_count),
        average_first_token_latency_ms: average(
            point.metrics.first_token_latency_sum_ms,
@@ -1231,10 +1287,7 @@ fn trend_point(point: RequestMetricPoint) -> TrendPoint {
            point.metrics.cache_hit_request_count,
            point.metrics.cache_eligible_request_count,
        ),
-        success_rate: ratio(
-            point.metrics.success_count,
-            HealthWindow::from_metrics(&point.metrics).eligible_requests(),
-        ),
+        success_rate: health.success_ratio(),
        metrics: point.metrics,
        cost_coverage: point.cost_coverage,
        costs: point.costs,
@@ -1318,57 +1371,7 @@ fn rate_or_zero(numerator: u64, denominator: u64) -> f64 {
    ratio(numerator, denominator).unwrap_or(0.0)
 }

-#[derive(Debug, Clone, Copy, Default)]
-struct HealthWindow {
-    success_requests: u64,
-    failed_requests: u64,
-    cancelled_requests: u64,
-    incomplete_requests: u64,
-    caller_error_requests: u64,
-}
-
-impl HealthWindow {
-    fn from_metrics(metrics: &RequestMetrics) -> Self {
-        Self {
-            success_requests: metrics.success_count,
-            failed_requests: service_failure_count(metrics),
-            cancelled_requests: metrics.cancelled_count,
-            incomplete_requests: metrics.incomplete_count,
-            caller_error_requests: metrics.caller_error_count,
-        }
-    }
-
-    // 未完成保留交付终态，但上游失败、超时和进程中断都不能视为服务成功
-    fn non_success_requests(self) -> u64 {
-        self.failed_requests
-            .saturating_add(self.incomplete_requests)
-    }
-
-    fn eligible_requests(self) -> u64 {
-        self.success_requests
-            .saturating_add(self.non_success_requests())
-    }
-
-    fn add_metrics(&mut self, metrics: &RequestMetrics) {
-        self.add_window(Self::from_metrics(metrics));
-    }
-
-    fn add_window(&mut self, other: Self) {
-        self.success_requests = self.success_requests.saturating_add(other.success_requests);
-        self.failed_requests = self.failed_requests.saturating_add(other.failed_requests);
-        self.cancelled_requests = self
-            .cancelled_requests
-            .saturating_add(other.cancelled_requests);
-        self.incomplete_requests = self
-            .incomplete_requests
-            .saturating_add(other.incomplete_requests);
-        self.caller_error_requests = self
-            .caller_error_requests
-            .saturating_add(other.caller_error_requests);
-    }
-}
-
-fn health_status(bucket: HealthWindow, is_future: bool) -> HealthStatus {
+fn health_status(bucket: RequestHealth, is_future: bool) -> HealthStatus {
    let eligible_requests = bucket.eligible_requests();
    if is_future {
        HealthStatus::Future
@@ -1389,14 +1392,6 @@ fn health_status(bucket: HealthWindow, is_future: bool) -> HealthStatus {
    }
 }

-fn health_reliability(bucket: HealthWindow) -> Option<f64> {
-    let eligible_requests = bucket.eligible_requests();
-    (eligible_requests > 0)
-        .then(|| bucket.success_requests as f64 / eligible_requests as f64 * 100.0)
-}
-
-fn service_failure_count(metrics: &RequestMetrics) -> u64 {
-    metrics
-        .failure_count
-        .saturating_sub(metrics.caller_error_count)
+fn health_reliability(bucket: RequestHealth) -> Option<f64> {
+    bucket.success_rate()
 }
@@ -8,7 +8,9 @@ use std::{collections::BTreeMap, sync::Arc};

 use async_trait::async_trait;
 use chrono::{TimeDelta, Utc};
-use gateway_core::{engine::execution::AuthenticatedClient, policy::ClientPeerSharing};
+use gateway_core::{
+    account::ProviderAccountId, engine::execution::AuthenticatedClient, policy::ClientPeerSharing,
+};
 use tokio::sync::Semaphore;

 use crate::{
@@ -113,10 +115,8 @@ impl PeerLinkService for DefaultPeerLinkService {
        let mut result = PeerLinkExport {
            observed_at: now,
            expires_at: now + TimeDelta::minutes(5),
-            budget_access: key
-                .budget
-                .limits
-                .access(key.budget.daily_used_usd, key.budget.weekly_used_usd),
+            budget_access: key.budget.access_at(budget_observed_at.into()),
+            key_limits: key.limits,
            budget: key.budget,
            budget_observed_at,
            pool: None,
@@ -153,16 +153,37 @@ impl PeerLinkService for DefaultPeerLinkService {
            .filter(|group| group.enabled)
            .map(|group| group.id.clone())
            .collect::<Vec<_>>();
+        let scope = client.policy().account_scope();
+        let direct_ids = ids
+            .iter()
+            .filter(|id| {
+                scope
+                    .directory()
+                    .account(id)
+                    .is_some_and(|account| account.is_direct_account())
+            })
+            .cloned()
+            .collect::<Vec<_>>();
        let accounts = self
            .accounts
-            .load_accounts_in_enabled_groups(&ids, &groups)
+            .load_accounts_in_enabled_groups(&direct_ids, &groups)
            .await
            .map_err(|error| map_store_error(error, "peer accounts"))?
            .into_iter()
            .filter(|account| {
-                self.providers
-                    .require(&account.provider_kind)
-                    .is_ok_and(|provider| provider.is_direct_account(&account.authentication_kind))
+                ProviderAccountId::new(account.id.clone())
+                    .ok()
+                    .and_then(|id| scope.directory().account(&id))
+                    .is_some_and(|frozen| {
+                        frozen.direct_authentication_kind()
+                            == Some(account.authentication_kind.as_str())
+                    })
+                    && self
+                        .providers
+                        .require(&account.provider_kind)
+                        .is_ok_and(|provider| {
+                            provider.is_direct_account(&account.authentication_kind)
+                        })
            })
            .collect::<Vec<_>>();
        let account_ids = accounts
@@ -231,26 +252,18 @@ impl PeerLinkService for DefaultPeerLinkService {
            ));
        }
        if sharing.share_quota {
-            let (quota, mut models) = projection::quota_and_models(
+            let (quota, models) = projection::quota_and_models(
                client,
                &accounts,
                &quotas,
                &self.providers,
                &runtime,
                &public_models,
+                &ids,
                now,
                limits.max_response_bytes,
            )
            .await?;
-            // 发布窗口内缺失或已变更的账号不能被静默剔除后推导整个模型池耗尽
-            if accounts.len() != ids.len() {
-                for model in &mut models {
-                    model.complete = false;
-                    if model.state == crate::model::peer_link::PeerModelState::Exhausted {
-                        model.state = crate::model::peer_link::PeerModelState::Unknown;
-                    }
-                }
-            }
            result.quota = Some(quota);
            result.models = models;
        }
@@ -1,6 +1,6 @@
 //! 从已授权的本地账号事实派生公开汇总，保留原始观测时间

-use std::collections::BTreeMap;
+use std::collections::{BTreeMap, BTreeSet};

 use chrono::{DateTime, TimeDelta, Utc};
 use gateway_core::{
@@ -38,7 +38,7 @@ pub(super) fn pool_summary(
    for account in accounts {
        match status(account, runtime, now) {
            AccountStatus::Normal => summary.ready += 1,
-            AccountStatus::RateLimited => summary.cooldown += 1,
+            AccountStatus::QuotaPaused | AccountStatus::RateLimited => summary.cooldown += 1,
            AccountStatus::QuotaExhausted => summary.exhausted += 1,
            AccountStatus::Disabled => summary.disabled += 1,
            AccountStatus::Error => summary.error += 1,
@@ -67,6 +67,7 @@ pub(super) async fn quota_and_models(
    providers: &ProviderAdminRegistry,
    runtime: &AccountRuntimeSnapshot,
    models: &[gateway_core::routing::PublicModelId],
+    authorized: &[ProviderAccountId],
    now: DateTime<Utc>,
    max_response_bytes: usize,
 ) -> Result<(Vec<PeerAccountQuota>, Vec<PeerModelSummary>), super::PeerLinkError> {
@@ -151,6 +152,28 @@ pub(super) async fn quota_and_models(
                .collect(),
        });
    }
+    // 转供账号及发布窗口内消失的账号没有本地观测，只影响它们获准执行的模型
+    if accounts.len() != authorized.len() {
+        let exported = accounts
+            .iter()
+            .map(|account| account.id.as_str())
+            .collect::<BTreeSet<_>>();
+        let missing = authorized
+            .iter()
+            .filter(|id| !exported.contains(id.as_str()))
+            .collect::<Vec<_>>();
+        for (index, model) in models.iter().enumerate() {
+            if index % 16 == 0 {
+                tokio::task::yield_now().await;
+            }
+            if missing
+                .iter()
+                .any(|id| snapshot.allows_public_model_for_account(model, scope, id))
+            {
+                observations.entry(model.as_str()).or_default().incomplete = true;
+            }
+        }
+    }
    let summaries = models
        .iter()
        .map(|model| {
@@ -248,6 +271,7 @@ fn status(
 ) -> AccountStatus {
    resolve_account_status(
        &AccountStatusFacts {
+            quota_paused: account.quota_paused,
            enabled: account.enabled,
            credential_state: account.credential_state,
            access_token_expires_at: account.access_token_expires_at.map(Into::into),
@@ -56,7 +56,7 @@ impl PeerInfoService {
                            checked_at: now,
                            scheduling: None,
                            summary: None,
-                            unsupported: false,
+                            stored_failure: None,
                        },
                    ));
                }
@@ -92,19 +92,19 @@ impl PeerInfoService {
                    (
                        connection.clone(),
                        cached.and_then(|cached| cached.summary.clone()),
-                        cached.is_some_and(|cached| cached.unsupported),
+                        cached.and_then(|cached| cached.stored_failure),
                    )
                })
                .collect::<Vec<_>>()
        };
        Ok(summaries
            .into_iter()
-            .map(|(connection, peer, unsupported)| {
+            .map(|(connection, peer, stored_failure)| {
                let quota = Self::project_peer(
                    &connection,
                    peer.as_deref(),
-                    self.last_error(&connection)
-                        .or(unsupported.then_some(UpstreamInfoFailure::Unsupported)),
+                    stored_failure,
+                    self.last_error(&connection),
                    now,
                );
                (connection, quota)
@@ -135,8 +135,8 @@ impl PeerInfoService {
            checked_at: now,
            scheduling,
            summary,
-            unsupported: observation
-                .is_some_and(|value| snapshot::is_unsupported(&value.quota, connection)),
+            stored_failure: observation
+                .and_then(|value| snapshot::stored_failure(&value.quota, connection)),
        };
        let previous = self
            .observations
@@ -151,6 +151,9 @@ impl PeerInfoService {
            .read()
            .unwrap_or_else(std::sync::PoisonError::into_inner)
            .get(&connection.account_id)
-            .is_some_and(|cached| cached.connection == *connection && cached.unsupported)
+            .is_some_and(|cached| {
+                cached.connection == *connection
+                    && cached.stored_failure == Some(UpstreamInfoFailure::Unsupported)
+            })
    }
 }
@@ -25,6 +25,7 @@ use gateway_core::{
    error::StoreError,
    task::{WorkerContribution, WorkerDefinitionError},
 };
+pub(crate) use projection::account_capacity;
 use service::PeerInfoService;

