From c2c5e1ced549ccb8f7e6a1961ea7ed4ccada506a Mon Sep 17 00:00:00 2001
From: kdletters <61648117+kdletters@users.noreply.github.com>
Date: Wed, 23 Sep 2026 19:04:45 +0800
Subject: [PATCH] =?UTF-8?q?=E5=8F=91=E8=A1=8C=E5=8C=85=E4=B8=8A=E9=99=90?=
 =?UTF-8?q?=E6=8F=90=E5=8D=87=E5=88=B0=20200=20MiB=20=E5=B9=B6=E6=94=AF?=
 =?UTF-8?q?=E6=8C=81=20AGC=20=E5=88=86=E7=89=87=E7=BB=AD=E4=BC=A0=E4=B8=8A?=
 =?UTF-8?q?=E4=BC=A0=20-=20=E5=8F=91=E8=A1=8C=E5=8C=85=E4=B8=8A=E9=99=90?=
 =?UTF-8?q?=20100=E2=86=92200=20MiB=E3=80=81=E5=B1=95=E5=BC=80=E6=80=BB?=
 =?UTF-8?q?=E9=87=8F=20250=E2=86=92500=20MiB=EF=BC=8C=E6=95=B4=E5=8C=85?=
 =?UTF-8?q?=E8=B7=AF=E7=94=B1=E8=AF=B7=E6=B1=82=E4=BD=93=E4=B8=8A=E9=99=90?=
 =?UTF-8?q?=E7=BB=A7=E7=BB=AD=E4=BB=8E=E5=8C=85=E4=B8=8A=E9=99=90=E6=B4=BE?=
 =?UTF-8?q?=E7=94=9F=EF=BC=9B=E5=8F=91=E8=A1=8C=E9=9D=99=E6=80=81=E8=B5=84?=
 =?UTF-8?q?=E6=BA=90=E8=BF=9B=E7=A8=8B=E5=86=85=E7=BC=93=E5=AD=98=E9=A2=84?=
 =?UTF-8?q?=E7=AE=97=E6=8F=90=E5=88=B0=20256=20MiB=20-=20=E5=8F=8D?=
 =?UTF-8?q?=E4=BB=A3=E6=94=BE=E8=A1=8C=E9=87=8F=E5=90=8C=E6=AD=A5=E6=94=BE?=
 =?UTF-8?q?=E5=AE=BD=E5=88=B0=20210=20MiB=EF=BC=9ANginx=20=E4=B8=89?=
 =?UTF-8?q?=E4=BB=BD=E6=A8=A1=E6=9D=BF=E7=9A=84=20client=5Fmax=5Fbody=5Fsi?=
 =?UTF-8?q?ze=E3=80=81Pingora=20=E7=BD=91=E5=85=B3=E9=BB=98=E8=AE=A4?=
 =?UTF-8?q?=E5=80=BC=E4=B8=8E=20env=20=E6=A0=B7=E4=BE=8B=E3=80=81=E8=B7=AF?=
 =?UTF-8?q?=E7=94=B1=E5=AF=B9=E7=85=A7=E7=9F=A9=E9=98=B5=20-=20platform-os?=
 =?UTF-8?q?s=20=E6=96=B0=E5=A2=9E=E5=86=85=E9=83=A8=E5=AF=B9=E8=B1=A1?=
 =?UTF-8?q?=E8=BF=BD=E5=8A=A0=E5=86=99=20append=5Finternal=5Fobject(=5Fwit?=
 =?UTF-8?q?h=5Fretry)=EF=BC=8C=E4=BB=A5=20OSS=20=E8=BF=94=E5=9B=9E?=
 =?UTF-8?q?=E7=9A=84=20next-append-position=20=E4=BD=9C=E4=B8=BA=E6=9D=83?=
 =?UTF-8?q?=E5=A8=81=E5=B7=B2=E6=94=B6=E5=AD=97=E8=8A=82=20-=20api-server?=
 =?UTF-8?q?=20=E6=96=B0=E5=A2=9E=20upload-state=20/=20chunk=20/=20complete?=
 =?UTF-8?q?=20/=20reset=20=E5=9B=9B=E6=9D=A1=E5=88=86=E7=89=87=E8=B7=AF?=
