diff --git a/apps/admin-web/src/pages/AdminDashboardPage.test.tsx b/apps/admin-web/src/pages/AdminDashboardPage.test.tsx
index 1951814b6..2c5164ecf 100644
--- a/apps/admin-web/src/pages/AdminDashboardPage.test.tsx
+++ b/apps/admin-web/src/pages/AdminDashboardPage.test.tsx
@@ -93,6 +93,21 @@ test('Dashboard 默认加载今日指标并支持运营汇总页签', async () =
   expect(screen.getByText('访问模块分布')).toBeTruthy();
 });
 
+test('Dashboard 默认日期使用北京时间', async () => {
+  vi.setSystemTime(new Date('2026-06-26T17:30:00Z'));
+
+  render(<AdminDashboardPage token="admin-token" onUnauthorized={vi.fn()} />);
+
+  await waitFor(() => {
+    expect(getAdminDashboard).toHaveBeenLastCalledWith('admin-token', {
+      granularity: 'period',
+      anchor: undefined,
+      startDate: '2026-06-27',
+      endDate: '2026-06-27',
+    });
+  });
+});
+
 test('Dashboard 选择本周时按今天填充整周范围', async () => {
   const user = setupUser();
   render(<AdminDashboardPage token="admin-token" onUnauthorized={vi.fn()} />);
diff --git a/apps/admin-web/src/pages/AdminDashboardPage.tsx b/apps/admin-web/src/pages/AdminDashboardPage.tsx
index 88fd78a15..d4f393504 100644
--- a/apps/admin-web/src/pages/AdminDashboardPage.tsx
+++ b/apps/admin-web/src/pages/AdminDashboardPage.tsx
@@ -36,7 +36,7 @@ export function AdminDashboardPage({
   const [granularity, setGranularity] =
     useState<AdminDashboardGranularity>('day');
   const [dateRange, setDateRange] = useState(() => {
-    const today = formatDateInput(new Date());
+    const today = formatBeijingDateInput(new Date());
     return { startDate: today, endDate: today };
   });
   const [activeTab, setActiveTab] = useState<AdminDashboardTab>('metrics');
@@ -327,7 +327,7 @@ export function AdminDashboardPage({
   ) {
     const nextRange = buildPresetDateRange(
       nextGranularity,
-      formatDateInput(new Date()),
+      formatBeijingDateInput(new Date()),
     );
     const rangeChanged =
       nextRange.startDate !== dateRange.startDate ||
@@ -450,11 +450,13 @@ function formatNumber(value: number) {
   return new Intl.NumberFormat('zh-CN').format(value);
 }
 
-function formatDateInput(date: Date) {
-  const year = date.getFullYear();
-  const month = String(date.getMonth() + 1).padStart(2, '0');
-  const day = String(date.getDate()).padStart(2, '0');
-  return `${year}-${month}-${day}`;
+function formatBeijingDateInput(date: Date) {
+  return new Intl.DateTimeFormat('en-CA', {
+    timeZone: 'Asia/Shanghai',
+    year: 'numeric',
+    month: '2-digit',
+    day: '2-digit',
+  }).format(date);
 }
 
 function rangePrefix(granularity: AdminDashboardGranularity) {
@@ -474,7 +476,7 @@ function buildPresetDateRange(
   granularity: AdminDashboardGranularity,
   selectedDate: string,
 ) {
-  const fallbackDate = formatDateInput(new Date());
+  const fallbackDate = formatBeijingDateInput(new Date());
   const anchor = parseDateValueAsUtc(selectedDate)
     ? selectedDate
     : fallbackDate;
diff --git a/docs/project-memory/shared-memory/pitfalls.md b/docs/project-memory/shared-memory/pitfalls.md
index e12ac6eb7..1f917b8d4 100644
--- a/docs/project-memory/shared-memory/pitfalls.md
+++ b/docs/project-memory/shared-memory/pitfalls.md
@@ -62,6 +62,14 @@
 - 验证：画板生成 workflow 测试覆盖 queueState 持续 `running` 到前端等待窗口结束时，不进入 failed、不显示该排队文案、不添加本地临时结果层。
 - 关联：`src/components/image-editor/useImageCanvasGenerationSubmissionWorkflow.ts`、`src/components/image-editor/useImageCanvasGenerationSubmissionWorkflow.test.tsx`。
 
+## 画板参考图 objectKey 必须先做归属校验
+
+- 现象：画板生成、快速编辑、图标素材或 UI 素材提取如果允许直接提交 generated objectKey，用户只要知道其他账号的私有 objectKey，就可能让 api-server 签名读取并送给外部生成供应商。
+- 原因：Data URL 参考图可以直接解析，但 objectKey 是服务端私有对象引用；只校验 generated 前缀、mime 和大小不能证明它属于当前账号。
+- 处理：所有编辑器参考图入口统一走 `parse_editor_reference_image(state, owner_user_id, source)`；objectKey 分支必须先在当前账号的项目资源、素材库资产或 `asset_object` 中匹配 owner / bucket / key，再读取 OSS。快速编辑和图标素材额外参考图也必须真实传到 provider，不只写 metadata。
+- 验证：`cargo test -p api-server --manifest-path server-rs/Cargo.toml editor_reference`，并用前端 workflow 测试覆盖 `referenceImageSrcs` 进入快速编辑 / 图标生成请求。
+- 关联：`server-rs/crates/api-server/src/editor_project.rs`、`server-rs/crates/spacetime-client/src/assets.rs`、`src/components/image-editor/useImageCanvasGenerationSubmissionWorkflow.ts`。
+
 ## 编辑器生成按钮显示泥点后仍要查真实钱包预扣
 