 /// 组合根独立注册公共互联 Worker，不属于任何具体 Provider 的任务集合
@@ -62,6 +63,24 @@ pub fn initialize(

 #[async_trait::async_trait]
 impl PeerUpstreamService for PeerInfoService {
+    fn observed_concurrency_limit(
+        &self,
+        version: &gateway_core::account::QuotaObservationVersion,
+        now: std::time::SystemTime,
+    ) -> Option<gateway_core::account::AccountConcurrencyLimit> {
+        let observations = self
+            .observations
+            .read()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
+        let cached = observations.get(&version.account_id)?;
+        if cached.observed_at != Some(version.observed_at)
+            || cached.connection.credential_revision != version.credential_revision
+        {
+            return None;
+        }
+        cached.scheduling.as_ref()?.concurrency_limit(now)
+    }
+
    async fn account_changed(&self, id: &ProviderAccountId) -> Result<(), StoreError> {
        PeerInfoService::account_changed(self, id).await
    }
@@ -16,10 +16,31 @@ use gateway_protocol::peer::{PeerComponentStatus, PeerLink};

 use super::{PeerInfoService, quota, snapshot};

+pub(crate) fn account_capacity(
+    account: &crate::model::accounts::AccountRecord,
+    mut capacity: crate::model::accounts::AccountCapacity,
+    quota: &ProviderQuota,
+) -> crate::model::accounts::AccountCapacity {
+    if account.concurrency_limit.is_none()
+        && let Some(info) = &quota.upstream
+        && !info.stale
+        && info
+            .observed_at
+            .is_some_and(|at| snapshot::fresh_at(at.into(), SystemTime::now()))
+        && let Some(limit) = info
+            .max_concurrency
+            .and_then(gateway_core::account::AccountConcurrencyLimit::from_key_limit)
+    {
+        capacity.total_slots = Some(u64::from(limit.get()));
+    }
+    capacity
+}
+
 impl PeerInfoService {
    pub(super) fn project_peer(
        connection: &UpstreamConnection,
        peer: Option<&PeerLink>,
+        stored_failure: Option<UpstreamInfoFailure>,
        last_error: Option<UpstreamInfoFailure>,
        now: SystemTime,
    ) -> ProviderQuota {
@@ -29,12 +50,17 @@ impl PeerInfoService {
        let stale = peer.as_ref().is_none_or(|peer| {
            !snapshot::component_fresh(Some(&peer.observed_at), Some(&peer.expires_at), now)
        });
+        let limits = peer.and_then(|peer| peer.key_limits);
        let info = ProviderUpstreamInfo {
-            discovered: peer.is_some(),
+            discovered: snapshot::is_discovered(peer, stored_failure),
            observed_at,
            stale,
            connection_revision: connection.revision.clone(),
-            last_error: last_error.map(|error| error.as_str().to_owned()),
+            last_error: last_error
+                .or(stored_failure)
+                .map(|error| error.as_str().to_owned()),
+            max_concurrency: limits.and_then(|limits| limits.max_concurrency),
+            requests_per_minute: limits.and_then(|limits| limits.requests_per_minute),
            pool: peer
                .as_ref()
                .and_then(|peer| peer.pool.as_ref())
@@ -188,6 +214,7 @@ impl PeerInfoService {
            }
        }
        ProviderQuota {
+            paused_windows: Vec::new(),
            upstream: Some(info),
            plan_type: None,
            observed_at,
@@ -105,8 +105,8 @@ impl PeerInfoService {
        {
            let error = state.last_error;
            drop(state);
-            if let Some(error) = error.filter(|error| *error != UpstreamInfoFailure::Unsupported) {
-                return Err(refresh_error(error));
+            if let Some(error) = error.and_then(refresh_error) {
+                return Err(error);
            }
            return self
                .read_quota(id)
@@ -130,26 +130,39 @@ impl PeerInfoService {
        let failure = result.as_ref().err().copied();
        let delay = match failure {
            None => Duration::from_secs(240 + stable_jitter(id.as_str())),
-            Some(UpstreamInfoFailure::Unauthorized) => Duration::from_secs(1800),
+            Some(UpstreamInfoFailure::Unauthorized | UpstreamInfoFailure::SharingDisabled) => {
+                Duration::from_secs(1800)
+            }
            Some(_) => Duration::from_secs(30),
        }
        .max(retry_after.unwrap_or_default());
        state.next_attempt = Instant::now() + delay;
-        state.manual_after = Instant::now()
-            + (if failure.is_some_and(|error| error != UpstreamInfoFailure::Unsupported) {
-                delay
-            } else {
-                Duration::from_secs(15)
-            })
-            .max(retry_after.unwrap_or_default());
+        // 管理员修复授权后可主动复核，不继承自动重试的长退避，仍遵守上游限流
+        state.manual_after =
+            Instant::now() + Duration::from_secs(15).max(retry_after.unwrap_or_default());
        state.last_error = failure;
        let document = match result {
            Ok(document) => Some(document),
-            // 空观测清除已撤销内容，并用共有观察时间阻止更早请求重新写回
-            Err(UpstreamInfoFailure::Unauthorized) => {
-                Some(OpaqueProviderData::new(Default::default()))
-            }
            Err(UpstreamInfoFailure::Unsupported) => Some(snapshot::unsupported(&connection)),
+            Err(error @ UpstreamInfoFailure::SharingDisabled) => {
+                Some(snapshot::unavailable(&connection, error))
+            }
+            Err(error @ UpstreamInfoFailure::Unauthorized) => {
+                let discovered = self
+                    .read_summary(id)
+                    .await
+                    .map_err(store_error)?
+                    .and_then(|quota| quota.upstream)
+                    .is_some_and(|info| {
+                        info.connection_revision == connection.revision && info.discovered
+                    });
+                // 首次探测失败不能证明对方是互联节点；已确认的连接只留下无共享内容的识别记录
+                Some(if discovered {
+                    snapshot::unavailable(&connection, error)
+                } else {
+                    OpaqueProviderData::new(Default::default())
+                })
+            }
            Err(_) => None,
        };
        if let Some(document) = document {
@@ -157,6 +170,7 @@ impl PeerInfoService {
                .and_then(|peer| quota::observe(&peer, started_at, now))
                .unwrap_or(QuotaState::unknown());
            let observation = QuotaObservation {
+                quota_pause: None,
                expected_connection: Some(connection.clone()),
                account_id: id.clone(),
                expected_revision: connection.credential_revision,
@@ -190,8 +204,8 @@ impl PeerInfoService {
        }
        drop(state);
        // 不支持协议是正常发现结果，管理端保留分类，后台不重复报警
-        if let Some(error) = failure.filter(|error| *error != UpstreamInfoFailure::Unsupported) {
-            return Err(refresh_error(error));
+        if let Some(error) = failure.and_then(refresh_error) {
+            return Err(error);
        }
        self.read_quota(id)
            .await
@@ -206,12 +220,13 @@ fn stable_jitter(id: &str) -> u64 {
    }) % 60
 }

