Merge branch 'master' into codex/puzzle-clear-template-runtime-fixes

# Conflicts:
#	.hermes/shared-memory/decision-log.md
#	.hermes/shared-memory/project-overview.md
#	docs/【开发运维】本地开发验证与生产运维-2026-05-15.md
#	scripts/dev.test.ts
#	server-rs/crates/api-server/src/creation_entry_config.rs
#	server-rs/crates/api-server/src/wooden_fish.rs
#	server-rs/crates/module-auth/src/lib.rs
#	server-rs/crates/spacetime-client/src/wooden_fish.rs
#	server-rs/crates/spacetime-module/src/auth/procedures.rs
#	src/components/custom-world-home/creationWorkShelf.ts
#	src/components/platform-entry/PlatformEntryFlowShellImpl.tsx
#	src/components/rpg-entry/rpgEntryWorldPresentation.ts
#	src/services/miniGameDraftGenerationProgress.test.ts
#	src/services/miniGameDraftGenerationProgress.ts

server-rs/crates/spacetime-module/src/auth/procedures.rs

@@ -454,7 +454,6 @@ fn export_auth_store_snapshot_from_tables_tx(
         .meta_id()
         .find(&AUTH_STORE_PROJECTION_META_ID.to_string())
         .map(|row| row.updated_at.to_micros_since_unix_epoch());
-
     let snapshot = build_auth_store_snapshot_from_rows(users, identities, sessions)?;
     if let Some(updated_at_micros) = updated_at_micros {
         upsert_auth_store_snapshot_rows(ctx, &snapshot, updated_at_micros)?;
@@ -485,6 +484,7 @@ fn build_auth_store_snapshot_from_rows(
         if !valid_user_ids.contains(&identity.user_id) {
             continue;
         }
+
         match identity.provider.as_str() {
             "phone" => {
                 let phone_number = identity
@@ -558,6 +558,10 @@ fn build_auth_store_snapshot_from_rows(
     let mut sessions_by_id = std::collections::HashMap::new();
     let mut session_id_by_refresh_token_hash = std::collections::HashMap::new();
     for session in sessions {
+        if !valid_user_ids.contains(&session.user_id) {
+            continue;
+        }
+
         let client_info = serde_json::from_str::<serde_json::Value>(&session.client_info_json)
             .map_err(|error| format!("refresh session 客户端信息 JSON 解析失败：{error}"))?;
         session_id_by_refresh_token_hash.insert(
@@ -712,10 +716,9 @@ mod tests {
 
     #[test]
     fn auth_store_snapshot_user_row_key_is_stable_after_username_change() {
-        let mut before = sample_snapshot();
+        let before = sample_snapshot();
         let mut after = sample_snapshot();
-        after.users_by_username.clear();
-        let mut renamed_user = before
+        let mut renamed_user = after
             .users_by_username
             .remove("phone_42")
             .expect("sample user exists");