 - 现象：画板生成按钮显示 `N泥点`，后端也能按模型配置计算出价格，但用户点击后钱包余额不变。
diff --git a/docs/technical/【前端架构】图片画布编辑器MVP接入方案-2026-06-11.md b/docs/technical/【前端架构】图片画布编辑器MVP接入方案-2026-06-11.md
index 97af23d9b..b986a9cd2 100644
--- a/docs/technical/【前端架构】图片画布编辑器MVP接入方案-2026-06-11.md
+++ b/docs/technical/【前端架构】图片画布编辑器MVP接入方案-2026-06-11.md
@@ -75,7 +75,7 @@
 - `POST /api/editor/images/generations`：按提示词调用 VectorEngine 生成图片；角色生成可携带 `model`、`aspectRatio`、`imageSize` 和 `referenceImageSrcs`，宣发素材携带 `kind: "publication-material"` 时固定归一为 `gpt-image-2`，不支持 `nanobanana2`。`nanobanana2` 参考图作为 `inline_data` 进入 `generateContent`，`gpt-image-2` 参考图进入 edits。普通重绘继续走该接口并把当前图层图片作为参考图；图片快速编辑不走该接口。请求可携带 `projectId`、`assetFolderId`、`assetKind`、`generationInputs` 和 `sourceResourceId`，后端生成成功后创建 project resource / 账号素材并在响应中返回 resource / asset 快照。
 - `POST /api/editor/icon-spritesheets/generations`：按图标规范图和素材描述数组生成 spritesheet，再由后端切分为独立透明图标。请求支持 `model`、`aspectRatio`、`imageSize`、`priceMudPoints`、`projectId`、`assetFolderId` 和 `generationInputs`；`priceMudPoints` 必须来自编辑器生成计费配置中对应生图模型的尺寸档位（如 `nanobanana2` 的 `0.5K / 1K / 2K` 或 `gpt-image-2` 的 `1K / 2K`），后端用 `editor_generation_config` 校验后才调用上游；`nanobanana2` 走原生 `generateContent` 并写入 `generationConfig.imageConfig.aspectRatio/imageSize`，`0.5K` 传 `"512"`；`gpt-image-2` 走 `/v1/images/edits`。后端把 spritesheet 和拆分后的 icon 都保存为 project resource / 账号素材，并随响应返回对应快照。
 - `POST /api/editor/ui-designs/assets/extractions`：以前端已绘入红色框选轮廓的 UI 设计图 Data URL 作为参考图，固定 `gpt-image-2` 和提示词 `仅提取被红色框框选的素材并整理成spritesheet，图集背景必须使用单一纯绿色 #00FF00 / RGB(0,255,0) 绿幕，方便后续扣除背景；素材自身不要出现绿色描边、绿色底板或绿色阴影。` 生成素材 spritesheet，再按连通域自动拆分为 `素材 1..N`，返回结构复用图标 spritesheet 响应。请求必须携带 `aspectRatio: "1:1"`、`imageSize: "1K" | "2K"` 和 `priceMudPoints`；框选数量不超过 6 个时前端按 `1:1·1K` 与 gpt-image-2 1K 价格提交，超过 6 个时按 `1:1·2K` 与 2K 价格提交。后端必须在调用上游前校验比例、尺寸和泥点价格，只允许 `1:1 / 1K / 2K`。请求可携带 `projectId`、`assetFolderId`、`generationInputs` 和 `spritesheetLabel`，后端保存 spritesheet / 拆分素材并返回对应 resource / asset 快照；前端必须把 spritesheet 原图与拆分素材都加入画布。
-- `POST /api/editor/images/edits`：按提示词和当前图片 Data URL 调用 VectorEngine edits，返回新的生成图片元数据；请求携带 project / asset 上下文时由后端创建新 resource / asset，前端只消费响应快照。
+- `POST /api/editor/images/edits`：按提示词、当前图片 Data URL 和最多 8 张额外参考图调用 VectorEngine edits，返回新的生成图片元数据；请求携带 project / asset 上下文时由后端创建新 resource / asset，前端只消费响应快照。
 - `POST /api/editor/videos/generations`：按视频描述、模型、比例、时长、分辨率、模式、声音、默认联网搜索标记和泥点价格生成视频。前端可选模型为 `seedance2.0-fast`、`seedance2.0`、`kling3.0`、`kling3.0-omni`，默认 `seedance2.0-fast`；后端必须将 `seedance2.0-fast` 映射到 `doubao-seedance-2-0-fast-260128`，将 `seedance2.0` 映射到 `doubao-seedance-2-0-260128`，两者不得混用。后端允许 6 类比例、4 到 15 秒整数、`480p / 720p / 1080p`，并拒绝 `seedance2.0-fast + 1080p`；`sound=on/off` 映射 Ark `generate_audio=true/false`。后端复用 Ark / VectorEngine content generation task 轮询链路，下载最终视频并持久化到 OSS，返回 `videoSrc`、尺寸、prompt、model、provider、taskId、durationSeconds、resolution 和 `priceMudPoints`。
 
 所有写接口都必须校验 Bearer 登录态和 owner；接口只返回当前用户有权读取的工程与资源。
@@ -108,7 +108,7 @@
 - 图片选中后的浮动工具栏按钮顺序固定为：快速编辑、分割线、裁扩按钮、去除背景按钮、UI设计图专属提取素材、角色图专属生成动画、分割线、重绘、下载按钮。裁扩通过画布边界拖拉完成，不再展示四边数值输入；默认自由比例，选择固定比例后拖拉边界保持对应比例，完成后在原素材旁边新增裁扩结果图层，扩展区域透明填充。去除背景使用前端轻量去背并回写为新的工程资源快照；前端轻量去背必须复用共享 `chromaKey` 的绿幕 / 近白背景模型，不再只按四角颜色扩散，避免纯白角色主体或主体内部浅色区域被扣碎。UI设计图的提取素材必须先进入红框素材框选状态，默认启用矩形框选，右侧框选工具与快速编辑统一且可再次点击取消启用态，当前启用工具按钮必须保持高亮。素材提取面板必须在素材下方，使用与生成新素材一致的面板宽度和底部模型 / 按钮样式，提示语显示 `使用框选工具框选你希望从画面中提取的素材`，并展示按原图坐标准确裁剪的框选区域截图预览、固定模型 `gpt-image-2`、左下角计划规格 `1:1·1K/2K` 和 `提取 · N泥点` 按钮，不显示额外取消按钮；点击素材和面板以外的画布区域即退出 UI 素材提取。至少框选一个区域后才可提交，前端把红色轮廓绘入原图后固定走 `gpt-image-2` 和提示词 `仅提取被红色框框选的素材并整理成spritesheet，图集背景必须使用单一纯绿色 #00FF00 / RGB(0,255,0) 绿幕，方便后续扣除背景；素材自身不要出现绿色描边、绿色底板或绿色阴影。`，生成的 spritesheet 原图和拆分后的独立素材都作为画布图层保留。
 - 重绘生成资源后，右侧出现新生成结果图层，并自动 fit 原图 + 新图，且重绘面板保持打开。
 - 快速编辑 / 重绘站内 public 示例图、历史 generated 图或 OSS generated 图时，前端先读取成 `data:image/*;base64,...` 再提交，后端不得再收到 `/creation-type-references/*`、`/generated-*` 或 OSS URL 作为 `referenceImageSrcs/sourceImageSrc`。
-- 快速编辑的额外参考图只进入输入快照和前端上下文，不再作为图片编辑请求的 `referenceImageSrcs` 提交；需要真正多参考图编辑时再扩展 `/api/editor/images/edits` 契约。
+- 快速编辑的额外参考图既进入输入快照，也作为 `/api/editor/images/edits` 的 `referenceImageSrcs` 提交给后端；原图仍只作为 `sourceImageSrc`，不占用额外参考图额度。
 - 素材文件夹可以新建、折叠、重命名和删除；删除普通文件夹后，其素材移动到“项目素材”。普通上传默认落入“上传素材”文件夹；素材库缺少该文件夹时，前端在首次普通上传前创建一次并复用，拖到指定文件夹或点击指定文件夹上传时仍进入目标文件夹。
 - 上传按钮和拖拽上传都支持多文件；底部工具栏的上传入口选择文件后直接进入“上传素材”并在当前画布视口中心创建画布图层，素材栏文件夹内的上传入口只写入对应素材文件夹、不自动入画布；拖到文件夹或该文件夹内素材时进入目标文件夹；拖到画布时进入“上传素材”并在投放点创建画布图层。上传图片必须在创建占位素材、画布图层和账号级素材记录前先读取原图 Resolution，图层宽高、`originalWidth/originalHeight` 和素材库 `width/height` 都使用图片本身尺寸；仅在无法解析尺寸时才使用上传兜底尺寸。
 - 音频 / 视频素材卡和画布媒体图层必须提供稳定的非文字视觉预览：优先使用 `thumbnailSrc` / 视频 `poster`，没有真实首帧或音频封面时使用由媒体类型、素材名和地址派生的确定性视觉底图。视频图层使用原生 `<video controls preload="metadata" playsInline>` 播放，外层图层仍承接选择和拖拽语义；音频图层播放前继续通过 `/api/assets/read-url` 换签。画布素材导出按 `mediaType` 保留真实媒体格式：图片进入 `images/`，音频 / 视频进入 `media/`，文件扩展名从响应 MIME、`objectKey` 或源 URL 推断，不得把音频 / 视频导出成 PNG。
diff --git a/docs/technical/【后台管理】Dashboard运营看板方案-2026-06-23.md b/docs/technical/【后台管理】Dashboard运营看板方案-2026-06-23.md
index 13c9cce2e..3217bfbf5 100644
--- a/docs/technical/【后台管理】Dashboard运营看板方案-2026-06-23.md
+++ b/docs/technical/【后台管理】Dashboard运营看板方案-2026-06-23.md
@@ -14,6 +14,7 @@
 - `anchor` 使用北京时间日历日期，保留给 `day` / `week` / `month` 兼容旧查询口径。`week` 和 `month` 选择包含该日期的自然周 / 自然月。
 - `period` 使用 `startDate` / `endDate` 作为闭区间自定义时段，最多 366 天。
 - 前端统一展示起始日期和终止日期两个日期选择器；点击“本日 / 本周 / 本月”按当天真实日期自动填充对应自然日 / 自然周 / 自然月范围并刷新，手动修改起止日期后按当前日期范围查询。
+- 前端默认日期和“本日 / 本周 / 本月”快捷入口都按 `Asia/Shanghai` 计算，不使用浏览器本地时区。
 - 前端每 5 分钟自动刷新一次，同时保留手动刷新按钮。
 