-fn refresh_error(error: UpstreamInfoFailure) -> ProviderAdminError {
-    ProviderAdminError::new(ProviderAdminErrorKind::BadGateway).with_public_message(match error {
+fn refresh_error(error: UpstreamInfoFailure) -> Option<ProviderAdminError> {
+    let message = match error {
        UpstreamInfoFailure::Unauthorized => "上游未授权读取互联信息",
-        UpstreamInfoFailure::Unsupported => "上游不支持互联信息查询",
+        UpstreamInfoFailure::Unsupported | UpstreamInfoFailure::SharingDisabled => return None,
        UpstreamInfoFailure::RateLimited => "上游互联查询已限流",
        UpstreamInfoFailure::InvalidResponse => "上游互联响应无效",
        UpstreamInfoFailure::Unavailable => "上游互联服务暂不可用",
-    })
+    };
+    Some(ProviderAdminError::new(ProviderAdminErrorKind::BadGateway).with_public_message(message))
 }
@@ -63,6 +63,7 @@ struct ModelObservation {

 pub(super) struct SchedulingObservation {
    validity: Validity,
+    concurrency_limit: Option<gateway_core::account::AccountConcurrencyLimit>,
    exhausted_budgets: Vec<Validity>,
    models: HashMap<String, Option<ModelObservation>>,
 }
@@ -166,43 +167,52 @@ impl SchedulingObservation {
        }
        Some(Self {
            validity,
+            concurrency_limit: peer
+                .key_limits
+                .and_then(|limits| limits.max_concurrency)
+                .and_then(gateway_core::account::AccountConcurrencyLimit::from_key_limit),
            exhausted_budgets,
            models,
        })
    }

    pub(super) fn fresh(&self, now: SystemTime) -> bool {
-        self.validity.fresh(now)
-            && now
-                .duration_since(self.validity.observed_at)
-                .unwrap_or_default()
-                <= snapshot::FRESH_FOR
+        self.validity.fresh(now) && snapshot::fresh_at(self.validity.observed_at, now)
    }

-    pub(super) fn signal(&self, model: &str, now: SystemTime) -> Option<UpstreamSchedulingSignal> {
+    pub(super) fn concurrency_limit(
+        &self,
+        now: SystemTime,
+    ) -> Option<gateway_core::account::AccountConcurrencyLimit> {
+        self.concurrency_limit.filter(|_| self.fresh(now))
+    }
+
+    pub(super) fn signal(
+        &self,
+        model: Option<&str>,
+        now: SystemTime,
+    ) -> Option<UpstreamSchedulingSignal> {
        if !self.fresh(now) {
            return None;
        }
-        if self
+        let budget_exhausted = self
            .exhausted_budgets
            .iter()
-            .any(|validity| validity.fresh(now))
-        {
-            return Some(UpstreamSchedulingSignal {
-                exhausted: true,
-                remaining_percent: None,
-            });
-        }
-        let model = self.models.get(model)?.as_ref()?;
-        if !model.validity.fresh(now) {
+            .any(|validity| validity.fresh(now));
+        let model = model
+            .and_then(|id| self.models.get(id)?.as_ref())
+            .filter(|model| model.validity.fresh(now));
+        if !budget_exhausted && model.is_none() && self.concurrency_limit.is_none() {
            return None;
        }
        Some(UpstreamSchedulingSignal {
-            exhausted: model.exhausted,
-            remaining_percent: model
-                .account
-                .as_ref()
-                .and_then(|account| account.remaining_percent(now)),
+            concurrency_limit: self.concurrency_limit,
+            exhausted: budget_exhausted || model.is_some_and(|model| model.exhausted),
+            remaining_percent: if budget_exhausted {
+                None
+            } else {
+                model.and_then(|model| model.account.as_ref()?.remaining_percent(now))
+            },
        })
    }
 }
@@ -34,7 +34,7 @@ pub(super) struct CachedObservation {
    pub checked_at: SystemTime,
    pub scheduling: Option<Arc<SchedulingObservation>>,
    pub summary: Option<Arc<PeerLink>>,
-    pub unsupported: bool,
+    pub stored_failure: Option<UpstreamInfoFailure>,
 }

 pub(crate) struct PeerInfoService {
@@ -172,17 +172,17 @@ impl PeerInfoService {
        let peer = observation
            .as_ref()
            .and_then(|value| snapshot::decode(&value.quota));
-        let unsupported = observation
+        let stored_failure = observation
            .as_ref()
-            .is_some_and(|value| snapshot::is_unsupported(&value.quota, &connection));
+            .and_then(|value| snapshot::stored_failure(&value.quota, &connection));
        if self.current_connection(id).await?.as_ref() != Some(&connection) {
            return Ok(None);
        }
        Ok(Some(Self::project_peer(
            &connection,
            peer.as_ref(),
-            self.last_error(&connection)
-                .or(unsupported.then_some(UpstreamInfoFailure::Unsupported)),
+            stored_failure,
+            self.last_error(&connection),
            SystemTime::now(),
        )))
    }
@@ -282,10 +282,25 @@ impl PeerInfoService {
 }

 impl UpstreamInfoSource for PeerInfoService {
+    fn is_peer(&self, account: &ProviderAccount) -> bool {
+        if !self.supported(account) {
+            return false;
+        }
+        let connection = UpstreamConnection::for_account(account);
+        self.observations
+            .read()
+            .unwrap_or_else(std::sync::PoisonError::into_inner)
+            .get(account.id())
+            .is_some_and(|cached| {
+                cached.connection == connection
+                    && snapshot::is_discovered(cached.summary.as_deref(), cached.stored_failure)
+            })
+    }
+
    fn signal(
        &self,
        account: &ProviderAccount,
-        model: &str,
+        model: Option<&str>,
        now: SystemTime,
    ) -> Option<UpstreamSchedulingSignal> {
        if !account.enabled() {
@@ -16,6 +16,10 @@ use serde::Deserialize as _;
 pub(super) const MAX_AGE: Duration = Duration::from_secs(30 * 60);
 pub(super) const FRESH_FOR: Duration = Duration::from_secs(5 * 60);

+pub(super) fn is_discovered(peer: Option<&PeerLink>, failure: Option<UpstreamInfoFailure>) -> bool {
+    peer.is_some() || failure == Some(UpstreamInfoFailure::Unauthorized)
+}
+
 // 不支持协议是连接的识别结果，复用观测存储与版本保护，不伪造上游额度快照
 pub(super) fn unsupported(connection: &UpstreamConnection) -> OpaqueProviderData {
    OpaqueProviderData::new(serde_json::Map::from_iter([
@@ -28,17 +32,42 @@ pub(super) fn unsupported(connection: &UpstreamConnection) -> OpaqueProviderData
    ]))
 }

-pub(super) fn is_unsupported(data: &OpaqueProviderData, connection: &UpstreamConnection) -> bool {
+// 授权撤销或共享关闭后只保存连接与失败原因，丢弃全部共享数据
+pub(super) fn unavailable(
+    connection: &UpstreamConnection,
+    reason: UpstreamInfoFailure,
+) -> OpaqueProviderData {
+    OpaqueProviderData::new(serde_json::Map::from_iter([
+        ("object".into(), "cpr.peer.unavailable".into()),
+        ("schema_version".into(), 1.into()),
+        (
+            "connection_revision".into(),
+            connection.revision.clone().into(),
+        ),
+        ("reason".into(), reason.as_str().into()),
+    ]))
+}
+
+pub(super) fn stored_failure(
+    data: &OpaqueProviderData,
+    connection: &UpstreamConnection,
+) -> Option<UpstreamInfoFailure> {
    let fields = data.expose_to_provider();
-    fields.get("object").and_then(serde_json::Value::as_str) == Some("cpr.peer.unsupported")
-        && fields
-            .get("schema_version")
-            .and_then(serde_json::Value::as_u64)
-            == Some(1)
-        && fields
-            .get("connection_revision")
-            .and_then(serde_json::Value::as_str)
-            == Some(connection.revision.as_str())
+    if fields.get("schema_version")?.as_u64()? != 1
+        || fields.get("connection_revision")?.as_str()? != connection.revision
+    {
+        return None;
+    }
+    match fields.get("object")?.as_str()? {
+        "cpr.peer.unsupported" => Some(UpstreamInfoFailure::Unsupported),
+        "cpr.peer.unavailable" => match fields.get("reason")?.as_str()? {
+            "unauthorized" => Some(UpstreamInfoFailure::Unauthorized),
+            "sharing_disabled" => Some(UpstreamInfoFailure::SharingDisabled),
+            "unsupported" => Some(UpstreamInfoFailure::Unsupported),
+            _ => None,
+        },
+        _ => None,
+    }
 }

 pub(super) fn timestamp(value: &str) -> Option<SystemTime> {
@@ -54,10 +83,12 @@ pub(super) fn datetime(value: &str) -> Option<DateTime<Utc>> {
 }

 pub(super) fn fresh(observed: &str, now: SystemTime) -> bool {
-    timestamp(observed).is_some_and(|observed| {
-        observed <= now + Duration::from_secs(60)
-            && now.duration_since(observed).unwrap_or_default() <= FRESH_FOR
-    })
+    timestamp(observed).is_some_and(|observed| fresh_at(observed, now))
+}
+
+pub(super) fn fresh_at(observed: SystemTime, now: SystemTime) -> bool {
+    observed <= now + Duration::from_secs(60)
+        && now.duration_since(observed).unwrap_or_default() <= FRESH_FOR
 }

 pub(super) fn component_fresh(
@@ -127,6 +158,9 @@ pub(super) fn parse(
    }
    // 未授权能力不能借同名数据块越过逐层公开边界
    let disclosed = |capability| peer.capabilities.iter().any(|value| value == capability);
+    if !disclosed("key_limits") {
+        peer.key_limits = None;
+    }
    if !disclosed("key_usage") {
        peer.usage = None;
    }
@@ -9,9 +9,10 @@ use crate::{
    model::{
        AdminError, MutationContext,
        client_keys::{
-            ClientKeyBudgetMutationOrigin, ClientKeyCursor, ClientKeyCursorValue,
-            ClientKeyListQuery, ClientKeyPageSize, ClientKeySort, ClientKeySortField,
-            ResetClientKeyBudget, SortDirection, UpdateClientKeyBudgetLimits,
+            ClientKeyBudgetMutationOrigin, ClientKeyBudgetWindow, ClientKeyBudgetWindowPeriod,
+            ClientKeyCursor, ClientKeyCursorValue, ClientKeyListQuery, ClientKeyPageSize,
+            ClientKeySort, ClientKeySortField, ResetClientKeyBudget, SetClientKeyBudgetWindow,
+            SortDirection, UpdateClientKeyBudgetLimits,
        },
        plugin_client_keys::{
            PluginClientKey, PluginClientKeyCursor, PluginClientKeyFacts, PluginClientKeyListQuery,
@@ -35,6 +36,29 @@ impl DefaultPluginClientKeyAccess {

 #[async_trait]
 impl PluginClientKeyAccess for DefaultPluginClientKeyAccess {
+    async fn budget_window(
+        &self,
+        id: &ClientApiKeyId,
+        period: ClientKeyBudgetWindowPeriod,
+    ) -> Result<ClientKeyBudgetWindow, AdminError> {
+        self.service.budget_window(id, period).await
+    }
+
+    async fn set_budget_window(
+        &self,
+        owner: &PluginResourceOwner,
+        command: SetClientKeyBudgetWindow,
+        context: &MutationContext,
+    ) -> Result<u64, AdminError> {
+        self.service
+            .set_budget_window(
+                context,
+                command,
+                ClientKeyBudgetMutationOrigin::Plugin(owner.clone()),
+            )
+            .await
+    }
+
    async fn facts(&self, id: &ClientApiKeyId) -> Result<PluginClientKeyFacts, AdminError> {
        let key = self.service.get(id).await?;
        Ok(PluginClientKeyFacts {
@@ -217,7 +217,7 @@ impl PluginsService {
                artifact_sha256: metadata.sha256.clone(),
                enabled: !configuration_required && compatible,
                configuration: configuration.clone(),
-                secrets: None,
+                secrets: Default::default(),
                bindings: bindings.clone(),
            };
            match self.configure_instance(None, input, context).await {
@@ -28,17 +28,16 @@ pub(super) fn same_creation_request(
    existing: &PluginInstance,
    input: &ConfigurePluginInstance,
 ) -> bool {
-    let same_secrets = input
+    let mut requested_secrets = input
        .secrets
-        .as_ref()
-        .map_or(existing.secrets.is_empty(), |secrets| {
-            secrets.len() == existing.secrets.len()
-                && secrets.iter().all(|(key, value)| {
-                    existing
-                        .secrets
-                        .get(key)
-                        .is_some_and(|current| current.expose_secret() == value.expose_secret())
-                })
+        .iter()
+        .filter_map(|(key, value)| value.as_ref().map(|value| (key, value)));
+    let same_secrets = requested_secrets.clone().count() == existing.secrets.len()
+        && requested_secrets.all(|(key, value)| {
+            existing
+                .secrets
+                .get(key)
+                .is_some_and(|current| current.expose_secret() == value.expose_secret())
        });
    existing.name == input.name.trim()
        && existing.artifact_sha256 == input.artifact_sha256
@@ -158,7 +158,6 @@ impl PluginsService {
        }
        let saved = if let Some(previous) = &existing
            && previous.artifact_sha256 != input.artifact_sha256
-            && input.secrets.is_none()
        {
            self.store
                .load_version_configuration(&previous.id, &input.artifact_sha256)
@@ -167,6 +166,21 @@ impl PluginsService {
        } else {
            None
        };
+        let mut secrets = saved.map(|saved| saved.secrets).unwrap_or_else(|| {
+            existing
+                .as_ref()
+                .map_or_else(Default::default, |instance| instance.secrets.clone())
+        });
+        for (name, value) in input.secrets {
+            match value {
+                Some(value) => {
+                    secrets.insert(name, value);
+                }
+                None => {
+                    secrets.remove(&name);
+                }
+            }
+        }
        let instance = PluginInstance {
            id: existing.as_ref().map_or_else(
                || {
@@ -182,14 +196,7 @@ impl PluginsService {
            enabled: input.enabled,
            trusted_process: true,
            configuration: input.configuration,
-            secrets: input
-                .secrets
-                .or_else(|| saved.map(|saved| saved.secrets))
-                .unwrap_or_else(|| {
-                    existing
-                        .as_ref()
-                        .map_or_else(Default::default, |instance| instance.secrets.clone())
-                }),
+            secrets,
            bindings: input.bindings,
            revision: candidate_revision,
        };
@@ -365,7 +365,8 @@ fn current_platform() -> Option<Platform> {
 fn target_environment_matches(target: &str) -> bool {
    match target {
        "x86_64-unknown-linux-gnu" | "aarch64-unknown-linux-gnu" => cfg!(target_env = "gnu"),
-        "aarch64-apple-darwin" => cfg!(target_os = "macos"),
+        "x86_64-apple-darwin" | "aarch64-apple-darwin" => cfg!(target_os = "macos"),
+        "x86_64-pc-windows-msvc" | "aarch64-pc-windows-msvc" => cfg!(target_env = "msvc"),
        _ => false,
    }
 }
@@ -385,6 +386,13 @@ const SUPPORTED_PLATFORMS: &[Platform] = &[
        runtime_os: "linux",
        runtime_architecture: "aarch64",
    },
+    Platform {
+        release_os: "darwin",
+        release_architecture: "amd64",
+        target: "x86_64-apple-darwin",
+        runtime_os: "macos",
+        runtime_architecture: "x86_64",
+    },
    Platform {
        release_os: "darwin",
        release_architecture: "arm64",
@@ -392,4 +400,18 @@ const SUPPORTED_PLATFORMS: &[Platform] = &[
        runtime_os: "macos",
        runtime_architecture: "aarch64",
    },
+    Platform {
+        release_os: "windows",
+        release_architecture: "amd64",
+        target: "x86_64-pc-windows-msvc",
+        runtime_os: "windows",
+        runtime_architecture: "x86_64",
+    },
+    Platform {
+        release_os: "windows",
+        release_architecture: "arm64",
+        target: "aarch64-pc-windows-msvc",
+        runtime_os: "windows",
+        runtime_architecture: "aarch64",
+    },
 ];
@@ -69,7 +69,7 @@ impl PluginsService {
            artifact_sha256: input.artifact_sha256,
            enabled: existing.enabled,
            configuration: saved.configuration,
-            secrets: Some(saved.secrets),
+            secrets: Default::default(),
            bindings: saved.bindings,
        };
        // 沿用同一份快照的 CAS 和状态迁移流程，不能在检查目标后重新读取并覆盖并发配置
@@ -202,7 +202,7 @@ impl PluginsService {
            artifact_sha256: input.artifact_sha256,
            enabled: existing.enabled,
            configuration: configuration.configuration,
-            secrets: Some(configuration.secrets),
+            secrets: Default::default(),
            bindings: configuration.bindings,
        };
        // 同一次读取的 CAS 覆盖草稿计算、准备与提交，不能覆盖并发设置
@@ -23,11 +23,51 @@ use crate::{
    },
    ports::{
        provider::ProviderAdminRegistry,
-        proxy::{ProxyProbe, ProxyStore},
+        proxy::{PluginProxyAccess, ProxyProbe, ProxyStore},
        store::AdminStoreErrorKind,
    },
 };

+pub(crate) struct DefaultPluginProxyAccess {
+    pub(crate) store: Arc<dyn ProxyStore>,
+}
+
+#[async_trait]
+impl PluginProxyAccess for DefaultPluginProxyAccess {
+    async fn list(&self, query: ProxyListQuery) -> Result<ProxyPage, AdminError> {
+        list_proxies(self.store.as_ref(), query).await
+    }
+
+    async fn resolve(&self, id: &str) -> Result<OutboundProxy, AdminError> {
+        if id.is_empty() || id.len() > 128 || id.chars().any(char::is_control) {
+            return Err(AdminError::invalid("代理 ID 不合法"));
+        }
+        let record = self
+            .store
+            .get(id)
+            .await
+            .map_err(|error| map_store_error(error, "proxy"))?;
+        // 显式选择代理时必须有可用配置，不能沿用账号停用代理后直连的语义
+        if !record.enabled {
+            return Err(AdminError::invalid("代理已禁用，请启用后再选择"));
+        }
+        Ok(record.proxy)
+    }
+}
+
+async fn list_proxies(
+    store: &dyn ProxyStore,
+    query: ProxyListQuery,
+) -> Result<ProxyPage, AdminError> {
+    if query.page == 0 || query.search.len() > 256 || query.search.chars().any(char::is_control) {
+        return Err(AdminError::invalid("代理查询参数不合法"));
+    }
+    store
+        .list(query)
+        .await
+        .map_err(|error| map_store_error(error, "proxy"))
+}
+
 #[async_trait]
 pub trait ProxiesService: Send + Sync {
    async fn create_batch(
@@ -268,14 +308,7 @@ impl ProxiesService for DefaultProxiesService {
    }

    async fn list(&self, query: ProxyListQuery) -> Result<ProxyPage, AdminError> {
-        if query.page == 0 || query.search.len() > 256 || query.search.chars().any(char::is_control)
-        {
-            return Err(AdminError::invalid("代理查询参数不合法"));
-        }
-        self.store
-            .list(query)
-            .await
-            .map_err(|error| map_store_error(error, "proxy"))
+        list_proxies(self.store.as_ref(), query).await
    }

    async fn create(
@@ -361,9 +394,10 @@ impl ProxiesService for DefaultProxiesService {
        proxy: Option<&OutboundProxy>,
        detect_location: bool,
    ) -> Result<ProxyTestResult, AdminError> {
-        let _permit = self.test_slots.try_acquire().map_err(|_| {
-            AdminError::new(AdminErrorKind::RateLimited, "代理测试繁忙，请稍后重试")
-        })?;
+        let _permit = self
+            .test_slots
+            .try_acquire()
+            .map_err(|_| AdminError::new(AdminErrorKind::RateLimited, "代理测试已达并发上限"))?;
        Ok(self.probe.test(proxy, detect_location).await)
    }