 ## 指标口径
diff --git a/docs/【后端架构】server-rs与SpacetimeDB数据契约-2026-05-15.md b/docs/【后端架构】server-rs与SpacetimeDB数据契约-2026-05-15.md
index 1153d4391..cd4b69b78 100644
--- a/docs/【后端架构】server-rs与SpacetimeDB数据契约-2026-05-15.md
+++ b/docs/【后端架构】server-rs与SpacetimeDB数据契约-2026-05-15.md
@@ -202,6 +202,7 @@ npm run check:server-rs-ddd
 2. 编辑器画板所有会调用外部生成 provider 的入口都不从前端请求接收 `priceMudPoints`；实际扣费真相以后端运行时模型定价配置为准，前端按钮泥点只作为展示。
 3. 编辑器图片生成 / 图片修改 / 图标 spritesheet / UI 设计图提取素材 / 视频 / 角色动作 / 音效 / 背景音乐必须在后端计算模型价格后使用 `execute_billable_asset_operation_with_cost` 预扣泥点；预扣失败必须 fail-closed，不得继续提交 VectorEngine、Ark、Suno 或 Vidu 上游任务。
 4. 音频生成的编辑器链路虽然任务提交和结果发布分离，仍必须把提交时后端计算出的模型价格写入 `AudioAssetBindingTarget.billing_points_cost`，最终发布落资产时按该价格扣费；创作音频目标未提供该字段时才使用旧的创作音频固定成本。
+5. 编辑器图片生成、图片修改、图标 spritesheet 和 UI 设计图提取素材的参考图可以提交 Data URL 或已登记的 generated objectKey；objectKey 必须归属于当前账号的 `editor_project_resource`、`editor_asset` 或 `asset_object`，后端通过归属校验后才签名读取 OSS。快速编辑、图标素材和 UI 素材提取的额外参考图必须真正传入 provider，不得只写入 `generationInputs` 展示快照；UI 素材提取额外参考图上限为 5 张，普通图片生成上限 5 张，快速编辑 / 图标素材上限 8 张额外参考图。
 
 ## 外部服务与资产
 
diff --git a/docs/【编辑器】生成类面板Lovart统一改造方案-2026-06-17.md b/docs/【编辑器】生成类面板Lovart统一改造方案-2026-06-17.md
index fe15a42d4..d2df5b9d2 100644
--- a/docs/【编辑器】生成类面板Lovart统一改造方案-2026-06-17.md
+++ b/docs/【编辑器】生成类面板Lovart统一改造方案-2026-06-17.md
@@ -178,7 +178,7 @@
 - 快速编辑底部展示当前选择的比例 / 尺寸和模型，视觉对齐可编辑面板的比例 / 尺寸 / 模型按钮，并允许展开修改；额外参考图最多 8 张，原图作为 `sourceImageSrc` 直接编辑，不在参考图条里固定显示 `图x`。
 - 快速编辑打开后画布自动缩放平移到原图完整展示，并让面板位于原图下方且不遮挡原图；原图右侧出现竖向矩形 / 椭圆 / 画笔自由框选按钮。进入快速编辑不默认启用框选，点击工具启用并保持高亮，再点同一工具取消；完成框选后画布红色细框显示连续序号，输入框同步追加 `对N号红色圈选框里的内容做以下修改：`。
 - 快速编辑提交前保留提示词里对原图的 `原图`、`当前图片`、`当前图` 或 `图1` 引用，不再改写成 `图N`。
-- 快速编辑提交给后端时只把原图或已绘制红框和序号的标注图作为 `sourceImageSrc`；额外参考图只进入输入快照和前端上下文，不作为图片编辑请求的 `referenceImageSrcs`。
+- 快速编辑提交给后端时只把原图或已绘制红框和序号的标注图作为 `sourceImageSrc`；额外参考图进入输入快照，并作为图片编辑请求的 `referenceImageSrcs` 一起提交。
 - 生成中的占位图聚焦后可用 `Delete` / `Backspace` 删除；删除后异步结果不再落回画布，也不显示额外删除 UI。
 - 快速编辑生成中的占位图同样只支持键盘 `Delete` / `Backspace` 删除，不新增 UI 删除按钮；删除后异步结果不得再落回画布。
 - 生成视频 / 角色形象 / 角色动作 / 音效 / 背景音乐新建后，画布占位空白样式和右上角标签均与对应生成类型一致，不再统一使用图片占位 icon。
diff --git a/server-rs/crates/api-server/src/app.rs b/server-rs/crates/api-server/src/app.rs
index fc7dd84fc..f549e281c 100644
--- a/server-rs/crates/api-server/src/app.rs
+++ b/server-rs/crates/api-server/src/app.rs
@@ -1695,6 +1695,54 @@ mod tests {
         assert!(!body_text.contains("length limit exceeded"));
     }
 
+    #[tokio::test]
+    async fn editor_image_edit_accepts_reference_body_above_default_limit() {
+        let state = AppState::new(AppConfig {
+            external_generation_mode: ExternalGenerationMode::Inline,
+            ..AppConfig::default()
+        })
+        .expect("state should build");
+        let seed_user = seed_phone_user_with_password(&state, "13800138029", TEST_PASSWORD).await;
+        let token = sign_test_user_token(&state, &seed_user, "sess_editor_image_edit_body");
+        let app = build_router(state);
+        let source_image_src = format!("data:image/png;base64,{}", "A".repeat(3 * 1024 * 1024));
+        let request_body = serde_json::json!({
+            "prompt": "快速编辑图片",
+            "sourceImageSrc": source_image_src,
+            "size": "1024x1024",
+            "model": "gpt-image-2"
+        })
+        .to_string();
+        assert!(request_body.len() > 2 * 1024 * 1024);
+
+        let response = app
+            .oneshot(
+                Request::builder()
+                    .method("POST")
+                    .uri("/api/editor/images/edits")
+                    .header("authorization", format!("Bearer {token}"))
+                    .header("content-type", "application/json")
+                    .body(Body::from(request_body))
+                    .expect("request should build"),
+            )
+            .await
+            .expect("request should succeed");
+
+        assert_eq!(response.status(), StatusCode::SERVICE_UNAVAILABLE);
+        let body = response
+            .into_body()
+            .collect()
+            .await
+            .expect("response body should collect")
+            .to_bytes();
+        let body_text = String::from_utf8_lossy(&body);
+        assert!(
+            body_text.contains("VECTOR_ENGINE_BASE_URL"),
+            "handler should parse the oversized editor edit image before checking VectorEngine config: {body_text}"
+        );
+        assert!(!body_text.contains("length limit exceeded"));
+    }
+
     #[tokio::test]
     async fn password_entry_rejects_unknown_phone_without_registration() {
         let app = build_router(AppState::new(AppConfig::default()).expect("state should build"));
diff --git a/server-rs/crates/api-server/src/character_animation_assets.rs b/server-rs/crates/api-server/src/character_animation_assets.rs
index 996a5a507..f5fca0d63 100644
--- a/server-rs/crates/api-server/src/character_animation_assets.rs
+++ b/server-rs/crates/api-server/src/character_animation_assets.rs
@@ -1124,13 +1124,12 @@ pub async fn resolve_role_asset_workflow(
     })?;
 
     let cache_scope_id = trim_optional_text(payload.cache_scope_id.as_deref());
-    let cache = match load_workflow_cache(&state, character_id.as_str(), cache_scope_id.as_deref())
-        .await
-    {
-        Ok(cache) => cache,
-        Err(error) if is_missing_oss_config_error(&error) => None,
-        Err(error) => return Err(character_animation_error_response(&request_context, error)),
-    };
+    let cache =
+        match load_workflow_cache(&state, character_id.as_str(), cache_scope_id.as_deref()).await {
+            Ok(cache) => cache,
+            Err(error) if is_missing_oss_config_error(&error) => None,
+            Err(error) => return Err(character_animation_error_response(&request_context, error)),
+        };
     let workflow = build_role_asset_workflow(payload.role, cache.as_ref());
 
     Ok(json_success_body(
diff --git a/server-rs/crates/api-server/src/editor_project.rs b/server-rs/crates/api-server/src/editor_project.rs
index 4695e5180..a934ec8cc 100644
--- a/server-rs/crates/api-server/src/editor_project.rs
+++ b/server-rs/crates/api-server/src/editor_project.rs
@@ -59,8 +59,7 @@ use crate::{
     http_error::AppError,
     openai_image_generation::{
         DownloadedOpenAiImage, GPT_IMAGE_2_MODEL, OpenAiReferenceImage,
-        build_openai_image_http_client, create_openai_image_edit_with_references,
-        create_openai_image_edit_with_references_and_model,
+        build_openai_image_http_client, create_openai_image_edit_with_references_and_model,
         create_openai_image_generation_with_model, create_openai_nanobanana_generate_content,
         require_openai_image_settings,
     },
@@ -83,6 +82,7 @@ const EDITOR_IMAGE_MODEL_NANOBANANA2: &str = "gemini-3.1-flash-image-preview";
 const EDITOR_IMAGE_MODEL_NANOBANANA2_DISPLAY_ALIAS: &str = "nanobanana2";
 const EDITOR_IMAGE_MODEL_NANOBANANA_LEGACY_ALIAS: &str = "nano-banana";
 const EDITOR_ICON_DESCRIPTION_LIMIT: usize = 100;
+const EDITOR_UI_DESIGN_ASSET_EXTRACTION_REFERENCE_LIMIT: usize = 5;
 const EDITOR_UI_DESIGN_ASSET_EXTRACTION_PROMPT: &str = "仅提取被红色框框选的素材并整理成spritesheet，图集背景必须使用单一纯绿色 #00FF00 / RGB(0,255,0) 绿幕，方便后续扣除背景；素材自身不要出现绿色描边、绿色底板或绿色阴影。";
 const EDITOR_CHARACTER_IMAGE_ASSET_KIND: &str = "editor_character_image";
 const EDITOR_CHARACTER_IMAGE_ENTITY_KIND: &str = "editor_project";
@@ -215,6 +215,9 @@ pub struct EditorImageGenerationRequest {
 pub struct EditorImageEditRequest {
     pub(crate) prompt: String,
     pub(crate) source_image_src: String,
+    pub(crate) size: Option<String>,
+    pub(crate) model: Option<String>,
+    pub(crate) reference_image_srcs: Option<Vec<String>>,
     pub(crate) project_id: Option<String>,
     pub(crate) asset_kind: Option<String>,
     pub(crate) generation_inputs: Option<Value>,
@@ -228,6 +231,7 @@ pub struct EditorImageEditRequest {
 #[serde(rename_all = "camelCase")]
 pub struct EditorIconSpritesheetGenerationRequest {
     pub(crate) reference_image_src: String,
+    pub(crate) reference_image_srcs: Option<Vec<String>>,
     pub(crate) icon_descriptions: Vec<String>,
     pub(crate) model: Option<String>,
     pub(crate) aspect_ratio: Option<String>,
@@ -1177,8 +1181,10 @@ pub(crate) async fn generate_editor_image_for_owner(
     } else {
         let mut parsed_reference_images = Vec::with_capacity(reference_sources.len());
         for source in &reference_sources {
-            parsed_reference_images
-                .push(parse_editor_reference_image(state, source.as_str()).await?);
+            parsed_reference_images.push(
+                parse_editor_reference_image(state, caller.owner_user_id.as_str(), source.as_str())
+                    .await?,
+            );
         }
         parsed_reference_images
     };
@@ -1381,7 +1387,11 @@ fn editor_generated_image_storage_profile(
     }
 }
 
-fn resolve_editor_image_edit_price(state: &AppState) -> Result<u32, AppError> {
+fn resolve_editor_image_edit_price(
+    state: &AppState,
+    model: &str,
+    size: &str,
+) -> Result<u32, AppError> {
     let expected_price_mud_points = state
         .editor_generation_pricing()
         .map_err(|error| {
@@ -1390,10 +1400,27 @@ fn resolve_editor_image_edit_price(state: &AppState) -> Result<u32, AppError> {
                 "message": error.to_string(),
             }))
         })?
-        .image_generation_mud_points(Some("quick-edit"), Some(GPT_IMAGE_2_MODEL), Some("1K"));
+        .image_generation_mud_points(
+            Some("quick-edit"),
+            Some(model),
+            Some(editor_image_price_size_from_pixels(size)),
+        );
     Ok(expected_price_mud_points)
 }
 