@@ -374,9 +408,10 @@ impl ProxiesService for DefaultProxiesService {
        detect_location: bool,
        context: &MutationContext,
    ) -> Result<ProxyRecord, AdminError> {
-        let _permit = self.test_slots.try_acquire().map_err(|_| {
-            AdminError::new(AdminErrorKind::RateLimited, "代理测试繁忙，请稍后重试")
-        })?;
+        let _permit = self
+            .test_slots
+            .try_acquire()
+            .map_err(|_| AdminError::new(AdminErrorKind::RateLimited, "代理测试已达并发上限"))?;
        let record = self
            .store
            .get(id)
@@ -252,7 +252,7 @@ impl SettingsService for DefaultSettingsService {
                    .is_some_and(|models| models.contains_key(model))
            })
        {
-            return Err(AdminError::invalid("内置价目不能删除，仅支持人工覆盖"));
+            return Err(AdminError::invalid("内置价目只能覆盖，不能删除"));
        }
        let defaults = gateway_core::metering::merge_pricing(catalog.defaults, &catalog.synced);
        let defaults = defaults.get(&command.provider);
@@ -332,24 +332,35 @@ impl SettingsService for DefaultSettingsService {
        configuration: Option<&gateway_core::account::OpaqueProviderData>,
    ) -> Result<gateway_core::account::OpaqueProviderData, AdminError> {
        let profile_provider = self.profile_provider(provider)?;
-        let global;
-        let (configuration, source) = if let Some(configuration) = configuration {
-            (configuration, "override")
+        let independent = configuration.filter(|key| {
+            gateway_core::settings::request_profiles::inherited_fields(key).is_none()
+        });
+        let preview = if let Some(key) = independent {
+            profile_provider.preview_key_client_profile(key, None)
        } else {
-            global = self
+            let global = self
                .load()
                .await?
                .client_profile(provider)
                .cloned()
                .or_else(|| profile_provider.default_client_profile())
                .ok_or_else(|| AdminError::internal("通用客户端身份尚未初始化"))?;
-            (&global, "global")
-        };
-        let mut preview = profile_provider
-            .preview_client_profile(configuration)
-            .map_err(|error| super::map_provider_error(error, "client profile"))?
-            .into_inner();
-        preview.insert("source".to_owned(), serde_json::Value::from(source));
+            if let Some(key) = configuration {
+                profile_provider.preview_key_client_profile(key, Some(&global))
+            } else {
+                profile_provider.preview_client_profile(&global)
+            }
+        }
+        .map_err(|error| super::map_provider_error(error, "client profile"))?;
+        let mut preview = preview.into_inner();
+        preview.insert(
+            "source".to_owned(),
+            serde_json::Value::from(if independent.is_some() {
+                "override"
+            } else {
+                "global"
+            }),
+        );
        Ok(gateway_core::account::OpaqueProviderData::new(preview))
    }

@@ -419,7 +430,7 @@ impl SettingsService for DefaultSettingsService {
                    crate::ports::store::AdminStoreErrorKind::Conflict
                        | crate::ports::store::AdminStoreErrorKind::StaleRevision
                ) {
-                    AdminError::conflict("运行设置已被其他调用修改，请重新读取并确认后提交")
+                    AdminError::conflict("运行设置已变更，请刷新核对后提交")
                } else {
                    map_store_error(error, "runtime settings")
                }
@@ -10,8 +10,8 @@ use crate::{
    model::{
        AdminError, AdminErrorKind,
        system::{
-            SystemOperationAccepted, SystemUpdateChannel, SystemUpdateDetail, SystemUpdateStatus,
-            SystemVersion,
+            SystemOperationAccepted, SystemUpdateChannel, SystemUpdateCheck, SystemUpdateDetail,
+            SystemUpdateStatus, SystemVersion,
        },
    },
    ports::system::{
@@ -25,7 +25,7 @@ pub trait SystemService: Send + Sync {
    async fn version(&self) -> Result<SystemVersion, AdminError>;
    async fn update_detail(
        &self,
-        refresh: bool,
+        check: SystemUpdateCheck,
        channel: Option<SystemUpdateChannel>,
    ) -> Result<SystemUpdateDetail, AdminError>;
    fn update_events(&self) -> SystemUpdateEventStream;
@@ -71,11 +71,11 @@ impl SystemService for DefaultSystemService {

    async fn update_detail(
        &self,
-        refresh: bool,
+        check: SystemUpdateCheck,
        channel: Option<SystemUpdateChannel>,
    ) -> Result<SystemUpdateDetail, AdminError> {
        self.operations
-            .update_detail(refresh, channel)
+            .update_detail(check, channel)
            .await
            .map_err(map_system_error)
    }
@@ -15,6 +15,11 @@ use std::sync::Arc;

 #[async_trait]
 pub trait UsageDataService: Send + Sync {
+    async fn open_read(
+        &self,
+        query: UsageReadQuery,
+        cancellation: gateway_core::lifecycle::CancellationToken,
+    ) -> UsageDataResult<Box<dyn UsageReadSession>>;
    async fn list_aggregates(
        &self,
        request: ListUsageAggregates,
@@ -58,6 +63,21 @@ impl DefaultUsageDataService {

 #[async_trait]
 impl UsageDataService for DefaultUsageDataService {
+    async fn open_read(
+        &self,
+        query: UsageReadQuery,
+        cancellation: gateway_core::lifecycle::CancellationToken,
+    ) -> UsageDataResult<Box<dyn UsageReadSession>> {
+        let filter = query.filter();
+        validation::query(&filter.records, None, None)?;
+        if let Some(group) = &filter.routing_group_ref {
+            validation::text(group, 128)?;
+        }
+        if !(1..=USAGE_READ_MAX_BATCH_ROWS).contains(&query.batch_size()) {
+            return Err(UsageDataError::invalid("读取批次条数应为 1 到 1024"));
+        }
+        self.store.open_read(query, cancellation).await
+    }
    async fn list_aggregates(
        &self,
        request: ListUsageAggregates,
@@ -7,7 +7,6 @@ use gateway_core::account::OpaqueProviderData;

 use gateway_admin::model::{
    PageSize, Revision,
-    accounts::AccountUsage,
    auth::LoginCommand,
    client_keys::ClientKeyPageSize,
    observability::{DecimalAmount, RequestOutcome, TimeRange},
@@ -107,6 +106,7 @@ fn provider_document_debug_should_not_expose_opaque_material() {
 #[test]
 fn representative_quota_should_prefer_short_window_and_highest_usage() {
    let quota = ProviderQuota {
+        paused_windows: Vec::new(),
        upstream: None,
        credits: None,
        plan_type: None,
@@ -130,6 +130,7 @@ fn representative_quota_should_prefer_account_wide_window_over_model_specific_wi
    let mut model_specific = quota_window("shortTerm", Some(18_000), Some(64.0));
    model_specific.local_usage_attribution = QuotaLocalUsageAttribution::Unavailable;
    let quota = ProviderQuota {
+        paused_windows: Vec::new(),
        upstream: None,
        credits: None,
        plan_type: None,
@@ -146,60 +147,10 @@ fn representative_quota_should_prefer_account_wide_window_over_model_specific_wi
    assert_eq!(quota.representative_used_percent(), Some(5.0));
 }

-#[test]
-fn usage_window_should_not_use_daily_rolling_usage_for_weekly_statistics() {
-    let usage = AccountUsage {
-        account_id: "acct_xai".to_owned(),
-        request_count: 5,
-        success_count: 5,
-        input_tokens: Some(100),
-        output_tokens: Some(20),
-        cached_input_tokens: Some(80),
-        cache_write_input_tokens: Some(0),
-        reasoning_output_tokens: Some(0),
-        image_input_tokens: Some(0),
-        image_output_tokens: Some(0),
-        image_request_count: 0,
-        image_request_failed_count: 0,
-        total_tokens: Some(120),
-        cost_coverage: Default::default(),
-        costs: Vec::new(),
-        last_used_at: Some(Utc::now()),
-        request_buckets: Vec::new(),
-        models: Vec::new(),
-    };
-    let quota = ProviderQuota {
-        upstream: None,
-        credits: None,
-        plan_type: None,
-        observed_at: None,
-        refresh_token_expires_at: None,
-        windows: vec![ProviderQuotaWindow {
-            upstream: None,
-            key: "free-rolling-24h".to_owned(),
-            group: "shortTerm".to_owned(),
-            label: "日限额".to_owned(),
-            limit_id: None,
-            limit_name: None,
-            role: None,
-            local_usage_attribution: QuotaLocalUsageAttribution::AccountWide,
-            window_seconds: Some(86_400),
-            used_percent: None,
-            reset_at: None,
-            limit_reached: false,
-            local_usage: Some(usage),
-            provider_data: None,
-        }],
-        limit_reached: false,
-        provider_data: None,
-    };
-
-    assert_eq!(quota.usage_window(), None);
-}
-
 #[test]
 fn exhausted_quota_should_project_full_usage_to_only_the_representative_window() {
    let mut quota = ProviderQuota {
+        paused_windows: Vec::new(),
        upstream: None,
        credits: None,
        plan_type: None,
@@ -230,6 +181,7 @@ fn exhausted_quota_should_preserve_the_provider_identified_reached_window() {
    let mut reached = quota_window("monthly", Some(2_592_000), Some(98.0));
    reached.limit_reached = true;
    let mut quota = ProviderQuota {
+        paused_windows: Vec::new(),
        upstream: None,
        credits: None,
        plan_type: None,
@@ -65,6 +65,36 @@ fn usage_window_should_not_fallback_to_short_daily_or_incomplete_windows() {
    assert_eq!(quota.usage_window(), None);
 }