+fn editor_image_price_size_from_pixels(size: &str) -> &'static str {
+    let Some((width, height)) = size.split_once('x') else {
+        return "1K";
+    };
+    let Ok(width) = width.parse::<u32>() else {
+        return "1K";
+    };
+    let Ok(height) = height.parse::<u32>() else {
+        return "1K";
+    };
+    if width.max(height) > 1536 { "2K" } else { "1K" }
+}
+
 fn normalize_editor_image_generation_size(size: Option<&str>) -> Cow<'static, str> {
     match size.map(str::trim).filter(|value| !value.is_empty()) {
         Some("1024x1024") | Some("1024*1024") | Some("1:1") => Cow::Borrowed("1024x1024"),
@@ -1543,7 +1570,14 @@ pub async fn edit_editor_image(
 ) -> Result<Json<Value>, AppError> {
     let caller = EditorGenerationCaller::from_authenticated(&authenticated);
     if !state.config.external_generation_mode.is_inline() {
-        let price_mud_points = u64::from(resolve_editor_image_edit_price(&state)?);
+        let generation_options =
+            normalize_editor_generation_options(payload.model.as_deref(), None, None);
+        let image_size = normalize_editor_image_generation_size(payload.size.as_deref());
+        let price_mud_points = u64::from(resolve_editor_image_edit_price(
+            &state,
+            generation_options.model,
+            image_size.as_ref(),
+        )?);
         let source_entity_id =
             editor_generation_source_entity_id(payload.project_id.as_deref(), "editor-image-edit");
         let queue_job = enqueue_editor_generation_job(
@@ -1582,9 +1616,28 @@ pub(crate) async fn edit_editor_image_for_owner(
             })),
         );
     }
-    let reference_image =
-        parse_editor_reference_image(state, payload.source_image_src.as_str()).await?;
-    let expected_price_mud_points = resolve_editor_image_edit_price(state)?;
+    let generation_options =
+        normalize_editor_generation_options(payload.model.as_deref(), None, None);
+    let image_size = normalize_editor_image_generation_size(payload.size.as_deref());
+    let mut reference_images =
+        Vec::with_capacity(1 + payload.reference_image_srcs.as_ref().map_or(0, Vec::len));
+    reference_images.push(
+        parse_editor_reference_image(
+            state,
+            caller.owner_user_id.as_str(),
+            payload.source_image_src.as_str(),
+        )
+        .await?,
+    );
+    for source in
+        normalize_editor_reference_image_sources(payload.reference_image_srcs.as_deref(), 8)
+    {
+        reference_images.push(
+            parse_editor_reference_image(state, caller.owner_user_id.as_str(), source).await?,
+        );
+    }
+    let expected_price_mud_points =
+        resolve_editor_image_edit_price(state, generation_options.model, image_size.as_ref())?;
 
     let settings = require_openai_image_settings(state)?.with_external_api_audit_context(
         request_context,
@@ -1601,14 +1654,15 @@ pub(crate) async fn edit_editor_image_for_owner(
         "editor_image_edit",
         request_context.request_id(),
         u64::from(expected_price_mud_points),
-        create_openai_image_edit_with_references(
+        create_openai_image_edit_with_references_and_model(
             &http_client,
             &settings,
+            generation_options.model,
             prompt.as_str(),
             Some("文字、水印、边框、按钮、UI 控件、低清晰度、变形主体"),
-            EDITOR_IMAGE_GENERATION_SIZE,
+            image_size.as_ref(),
             1,
-            &[reference_image],
+            reference_images.as_slice(),
             "图片画布修改图片",
         ),
     )
@@ -1652,7 +1706,7 @@ pub(crate) async fn edit_editor_image_for_owner(
             height,
             prompt: prompt.clone(),
             actual_prompt: generated.actual_prompt.clone(),
-            model: GPT_IMAGE_2_MODEL.to_string(),
+            model: generation_options.model.to_string(),
             provider: "VectorEngine".to_string(),
             task_id: generated.task_id.clone(),
             source_resource_id: payload.source_resource_id,
@@ -1681,7 +1735,7 @@ pub(crate) async fn edit_editor_image_for_owner(
             source_type: "generated",
             prompt,
             actual_prompt: generated.actual_prompt,
-            model: GPT_IMAGE_2_MODEL.to_string(),
+            model: generation_options.model.to_string(),
             provider: "VectorEngine",
             task_id: generated.task_id,
             resource: generated_asset.resource,
@@ -1741,7 +1795,14 @@ pub(crate) async fn generate_editor_icon_spritesheet_for_owner(
     payload: EditorIconSpritesheetGenerationRequest,
 ) -> Result<Json<Value>, AppError> {
     let icon_descriptions = normalize_icon_descriptions(payload.icon_descriptions)?;
-    let reference_image = parse_editor_reference_image(state, payload.reference_image_src.as_str())
+    let mut reference_images =
+        Vec::with_capacity(1 + payload.reference_image_srcs.as_ref().map_or(0, Vec::len));
+    reference_images.push(
+        parse_editor_reference_image(
+            state,
+            caller.owner_user_id.as_str(),
+            payload.reference_image_src.as_str(),
+        )
         .await
         .map_err(|error| {
             error.with_details(json!({
@@ -1749,7 +1810,23 @@ pub(crate) async fn generate_editor_icon_spritesheet_for_owner(
                 "field": "referenceImageSrc",
                 "message": "图标素材规范必须是图片 Data URL 或 objectKey。",
             }))
-        })?;
+        })?,
+    );
+    for source in
+        normalize_editor_reference_image_sources(payload.reference_image_srcs.as_deref(), 8)
+    {
+        reference_images.push(
+            parse_editor_reference_image(state, caller.owner_user_id.as_str(), source)
+                .await
+                .map_err(|error| {
+                    error.with_details(json!({
+                        "provider": "editor-icon-spritesheet",
+                        "field": "referenceImageSrcs",
+                        "message": "图标素材参考图必须是图片 Data URL 或 objectKey。",
+                    }))
+                })?,
+        );
+    }
     let generation_options = normalize_editor_generation_options(
         payload.model.as_deref(),
         payload.aspect_ratio.as_deref(),
@@ -1788,7 +1865,7 @@ pub(crate) async fn generate_editor_icon_spritesheet_for_owner(
                     None,
                     generation_options.aspect_ratio,
                     generation_options.provider_image_size,
-                    &[reference_image],
+                    reference_images.as_slice(),
                     "图片画布生成图标素材 spritesheet",
                 )
                 .await
@@ -1801,7 +1878,7 @@ pub(crate) async fn generate_editor_icon_spritesheet_for_owner(
                     None,
                     size,
                     1,
-                    &[reference_image],
+                    reference_images.as_slice(),
                     "图片画布生成图标素材 spritesheet",
                 )
                 .await
@@ -1949,19 +2026,26 @@ pub(crate) async fn extract_editor_ui_design_assets_for_owner(
     caller: EditorGenerationCaller,
     payload: EditorUiDesignAssetExtractionRequest,
 ) -> Result<Json<Value>, AppError> {
-    let reference_image = parse_editor_reference_image(state, payload.source_image_src.as_str())
-        .await
-        .map_err(|error| {
-            error.with_details(json!({
-                "provider": "editor-ui-design-asset-extraction",
-                "field": "sourceImageSrc",
-                "message": "UI设计图必须是图片 Data URL 或 objectKey。",
-            }))
-        })?;
+    let reference_image = parse_editor_reference_image(
+        state,
+        caller.owner_user_id.as_str(),
+        payload.source_image_src.as_str(),
+    )
+    .await
+    .map_err(|error| {
+        error.with_details(json!({
+            "provider": "editor-ui-design-asset-extraction",
+            "field": "sourceImageSrc",
+            "message": "UI设计图必须是图片 Data URL 或 objectKey。",
+        }))
+    })?;
     let mut reference_images = vec![reference_image];
-    for source in payload.reference_image_srcs.as_deref().unwrap_or(&[]) {
+    for source in normalize_editor_reference_image_sources(
+        payload.reference_image_srcs.as_deref(),
+        EDITOR_UI_DESIGN_ASSET_EXTRACTION_REFERENCE_LIMIT,
+    ) {
         reference_images.push(
-            parse_editor_reference_image(state, source.as_str())
+            parse_editor_reference_image(state, caller.owner_user_id.as_str(), source)
                 .await
                 .map_err(|error| {
                     error.with_details(json!({
@@ -3738,13 +3822,125 @@ const EDITOR_REFERENCE_IMAGE_MAX_SIZE_BYTES: u64 = 32 * 1024 * 1024;
 
 pub(crate) async fn parse_editor_reference_image(
     state: &AppState,
+    owner_user_id: &str,
     source: &str,
 ) -> Result<OpenAiReferenceImage, AppError> {
     let trimmed = source.trim();
     if trimmed.starts_with("data:") {
         return parse_editor_reference_image_data_url(trimmed);
     }
-    read_editor_reference_image_object(state, trimmed).await
+    let object_key = normalize_editor_reference_object_key(trimmed)?;
+    ensure_editor_reference_object_key_owned(state, owner_user_id, object_key.as_str()).await?;
+    read_editor_reference_image_object(state, object_key.as_str()).await
+}
+
+fn normalize_editor_reference_image_sources(sources: Option<&[String]>, limit: usize) -> Vec<&str> {
+    sources
+        .unwrap_or(&[])
+        .iter()
+        .map(String::as_str)
+        .map(str::trim)
+        .filter(|source| !source.is_empty())
+        .take(limit)
+        .collect()
+}
+
+fn normalize_editor_reference_object_key(source: &str) -> Result<String, AppError> {
+    let object_key = source.trim().trim_start_matches('/').to_string();
+    if object_key.is_empty() || LegacyAssetPrefix::from_object_key(object_key.as_str()).is_none() {
+        return Err(
+            AppError::from_status(StatusCode::BAD_REQUEST).with_details(json!({
+                "provider": "editor-reference-image",
+                "field": "sourceImageSrc",
+                "message": "图片参考图必须是图片 Data URL 或已登记的 generated objectKey。",
+            })),
+        );
+    }
+    Ok(object_key)
+}
+
+async fn ensure_editor_reference_object_key_owned(
+    state: &AppState,
+    owner_user_id: &str,
+    object_key: &str,
+) -> Result<(), AppError> {
+    let owner_user_id = owner_user_id.trim();
+    if owner_user_id.is_empty() {
+        return Err(editor_reference_image_forbidden(object_key));
+    }
+    let projects = state
+        .spacetime_client()
+        .list_editor_projects(owner_user_id.to_string())
+        .await
+        .map_err(map_editor_project_error)?;
+    if projects.iter().any(|project| {
+        project.resources.iter().any(|resource| {
+            editor_record_object_key_matches(resource.object_key.as_deref(), object_key)
+        })
+    }) {
+        return Ok(());
+    }
+    let library = state
+        .spacetime_client()
+        .get_editor_asset_library(owner_user_id.to_string(), current_utc_micros())
+        .await
+        .map_err(map_editor_project_error)?;
+    if library
+        .assets
+        .iter()
+        .any(|asset| editor_record_object_key_matches(asset.object_key.as_deref(), object_key))
+    {
+        return Ok(());
+    }
+    if let Some(asset_object) = state
+        .spacetime_client()
+        .get_asset_object_by_object_key(object_key.to_string())
+        .await
+        .map_err(map_editor_project_error)?
+    {
+        validate_editor_reference_asset_object(&asset_object, owner_user_id, state, object_key)?;
+        return Ok(());
+    }
+    Err(editor_reference_image_forbidden(object_key))
+}
+
+fn validate_editor_reference_asset_object(
+    asset_object: &module_assets::AssetObjectRecord,
+    owner_user_id: &str,
+    state: &AppState,
+    object_key: &str,
+) -> Result<(), AppError> {
+    let Some(oss_client) = state.oss_client() else {
+        return Err(editor_reference_image_forbidden(object_key));
+    };
+    let owned = asset_object
+        .owner_user_id
+        .as_deref()
+        .map(str::trim)
+        .is_some_and(|value| value == owner_user_id);
+    let bucket_matches = asset_object.bucket.trim() == oss_client.config_bucket().trim();
+    let key_matches = asset_object.object_key.trim().trim_start_matches('/') == object_key;
+    if owned && bucket_matches && key_matches {
+        Ok(())
+    } else {
+        Err(editor_reference_image_forbidden(object_key))
+    }
+}
+
+fn editor_record_object_key_matches(record_object_key: Option<&str>, object_key: &str) -> bool {
+    record_object_key
+        .map(str::trim)
+        .map(|value| value.trim_start_matches('/'))
+        .is_some_and(|value| value == object_key)
+}
+
+fn editor_reference_image_forbidden(object_key: &str) -> AppError {
+    AppError::from_status(StatusCode::FORBIDDEN).with_details(json!({
+        "provider": "editor-reference-image",
+        "field": "sourceImageSrc",
+        "message": "图片参考图不属于当前账号。",
+        "objectKey": object_key,
+    }))
 }
 
 fn parse_editor_reference_image_data_url(source: &str) -> Result<OpenAiReferenceImage, AppError> {
@@ -4443,6 +4639,25 @@ mod tests {
         );
     }
 
+    #[test]
+    fn editor_image_edit_price_uses_selected_model_and_size() {
+        let state = AppState::new(AppConfig::default()).expect("state should build");
+
+        assert_eq!(
+            resolve_editor_image_edit_price(&state, GPT_IMAGE_2_MODEL, "1024x1024").unwrap(),
+            3
+        );
+        assert_eq!(
+            resolve_editor_image_edit_price(&state, GPT_IMAGE_2_MODEL, "2048x1152").unwrap(),
+            5
+        );
+        assert_eq!(
+            resolve_editor_image_edit_price(&state, EDITOR_IMAGE_MODEL_NANOBANANA2, "2048x2048")
+                .unwrap(),
+            24
+        );
+    }
+
     #[test]
     fn editor_generation_dimensions_follow_model_options() {
         let default_generation = normalize_editor_generation_options(None, Some("1:1"), Some("1K"));
@@ -4571,8 +4786,8 @@ mod tests {
     fn editor_character_image_prompt_appends_user_role_setting() {
         let prompt = build_editor_character_image_prompt("菜市场卖菜大妈");
 
-        assert!(prompt.contains("基于图1的角色美术视觉规范指导"));
-        assert!(prompt.contains("生成游戏角色形象图"));
+        assert!(prompt.contains("严格基于图1的角色美术视觉规范"));
+        assert!(prompt.contains("生成游戏角色立绘"));
         assert!(prompt.contains("背景固定为单一纯绿色 #00FF00 / RGB(0,255,0) 绿幕"));
         assert!(prompt.contains("禁止镜头透视"));
         assert!(prompt.contains("角色设定：菜市场卖菜大妈"));
@@ -5185,6 +5400,94 @@ mod tests {
         assert_eq!(parsed.bytes, vec![0, 0, 0]);
     }
 