+#[test]
+fn usage_window_should_preserve_provider_rolling_daily_statistics() {
+    let mut rolling = usage_window("rolling-day", "shortTerm", 86_400);
+    rolling.reset_at = None;
+    rolling.used_percent = None;
+    let mut quota = usage_quota(vec![rolling.clone()]);
+    assert_eq!(
+        selected_usage_window(&quota),
+        Some(("rolling-day", AccountUsagePeriod::Daily))
+    );
+
+    quota.limit_reached = true;
+    quota.apply_limit_reached_display();
+    assert_eq!(
+        selected_usage_window(&quota),
+        Some(("rolling-day", AccountUsagePeriod::Daily))
+    );
+
+    quota
+        .windows
+        .push(usage_window("week", "shortTerm", 7 * 86_400));
+    assert_eq!(
+        selected_usage_window(&quota),
+        Some(("week", AccountUsagePeriod::Weekly))
+    );
+
+    rolling.local_usage_attribution = QuotaLocalUsageAttribution::Unavailable;
+    assert_eq!(usage_quota(vec![rolling]).usage_window(), None);
+}
+
 #[test]
 fn usage_window_should_preserve_provider_order_for_equal_periods() {
    let quota = usage_quota(vec![
@@ -86,6 +116,7 @@ fn selected_usage_window(quota: &ProviderQuota) -> Option<(&str, AccountUsagePer

 fn usage_quota(windows: Vec<ProviderQuotaWindow>) -> ProviderQuota {
    ProviderQuota {
+        paused_windows: Vec::new(),
        upstream: None,
        credits: None,
        plan_type: None,
@@ -138,6 +169,7 @@ fn usage_window(key: &str, group: &str, seconds: u64) -> ProviderQuotaWindow {
 #[test]
 fn dashboard_quota_should_preserve_unknown_and_actual_window_facts() {
    let mut quota = ProviderQuota {
+        paused_windows: Vec::new(),
        upstream: None,
        credits: None,
        plan_type: None,
@@ -237,7 +269,8 @@ fn pending_mutation_v1_should_round_trip_all_targets_and_owners() {
                        gateway_core::account::OutboundProxy::parse(
                            "http://user:secret@proxy.example:8080",
                        )
-                        .unwrap(),
+                        .unwrap()
+                        .with_max_websocket_connections(16),
                    ))
                    .with_outbound_proxy_id(Some("proxy_saved".to_owned()));
                assert_eq!(
@@ -263,6 +296,27 @@ fn pending_mutation_v1_should_keep_existing_storage_fields_and_reject_invalid_do
    let restored =
        PendingAuthorizationMutation::from_storage_v1(legacy.clone()).expect("v1 document");
    assert_eq!(Value::Object(restored.to_storage_v1()), legacy);
+    let mut legacy_proxy = legacy.clone();
+    legacy_proxy["outbound_proxy_url"] = json!("socks5h://proxy.example.invalid:1080");
+    legacy_proxy["outbound_proxy_id"] = json!("proxy_saved");
+    let restored = PendingAuthorizationMutation::from_storage_v1(legacy_proxy.clone())
+        .expect("legacy proxy without a capacity field remains readable");
+    assert_eq!(
+        restored
+            .outbound_proxy()
+            .unwrap()
+            .max_websocket_connections(),
+        0
+    );
+    assert_eq!(Value::Object(restored.to_storage_v1()), legacy_proxy);
+    for invalid in [json!(-1), json!(4294967296_u64), json!("16")] {
+        let mut document = legacy_proxy.clone();
+        document["outbound_proxy_max_websocket_connections"] = invalid;
+        assert!(PendingAuthorizationMutation::from_storage_v1(document).is_err());
+    }
+    let mut missing_proxy = legacy.clone();
+    missing_proxy["outbound_proxy_max_websocket_connections"] = json!(16);
+    assert!(PendingAuthorizationMutation::from_storage_v1(missing_proxy).is_err());
    for (pointer, invalid) in [
        ("/provider_kind", json!("")),
        ("/target/account_id", json!("")),
@@ -59,6 +59,7 @@ fn window(key: &str, days: u64) -> ProviderQuotaWindow {

 fn quota(windows: Vec<ProviderQuotaWindow>) -> ProviderQuota {
    ProviderQuota {
+        paused_windows: Vec::new(),
        upstream: None,
        credits: None,
        plan_type: None,
@@ -162,7 +163,10 @@ fn source_selection_keeps_provider_order_with_the_maximum_window_count() {
 fn short_or_model_specific_windows_are_not_account_capacity() {
    let mut model = window("model", 7);
    model.local_usage_attribution = QuotaLocalUsageAttribution::Unavailable;
-    for item in forecast(&quota(vec![window("day", 1), model])) {
+    let mut rolling = window("rolling-day", 1);
+    rolling.reset_at = None;
+    rolling.used_percent = None;
+    for item in forecast(&quota(vec![window("day", 1), rolling, model])) {
        assert!(item.source.is_none());
        assert!(item.unavailable_reason.is_some());
        assert!(item.estimated_tokens.is_none());
@@ -373,9 +373,11 @@ fn group_record() -> AccountGroupRecord {

 fn member(account_id: &str, total_slots: u64) -> AccountGroupMemberFact {
    AccountGroupMemberFact {
+        inherited_version: None,
        group_id: group_id(),
        account_id: account_id.to_owned(),
        status: AccountStatusFacts {
+            quota_paused: false,
            enabled: true,
            credential_state: CredentialState::Ready,
            access_token_expires_at: None,
@@ -2,6 +2,7 @@

 mod reset_credit_automation;

+use gateway_core::engine::probe::AccountProbeTarget;
 use std::{
    collections::BTreeMap,
    sync::{Arc, Mutex},
@@ -713,6 +714,7 @@ impl FakeAccountStore {

    fn page_item(account: AccountRecord) -> AccountPageItem {
        let facts = AccountStatusFacts {
+            quota_paused: false,
            enabled: account.enabled,
            credential_state: account.credential_state,
            access_token_expires_at: account.access_token_expires_at.map(Into::into),
@@ -787,6 +789,7 @@ impl AccountStore for FakeAccountStore {
            summary: AccountSummary {
                total,
                normal: 1,
+                quota_paused: 0,
                quota_exhausted: 0,
                rate_limited: 0,
                disabled: 0,
@@ -1081,6 +1084,7 @@ impl AccountStore for FakeAccountStore {
    async fn batch_update_accounts(
        &self,
        command: BatchUpdateAccounts,
+        _: gateway_admin::model::accounts::PreparedQuotaPauses,
        context: &MutationContext,
    ) -> AdminStoreResult<AccountsUpdateResult> {
        self.record("store.batch_update_accounts");
@@ -1127,6 +1131,7 @@ impl AccountStore for FakeAccountStore {

 #[derive(Default)]
 struct StaticSettingsStore {
+    reset_credit_on_low_weekly_quota: bool,
    reset_credit_max_weekly_remaining_percent: Option<u32>,
 }

@@ -1165,7 +1170,9 @@ impl SettingsStore for StaticSettingsStore {
                max_concurrent_per_account: 1,
                max_waiting_per_key: 0,
                max_waiting_per_account: 0,
-                concurrency_wait_timeout_seconds: 30,
+                key_queue_timeout_seconds: 30,
+                account_queue_timeout_seconds: 30,
+                switch_account_on_queue_failure: false,
                max_retry_after_seconds: 240,
                openai_guardian_reserved_concurrency: 0,
                openai_account_affinity: gateway_core::account::AccountAffinity::Relaxed,
@@ -1180,9 +1187,10 @@ impl SettingsStore for StaticSettingsStore {
                audit_retention_days: 30,
                account_error_protection: gateway_core::account::AccountErrorProtection::default(),
                account_warmup_enabled: false,
-                account_warmup_schedule_time: "08:00".to_owned(),
+                account_warmup_cron: "0 8 * * *".to_owned(),
                account_warmup_model: None,
                reset_credit_lead_minutes: 10,
+                reset_credit_on_low_weekly_quota: self.reset_credit_on_low_weekly_quota,
                reset_credit_max_weekly_remaining_percent: self
                    .reset_credit_max_weekly_remaining_percent,
            },
@@ -1335,7 +1343,9 @@ async fn connection_test_should_probe_unavailable_account() {
    let events = services
        .accounts()
        .test_connection(
-            ProviderAccountId::new("acct_test").expect("account ID"),
+            AccountProbeTarget::ConnectionTest(
+                ProviderAccountId::new("acct_test").expect("account ID"),
+            ),
            gateway_core::routing::UpstreamModelId::new("grok-4.5").expect("model"),
        )
        .await
@@ -1372,7 +1382,9 @@ async fn connection_test_rate_limited_probe_returns_provider_failure() {
    let events = services
        .accounts()
        .test_connection(
-            ProviderAccountId::new("acct_test").expect("account ID"),
+            AccountProbeTarget::ConnectionTest(
+                ProviderAccountId::new("acct_test").expect("account ID"),
+            ),
            gateway_core::routing::UpstreamModelId::new("grok-4.5").expect("model"),
        )
        .await
@@ -1405,7 +1417,9 @@ async fn connection_test_should_preserve_disabled_account_status() {
    let events = services
        .accounts()
        .test_connection(
-            ProviderAccountId::new("acct_test").expect("account ID"),
+            AccountProbeTarget::ConnectionTest(
+                ProviderAccountId::new("acct_test").expect("account ID"),
+            ),
            gateway_core::routing::UpstreamModelId::new("grok-4.5").expect("model"),
        )
        .await
@@ -1899,6 +1913,8 @@ async fn accounts_batch_update_should_commit_once_and_notify_each_provider() {
        .batch_update(
            &context("batch-update-request"),
            BatchUpdateAccounts {
+                quota_limits: None,
+                auto_use_quota_credits: None,
                model_access: Default::default(),
                outbound_proxy: None,
                account_ids: vec!["acct_openai".to_owned(), "acct_xai".to_owned()],
@@ -2066,6 +2082,7 @@ async fn accounts_list_should_degrade_quota_failure_to_empty_window_without_drop
    let events = events();
    let openai = FakeProviderAdmin::new("openai", events.clone());
    openai.set_quota(ProviderQuota {
+        paused_windows: Vec::new(),
        upstream: None,
        credits: None,
        plan_type: None,
@@ -2226,6 +2243,7 @@ async fn accounts_list_should_map_unknown_credential_to_error_not_normal() {
 async fn accounts_list_should_not_derive_rate_limited_from_provider_quota_view() {
    let provider = FakeProviderAdmin::new("openai", events());
    provider.set_quota(ProviderQuota {
+        paused_windows: Vec::new(),
        upstream: None,
        credits: None,
        plan_type: None,
@@ -2277,6 +2295,7 @@ async fn accounts_list_should_not_derive_rate_limited_from_provider_quota_view()
 async fn accounts_list_should_not_derive_exhaustion_from_provider_quota_view() {
    let provider = FakeProviderAdmin::new("openai", events());
    provider.set_quota(ProviderQuota {
+        paused_windows: Vec::new(),
        upstream: None,
        credits: None,
        plan_type: None,
@@ -2686,12 +2705,15 @@ async fn peer_account_usage_should_follow_budget_windows_without_borrowing_pool_
    for longest in [86_400, 604_800] {
        let provider = FakeProviderAdmin::new("openai", events());
        let mut account = account_record("openai");
+        account.concurrency_limit = None;
        account.authentication_kind = "api_key".to_owned();
        account.created_at = Utc::now() - TimeDelta::days(60);
        let store = FakeAccountStore::with_account(account, events());
        let reset_at = Utc::now() + TimeDelta::hours(1);
        let mut quota = empty_quota();
        quota.upstream = Some(ProviderUpstreamInfo {
+            max_concurrency: Some(7),
+            requests_per_minute: Some(60),
            discovered: true,
            observed_at: Some(Utc::now()),
            stale: false,
@@ -2762,6 +2784,8 @@ async fn peer_account_usage_should_follow_budget_windows_without_borrowing_pool_
            page.items[0].usage.as_ref().unwrap().total_tokens,
            Some(1_234)
        );
+        assert_eq!(page.items[0].capacity.total_slots, Some(7));
+        assert_eq!(page.items[0].account.concurrency_limit, None);
        let queries = store.quota_window_queries();
        assert_eq!(queries.len(), window_usage.len());
        for (query, expected) in queries.iter().zip(&window_usage) {
@@ -2878,6 +2902,7 @@ async fn accounts_list_should_attach_local_usage_to_quota_windows() {
    let provider = FakeProviderAdmin::new("openai", events());
    let reset_at = Utc::now() + TimeDelta::hours(1);
    provider.set_quota(ProviderQuota {
+        paused_windows: Vec::new(),
        upstream: None,
        credits: None,
        plan_type: None,
@@ -3042,6 +3067,7 @@ async fn accounts_list_should_not_attach_account_usage_to_model_specific_quota_w
    let provider = FakeProviderAdmin::new("openai", events());
    let reset_at = Utc::now() + TimeDelta::days(7);
    provider.set_quota(ProviderQuota {
+        paused_windows: Vec::new(),
        upstream: None,
        credits: None,
        plan_type: None,
@@ -3347,6 +3373,7 @@ pub(super) fn document() -> ProviderDocument {