+    #[test]
+    fn editor_reference_image_sources_are_trimmed_and_limited() {
+        let sources = vec![
+            " generated-character-drafts/editor/a.png ".to_string(),
+            "".to_string(),
+            "generated-character-drafts/editor/b.png".to_string(),
+            "generated-character-drafts/editor/c.png".to_string(),
+        ];
+
+        assert_eq!(
+            normalize_editor_reference_image_sources(Some(sources.as_slice()), 2),
+            vec![
+                "generated-character-drafts/editor/a.png",
+                "generated-character-drafts/editor/b.png"
+            ]
+        );
+    }
+
+    #[test]
+    fn editor_reference_object_key_requires_generated_prefix() {
+        assert_eq!(
+            normalize_editor_reference_object_key("/generated-character-drafts/editor/ref.png")
+                .unwrap(),
+            "generated-character-drafts/editor/ref.png"
+        );
+        assert!(normalize_editor_reference_object_key("/private/editor/ref.png").is_err());
+    }
+
+    #[test]
+    fn editor_reference_object_key_matches_registered_media() {
+        assert!(editor_record_object_key_matches(
+            Some("/generated-character-drafts/editor/ref.png"),
+            "generated-character-drafts/editor/ref.png",
+        ));
+        assert!(!editor_record_object_key_matches(
+            Some("generated-character-drafts/editor/other.png"),
+            "generated-character-drafts/editor/ref.png",
+        ));
+    }
+
+    #[test]
+    fn editor_reference_asset_object_requires_matching_owner_bucket_and_key() {
+        let state = AppState::new(AppConfig {
+            oss_bucket: Some("genarrative-assets".to_string()),
+            oss_endpoint: Some("oss-cn-beijing.aliyuncs.com".to_string()),
+            oss_access_key_id: Some("test-ak".to_string()),
+            oss_access_key_secret: Some("test-sk".to_string()),
+            ..AppConfig::default()
+        })
+        .expect("state should build");
+        let asset_object = module_assets::AssetObjectRecord {
+            asset_object_id: "assetobj_reference_1".to_string(),
+            bucket: "genarrative-assets".to_string(),
+            object_key: "generated-character-drafts/editor/ref.png".to_string(),
+            access_policy: module_assets::AssetObjectAccessPolicy::Private,
+            content_type: Some("image/png".to_string()),
+            content_length: 1024,
+            content_hash: None,
+            version: 1,
+            source_job_id: None,
+            owner_user_id: Some("user-1".to_string()),
+            profile_id: None,
+            entity_id: None,
+            asset_kind: "editor_generated_image".to_string(),
+            created_at: "2026-06-27T00:00:00Z".to_string(),
+            updated_at: "2026-06-27T00:00:00Z".to_string(),
+        };
+
+        assert!(
+            validate_editor_reference_asset_object(
+                &asset_object,
+                "user-1",
+                &state,
+                "generated-character-drafts/editor/ref.png",
+            )
+            .is_ok()
+        );
+        assert!(
+            validate_editor_reference_asset_object(
+                &asset_object,
+                "user-2",
+                &state,
+                "generated-character-drafts/editor/ref.png",
+            )
+            .is_err()
+        );
+    }
+
     #[test]
     fn editor_reference_image_mime_type_falls_back_to_magic_bytes() {
         assert_eq!(
@@ -5319,11 +5622,35 @@ mod tests {
     fn editor_image_edit_request_omits_price_mud_points() {
         let request: EditorImageEditRequest = serde_json::from_value(json!({
             "prompt": "修改图片",
-            "sourceImageSrc": "data:image/png;base64,AAAA"
+            "sourceImageSrc": "data:image/png;base64,AAAA",
+            "size": "2048x1152",
+            "model": "gpt-image-2",
+            "referenceImageSrcs": ["data:image/png;base64,BBBB"]
         }))
         .expect("image edit request should deserialize without price");
 
         assert_eq!(request.prompt, "修改图片");
+        assert_eq!(request.size.as_deref(), Some("2048x1152"));
+        assert_eq!(request.model.as_deref(), Some("gpt-image-2"));
+        assert_eq!(
+            request.reference_image_srcs,
+            Some(vec!["data:image/png;base64,BBBB".to_string()])
+        );
+    }
+
+    #[test]
+    fn editor_icon_spritesheet_request_accepts_extra_references() {
+        let request: EditorIconSpritesheetGenerationRequest = serde_json::from_value(json!({
+            "referenceImageSrc": "data:image/png;base64,spec",
+            "referenceImageSrcs": ["data:image/png;base64,style"],
+            "iconDescriptions": ["返回按钮"]
+        }))
+        .expect("icon spritesheet request should deserialize references");
+
+        assert_eq!(
+            request.reference_image_srcs,
+            Some(vec!["data:image/png;base64,style".to_string()])
+        );
     }
 
     #[test]
diff --git a/server-rs/crates/api-server/src/modules/editor_project.rs b/server-rs/crates/api-server/src/modules/editor_project.rs
index 2969c40b3..3d11ab36c 100644
--- a/server-rs/crates/api-server/src/modules/editor_project.rs
+++ b/server-rs/crates/api-server/src/modules/editor_project.rs
@@ -131,10 +131,14 @@ pub fn router(state: AppState) -> Router<AppState> {
         )
         .route(
             "/api/editor/images/edits",
-            post(edit_editor_image).route_layer(middleware::from_fn_with_state(
-                state.clone(),
-                require_bearer_auth,
-            )),
+            post(edit_editor_image)
+                .layer(DefaultBodyLimit::max(
+                    EDITOR_IMAGE_REFERENCE_BODY_LIMIT_BYTES,
+                ))
+                .route_layer(middleware::from_fn_with_state(
+                    state.clone(),
+                    require_bearer_auth,
+                )),
         )
         .route(
             "/api/editor/icon-spritesheets/generations",
diff --git a/server-rs/crates/shared-contracts/src/assets.rs b/server-rs/crates/shared-contracts/src/assets.rs
index 8bfc456e1..6734c63e4 100644
--- a/server-rs/crates/shared-contracts/src/assets.rs
+++ b/server-rs/crates/shared-contracts/src/assets.rs
@@ -444,6 +444,8 @@ pub struct EditorCanvasGenerationCompletionPayload {
 #[serde(rename_all = "camelCase")]
 pub struct EditorIconSpritesheetGenerateRequest {
     pub reference_image_src: String,
+    #[serde(default)]
+    pub reference_image_srcs: Vec<String>,
     pub icon_descriptions: Vec<String>,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub model: Option<String>,
@@ -1231,6 +1233,7 @@ mod tests {
     fn editor_icon_spritesheet_request_omits_price_and_response_includes_price() {
         let request_payload = serde_json::to_value(EditorIconSpritesheetGenerateRequest {
             reference_image_src: "data:image/png;base64,spec".to_string(),
+            reference_image_srcs: vec!["data:image/png;base64,style".to_string()],
             icon_descriptions: vec!["返回按钮".to_string(), "设置按钮".to_string()],
             model: Some("gemini-3.1-flash-image-preview".to_string()),
             aspect_ratio: Some("1:1".to_string()),
@@ -1242,6 +1245,10 @@ mod tests {
             request_payload["referenceImageSrc"],
             json!("data:image/png;base64,spec")
         );
+        assert_eq!(
+            request_payload["referenceImageSrcs"],
+            json!(["data:image/png;base64,style"])
+        );
         assert!(request_payload.get("priceMudPoints").is_none());
 
         let response_payload = serde_json::to_value(EditorIconSpritesheetGenerateResponse {
diff --git a/server-rs/crates/spacetime-client/src/assets.rs b/server-rs/crates/spacetime-client/src/assets.rs
index f8814228a..004197d93 100644
--- a/server-rs/crates/spacetime-client/src/assets.rs
+++ b/server-rs/crates/spacetime-client/src/assets.rs
@@ -61,6 +61,21 @@ impl SpacetimeClient {
         .await
     }
 