 fn empty_quota() -> ProviderQuota {
    ProviderQuota {
+        paused_windows: Vec::new(),
        upstream: None,
        credits: None,
        plan_type: None,
@@ -3384,6 +3411,9 @@ fn quota_local_usage(account_id: &str, total_tokens: u64) -> AccountUsage {
 pub(super) fn account_record(kind: &str) -> AccountRecord {
    let now = Utc::now();
    AccountRecord {
+        quota_paused: false,
+        quota_limits: Default::default(),
+        auto_use_quota_credits: false,
        outbound_proxy_id: None,
        outbound_proxy_enabled: true,
        notes: None,
@@ -231,6 +231,8 @@ fn plan(expires_at: chrono::DateTime<Utc>) -> ResetCreditAutomation {
        revision: 1,
        next_run_at: Utc::now(),
        state: ResetCreditAutomationState {
+            next_weekly_check_at: None,
+            awaiting_weekly_recovery_since: None,
            next_discovery_at: Utc::now() + TimeDelta::days(1),
            credits: vec![PlannedResetCredit {
                id: "card_1".into(),
@@ -309,7 +311,7 @@ async fn automation_restores_pending_idempotency_after_service_restart() {
        .state
        .retry_at = Some(Utc::now() - TimeDelta::seconds(1));
    drop(services);
-    let restarted = threshold_services(provider.clone(), store.clone(), Some(0)).await;
+    let restarted = threshold_services(provider.clone(), store.clone(), Some(0), true).await;
    restarted
        .accounts()
        .reconcile_reset_credit_automation(account_id)
@@ -712,10 +714,12 @@ async fn threshold_services(
    provider: Arc<FakeProviderAdmin>,
    store: Arc<FakeAccountStore>,
    max_remaining: Option<u32>,
+    early: bool,
 ) -> AdminServices {
    super::super::AdminHarness::new()
        .accounts(store)
        .settings(Arc::new(StaticSettingsStore {
+            reset_credit_on_low_weekly_quota: early,
            reset_credit_max_weekly_remaining_percent: max_remaining,
        }))
        .provider(provider)
@@ -783,7 +787,7 @@ async fn automation_weekly_threshold_is_optional_inclusive_and_uses_remaining_qu
        let store = FakeAccountStore::new("openai", events());
        schedule_due_credit(&provider, &store);
        provider.set_quota(weekly_quota(used));
-        let services = threshold_services(provider.clone(), store.clone(), threshold).await;
+        let services = threshold_services(provider.clone(), store.clone(), threshold, false).await;
        services
            .accounts()
            .reconcile_reset_credit_automation(ProviderAccountId::new("acct_test").unwrap())
@@ -825,7 +829,7 @@ async fn automation_retains_skipped_credit_and_refreshes_quota_on_next_attempt()
    let store = FakeAccountStore::new("openai", events());
    schedule_due_credit(&provider, &store);
    provider.set_quota(weekly_quota(10.0));
-    let services = threshold_services(provider.clone(), store.clone(), Some(70)).await;
+    let services = threshold_services(provider.clone(), store.clone(), Some(70), false).await;
    let id = ProviderAccountId::new("acct_test").unwrap();
    services
        .accounts()
@@ -897,7 +901,7 @@ async fn automation_defers_missing_invalid_or_failed_weekly_quota() {
        schedule_due_credit(&provider, &store);
        provider.set_quota(quota);
        *provider.quota_failure.lock().unwrap() = failure;
-        let services = threshold_services(provider.clone(), store.clone(), Some(70)).await;
+        let services = threshold_services(provider.clone(), store.clone(), Some(70), false).await;
        let result = services
            .accounts()
            .reconcile_reset_credit_automation(ProviderAccountId::new("acct_test").unwrap())
@@ -971,3 +975,256 @@ async fn automation_nothing_to_reset_retains_credit_and_retries_with_a_new_key()
            .is_empty()
    );
 }
+
+#[tokio::test]
+async fn early_use_checks_only_known_cards_and_confirms_low_quota_before_spending() {
+    for (enabled, threshold, used, expiring, expected) in [
+        (false, Some(10), 100.0, false, false),
+        (true, None, 99.9, true, false),
+        (true, None, 100.0, false, true),
+        (true, Some(10), 90.0, false, true),
+        (true, Some(100), 0.0, false, false),
+    ] {
+        let provider = FakeProviderAdmin::new("openai", events());
+        let store = FakeAccountStore::new("openai", events());
+        enable_capability(&provider);
+        let expiry = Utc::now()
+            + if expiring {
+                TimeDelta::minutes(5)
+            } else {
+                TimeDelta::days(3)
+            };
+        provider.reset_credits.lock().unwrap().push(card(expiry));
+        let mut record = plan(expiry);
+        let credits = std::mem::take(&mut record.state.credits);
+        store
+            .automations
+            .lock()
+            .unwrap()
+            .insert("acct_test".into(), record);
+        let services =
+            threshold_services(provider.clone(), store.clone(), threshold, enabled).await;
+        let id = ProviderAccountId::new("acct_test").unwrap();
+        provider.set_quota(weekly_quota(used));
+        services
+            .accounts()
+            .reconcile_reset_credit_automation(id.clone())
+            .await
+            .unwrap();
+        assert!(provider.quota_requests().is_empty());
+        let no_card = store
+            .reset_credit_automation("acct_test")
+            .await
+            .unwrap()
+            .unwrap();
+        assert_eq!(no_card.next_run_at, no_card.state.next_discovery_at);
+        store
+            .automations
+            .lock()
+            .unwrap()
+            .get_mut("acct_test")
+            .unwrap()
+            .state
+            .credits = credits;
+        services
+            .accounts()
+            .reconcile_reset_credit_automation(id)
+            .await
+            .unwrap();
+        assert_eq!(
+            provider.reset_credit_commands().len(),
+            usize::from(expected)
+        );
+        let status = services
+            .accounts()
+            .reset_credit_automation_status(ProviderAccountId::new("acct_test").unwrap())
+            .await
+            .unwrap();
+        assert_eq!(
+            status.weekly_trigger_remaining_percent,
+            enabled.then_some(threshold.unwrap_or(0))
+        );
+        if enabled {
+            assert!(status.next_consume_at.is_none());
+        }
+        let requests = provider.quota_requests();
+        assert_eq!(
+            requests.iter().filter(|r| !r.refresh).count(),
+            usize::from(enabled)
+        );
+        assert_eq!(requests.iter().any(|r| r.refresh), expected);
+        if enabled && !expected {
+            assert!(
+                store
+                    .reset_credit_automation("acct_test")
+                    .await
+                    .unwrap()
+                    .unwrap()
+                    .next_run_at
+                    <= Utc::now() + TimeDelta::seconds(90)
+            );
+        }
+    }
+}
+
+#[tokio::test]
+async fn early_use_rechecks_live_quota_and_waits_for_a_new_recovery_after_restart() {
+    let provider = FakeProviderAdmin::new("openai", events());
+    let store = FakeAccountStore::new("openai", events());
+    enable_capability(&provider);
+    let expiry = Utc::now() + TimeDelta::days(3);
+    let mut later = card(expiry + TimeDelta::days(1));
+    later.id = "later".into();
+    *provider.reset_credits.lock().unwrap() = vec![later, card(expiry)];
+    store
+        .automations
+        .lock()
+        .unwrap()
+        .insert("acct_test".into(), plan(expiry));
+    let id = ProviderAccountId::new("acct_test").unwrap();
+    let services = threshold_services(provider.clone(), store.clone(), Some(10), true).await;
+    let high = ProviderQuota {
+        observed_at: Some(Utc::now()),
+        ..weekly_quota(15.0)
+    };
+    provider.set_quota(weekly_quota(90.0));
+    let (release, gate) = tokio::sync::oneshot::channel();
+    *provider.reset_credit_query_gate.lock().unwrap() = Some(gate);
+    let (result, ()) = tokio::join!(
+        services
+            .accounts()
+            .reconcile_reset_credit_automation(id.clone()),
+        async {
+            tokio::time::timeout(
+                std::time::Duration::from_secs(2),
+                provider.reset_credit_query_started.notified(),
+            )
+            .await
+            .unwrap();
+            provider.set_quota(high.clone());
+            release.send(()).unwrap();
+        }
+    );
+    result.unwrap();
+    assert!(provider.reset_credit_commands().is_empty());
+
+    advance_retry(&store);
+    provider.set_quota(weekly_quota(95.0));
+    services
+        .accounts()
+        .reconcile_reset_credit_automation(id.clone())
+        .await
+        .unwrap();
+    let commands = provider.reset_credit_commands();
+    assert_eq!(commands.len(), 1);
+    assert_eq!(commands[0].credit_id.as_deref(), Some("card_1"));
+    provider
+        .reset_credits
+        .lock()
+        .unwrap()
+        .retain(|credit| credit.id != "card_1");
+
+    let services = threshold_services(provider.clone(), store.clone(), Some(10), true).await;
+    for quota in [weekly_quota(95.0), high, weekly_quota(95.0)] {
+        provider.set_quota(quota);
+        services
+            .accounts()
+            .reconcile_reset_credit_automation(id.clone())
+            .await
+            .unwrap();
+    }
+    assert_eq!(provider.reset_credit_commands().len(), 1);
+    provider.set_quota(ProviderQuota {
+        observed_at: Some(Utc::now()),
+        ..weekly_quota(20.0)
+    });
+    services
+        .accounts()
+        .reconcile_reset_credit_automation(id.clone())
+        .await
+        .unwrap();
+    provider.set_quota(weekly_quota(100.0));
+    services
+        .accounts()
+        .reconcile_reset_credit_automation(id)
+        .await
+        .unwrap();
+    let commands = provider.reset_credit_commands();
+    assert_eq!(commands.len(), 2);
+    assert_eq!(commands[1].credit_id.as_deref(), Some("later"));
+}
+
+#[tokio::test]
+async fn weekly_recovery_is_observed_without_cards_after_a_failed_quota_readback() {
+    let events = events();
+    let provider = FakeProviderAdmin::new("openai", events.clone());
+    enable_capability(&provider);
+    let store = FakeAccountStore::new("openai", events.clone());
+    let expiry = Utc::now() + TimeDelta::days(3);
+    let mut record = plan(expiry);
+    record.state.pending = Some(PendingResetCredit {
+        credit: record.state.credits[0].clone(),
+        redeem_request_id: uuid::Uuid::new_v4().to_string(),
+    });
+    store
+        .automations
+        .lock()
+        .unwrap()
+        .insert("acct_test".into(), record);
+    let id = ProviderAccountId::new("acct_test").unwrap();
+    let services = threshold_services(provider.clone(), store.clone(), Some(10), true).await;
+    let accounts = services.accounts();
+    *provider.quota_failure.lock().unwrap() = Some(ProviderAdminErrorKind::Unavailable);
+    accounts
+        .reconcile_reset_credit_automation(id.clone())
+        .await
+        .unwrap();
+    let waiting = store
+        .reset_credit_automation("acct_test")
+        .await
+        .unwrap()
+        .unwrap();
+    assert!(waiting.state.credits.is_empty());
+    assert_eq!(waiting.state.last_result.as_deref(), Some("reset"));
+    assert!(waiting.next_run_at <= Utc::now() + TimeDelta::seconds(90));
+
+    provider.set_quota(ProviderQuota {
+        observed_at: Some(Utc::now()),
+        ..weekly_quota(20.0)
+    });
+    accounts
+        .reconcile_reset_credit_automation(id.clone())
+        .await
+        .unwrap();
+    let recovered = store
+        .reset_credit_automation("acct_test")
+        .await
+        .unwrap()
+        .unwrap();
+    assert_eq!(recovered.next_run_at, recovered.state.next_discovery_at);
+    assert!(!recorded(&events).contains(&"provider.reset_credits"));
+    assert_eq!(
+        provider
+            .quota_requests()
+            .iter()
+            .map(|r| r.refresh)
+            .collect::<Vec<_>>(),
+        [true, false]
+    );
+
+    provider.set_quota(weekly_quota(95.0));
+    let mut new_card = card(expiry);
+    new_card.id = "next".into();
+    provider.reset_credits.lock().unwrap().push(new_card);
+    accounts
+        .reset_credits(&context("new-card"), id.clone())
+        .await
+        .unwrap();
+    accounts
+        .reconcile_reset_credit_automation(id)
+        .await
+        .unwrap();
+    let commands = provider.reset_credit_commands();
+    assert_eq!(commands.len(), 2);
+    assert_eq!(commands[1].credit_id.as_deref(), Some("next"));
+}
@@ -35,6 +35,32 @@ struct TestClientKeyStore {

 #[async_trait]
 impl ClientKeyStore for TestClientKeyStore {
+    async fn client_key_budget_window(
+        &self,
+        _: &gateway_core::policy::ClientApiKeyId,
+        _: gateway_admin::model::client_keys::ClientKeyBudgetWindowPeriod,
+    ) -> gateway_admin::ports::store::AdminStoreResult<
+        gateway_admin::model::client_keys::ClientKeyBudgetWindow,
+    > {
+        Err(gateway_admin::ports::store::AdminStoreError::new(
+            gateway_admin::ports::store::AdminStoreErrorKind::Unavailable,
+            "client key",
+            "unused budget window",
+        ))
+    }
+    async fn set_client_key_budget_window(
+        &self,
+        _: gateway_admin::model::client_keys::SetClientKeyBudgetWindow,
+        _: gateway_admin::model::client_keys::ClientKeyBudgetMutationOrigin,
+        _: &MutationContext,
+    ) -> gateway_admin::ports::store::AdminStoreResult<u64> {
+        Err(gateway_admin::ports::store::AdminStoreError::new(
+            gateway_admin::ports::store::AdminStoreErrorKind::Unavailable,
+            "client key",
+            "unused budget window",
+        ))
+    }
+
    async fn update_client_key_budget_limits(
        &self,
        _: gateway_admin::model::client_keys::UpdateClientKeyBudgetLimits,
@@ -140,10 +140,14 @@ impl PendingPeer {
 }

 impl UpstreamInfoSource for PendingPeer {
+    fn is_peer(&self, _: &ProviderAccount) -> bool {
+        false
+    }
+
    fn signal(
        &self,
        _: &ProviderAccount,
-        _: &str,
+        _: Option<&str>,
        _: std::time::SystemTime,
    ) -> Option<UpstreamSchedulingSignal> {
        None
@@ -152,6 +156,14 @@ impl UpstreamInfoSource for PendingPeer {

 #[async_trait]
 impl PeerUpstreamService for PendingPeer {
+    fn observed_concurrency_limit(
+        &self,
+        _: &gateway_core::account::QuotaObservationVersion,
+        _: std::time::SystemTime,
+    ) -> Option<gateway_core::account::AccountConcurrencyLimit> {
+        None
+    }
+
    async fn account_changed(&self, id: &ProviderAccountId) -> Result<(), StoreError> {
        self.changed.lock().unwrap().push(id.as_str().into());
        Ok(())
--- a/Show More
+++ b/Show More