+    pub async fn get_asset_object_by_object_key(
+        &self,
+        object_key: String,
+    ) -> Result<Option<AssetObjectRecord>, SpacetimeClientError> {
+        self.read_after_connect("get_asset_object_by_object_key", move |connection| {
+            Ok(connection
+                .db()
+                .asset_object()
+                .iter()
+                .find(|row| row.object_key == object_key)
+                .map(map_asset_object_row))
+        })
+        .await
+    }
+
     pub async fn bind_asset_object_to_entity(
         &self,
         input: module_assets::AssetEntityBindingInput,
diff --git a/server-rs/crates/spacetime-module/src/editor_project_storage.rs b/server-rs/crates/spacetime-module/src/editor_project_storage.rs
index 03b550d26..356e51c5b 100644
--- a/server-rs/crates/spacetime-module/src/editor_project_storage.rs
+++ b/server-rs/crates/spacetime-module/src/editor_project_storage.rs
@@ -1847,12 +1847,7 @@ fn project_resource_input_copies_source_media(
         .find(&source_resource_id.to_string())
         .filter(|source_resource| source_resource.owner_user_id == owner_user_id)
         .is_some_and(|source_resource| {
-            project_resource_matches_media(
-                &source_resource,
-                asset_object_id,
-                object_key,
-                image_src,
-            )
+            project_resource_matches_media(&source_resource, asset_object_id, object_key, image_src)
         })
 }
 
@@ -1883,12 +1878,7 @@ fn find_reusable_project_resource_for_input(
                         .as_deref()
                         .map(str::trim)
                         .is_some_and(|value| value == source_resource_id))
-                && project_resource_matches_media(
-                    resource,
-                    asset_object_id,
-                    object_key,
-                    image_src,
-                )
+                && project_resource_matches_media(resource, asset_object_id, object_key, image_src)
         })
         .collect::<Vec<_>>();
     matches.sort_by(|left, right| {
@@ -1934,12 +1924,7 @@ fn matching_media_ref(left: &str, right: &str) -> bool {
 }
 
 fn normalize_media_ref(value: &str) -> String {
-    let trimmed_value = value
-        .trim()
-        .split('?')
-        .next()
-        .unwrap_or("")
-        .trim();
+    let trimmed_value = value.trim().split('?').next().unwrap_or("").trim();
     let path_value = if let Some(protocol_index) = trimmed_value.find("://") {
         let after_protocol = &trimmed_value[protocol_index + 3..];
         after_protocol
diff --git a/src/components/image-editor/useImageCanvasGenerationSubmissionWorkflow.test.tsx b/src/components/image-editor/useImageCanvasGenerationSubmissionWorkflow.test.tsx
index a9401c304..6e5056bc1 100644
--- a/src/components/image-editor/useImageCanvasGenerationSubmissionWorkflow.test.tsx
+++ b/src/components/image-editor/useImageCanvasGenerationSubmissionWorkflow.test.tsx
@@ -676,6 +676,7 @@ describe('useImageCanvasGenerationSubmissionWorkflow', () => {
       expect(editEditorImageMock).toHaveBeenCalledWith(
         expect.objectContaining({
           sourceImageSrc: 'data:image/png;base64,marked-source',
+          referenceImageSrcs: ['data:image/png;base64,style.png'],
         }),
       );
     });
diff --git a/src/components/image-editor/useImageCanvasGenerationSubmissionWorkflow.ts b/src/components/image-editor/useImageCanvasGenerationSubmissionWorkflow.ts
index 0e4cca2ec..6d515ea49 100644
--- a/src/components/image-editor/useImageCanvasGenerationSubmissionWorkflow.ts
+++ b/src/components/image-editor/useImageCanvasGenerationSubmissionWorkflow.ts
@@ -1015,7 +1015,9 @@ export function useImageCanvasGenerationSubmissionWorkflow({
 
     try {
       const needsExtraReferenceImageSrcs =
-        panelMode === 'redraw' || isVideoQuickEditSource(quickEditSourceLayer);
+        panelMode === 'quick-edit' ||
+        panelMode === 'redraw' ||
+        isVideoQuickEditSource(quickEditSourceLayer);
       const extraReferenceImageSrcs = needsExtraReferenceImageSrcs
         ? await Promise.all(
             quickEditReferences.map((reference) =>
@@ -1215,6 +1217,9 @@ export function useImageCanvasGenerationSubmissionWorkflow({
                 sourceImageSrc: sourceReferenceImageSrc,
                 size: quickEditSize,
                 model: normalizeEditorImageModel(quickEditPanel.model),
+                ...(extraReferenceImageSrcs.length
+                  ? { referenceImageSrcs: extraReferenceImageSrcs }
+                  : {}),
                 projectId,
                 assetKind: quickEditSourceLayer.assetKind,
                 generationInputs,
diff --git a/src/services/image-editor/editorProjectClient.test.ts b/src/services/image-editor/editorProjectClient.test.ts
index 5aacb0da2..85ab73181 100644
--- a/src/services/image-editor/editorProjectClient.test.ts
+++ b/src/services/image-editor/editorProjectClient.test.ts
@@ -1324,6 +1324,7 @@ describe('editorProjectClient', () => {
       sourceImageSrc: 'data:image/png;base64,source',
       size: '1024x1024',
       model: 'gpt-image-2',
+      referenceImageSrcs: ['data:image/png;base64,style'],
       projectId: 'editor-project-1',
       assetKind: 'character',
       assetFolderId: 'project',
@@ -1346,6 +1347,7 @@ describe('editorProjectClient', () => {
           sourceImageSrc: 'data:image/png;base64,source',
           size: '1024x1024',
           model: 'gpt-image-2',
+          referenceImageSrcs: ['data:image/png;base64,style'],
           projectId: 'editor-project-1',
           assetKind: 'character',
           generationInputs: {
diff --git a/src/services/image-editor/editorProjectClient.ts b/src/services/image-editor/editorProjectClient.ts
index 746018eb2..474c3c028 100644
--- a/src/services/image-editor/editorProjectClient.ts
+++ b/src/services/image-editor/editorProjectClient.ts
@@ -187,6 +187,7 @@ export type EditorImageEditInput = {
   sourceImageSrc: string;
   size?: string;
   model?: string;
+  referenceImageSrcs?: string[];
   projectId?: string | null;
   assetKind?: string | null;
   generationInputs?: EditorAssetGenerationInputs | null;
@@ -832,6 +833,9 @@ export async function editEditorImage(input: EditorImageEditInput) {
       sourceImageSrc: input.sourceImageSrc,
       ...(input.size ? { size: input.size } : {}),
       ...(input.model ? { model: input.model } : {}),
+      ...(input.referenceImageSrcs?.length
+        ? { referenceImageSrcs: input.referenceImageSrcs }
+        : {}),
       ...(input.projectId ? { projectId: input.projectId } : {}),
       ...(input.assetKind ? { assetKind: input.assetKind } : {}),
       ...(input.generationInputs