 =?UTF-8?q?=E7=94=B1=EF=BC=8C=E6=8A=BD=E5=87=BA=E5=85=B1=E4=BA=AB=E6=94=B6?=
 =?UTF-8?q?=E5=8F=A3=20confirm=5Fvalidated=5Fpackage=EF=BC=9B=E5=81=8F?=
 =?UTF-8?q?=E7=A7=BB=E4=B8=8D=E7=AC=A6=E8=BF=94=E5=9B=9E=20409=20=E4=B8=8E?=
 =?UTF-8?q?=E6=9D=83=E5=A8=81=E5=81=8F=E7=A7=BB=EF=BC=8C=E6=A0=A1=E9=AA=8C?=
 =?UTF-8?q?=E5=A4=B1=E8=B4=A5=E5=88=A0=E9=99=A4=E5=8D=8A=E5=8C=85=E5=B9=B6?=
 =?UTF-8?q?=E8=90=BD=20upload=5Ffailed=20-=20AGC=20=E6=96=B0=E5=A2=9E?=
 =?UTF-8?q?=E5=8E=9F=E7=94=9F=E4=B8=8A=E4=BC=A0=E5=99=A8=20game=5Fpackage?=
 =?UTF-8?q?=5Fupload.rs=EF=BC=88=E5=86=85=E5=AE=B9=E5=AF=BB=E5=9D=80?=
 =?UTF-8?q?=E6=9A=82=E5=AD=98=E3=80=81=E5=88=86=E7=89=87=E7=BB=AD=E4=BC=A0?=
 =?UTF-8?q?=E3=80=81=E5=8F=97=E6=8E=A7=E9=87=8D=E8=AF=95=E3=80=81=E8=BF=9B?=
 =?UTF-8?q?=E5=BA=A6=E4=BA=8B=E4=BB=B6=EF=BC=89=E4=B8=8E=20prepare=20/=20u?=
 =?UTF-8?q?pload=20=E4=B8=A4=E6=9D=A1=E5=91=BD=E4=BB=A4=EF=BC=8C=E9=80=80?=
 =?UTF-8?q?=E5=BD=B9=E6=95=B4=E5=8C=85=E5=9B=9E=E4=BC=A0=E5=91=BD=E4=BB=A4?=
 =?UTF-8?q?=20-=20=E6=B8=B2=E6=9F=93=E8=BF=9B=E7=A8=8B=E6=94=B9=E4=B8=BA?=
 =?UTF-8?q?=20prepare=20=E2=86=92=20=E5=88=9B=E5=BB=BA=E6=B8=B8=E6=88=8F?=
 =?UTF-8?q?=20=E2=86=92=20=E5=88=9B=E5=BB=BA=E7=89=88=E6=9C=AC=20=E2=86=92?=
 =?UTF-8?q?=20=E5=8E=9F=E7=94=9F=E5=88=86=E7=89=87=E4=B8=8A=E4=BC=A0=20?=
 =?UTF-8?q?=E2=86=92=20=E9=80=81=E5=AE=A1=EF=BC=8CLocalProjectExportPackag?=
 =?UTF-8?q?ePayload=20=E6=95=B4=E5=8C=85=E7=B1=BB=E5=9E=8B=E9=80=80?=
 =?UTF-8?q?=E5=BD=B9=20-=20=E5=90=8C=E6=97=B6=E4=BF=AE=E6=AD=A3=20live=20?=
 =?UTF-8?q?=E7=94=A8=E4=BE=8B=E6=97=A0=E6=B3=95=E6=8C=87=E5=90=91=E6=9C=AC?=
 =?UTF-8?q?=E5=9C=B0=E6=A0=88=E7=9A=84=E4=B8=A4=E5=A4=84=E5=9F=BA=E7=A1=80?=
 =?UTF-8?q?=E8=AE=BE=E6=96=BD=E9=97=AE=E9=A2=98=EF=BC=9A=E5=B9=B3=E5=8F=B0?=
 =?UTF-8?q?=E5=9F=BA=E5=9D=80=E6=8C=89=E4=BC=A0=E5=85=A5=20URL=20=E9=80=89?=
 =?UTF-8?q?=E6=8B=A9=EF=BC=8C=E6=A1=A5=E6=8E=A5=E5=B1=82=E6=8A=8A=20jsdom?=
 =?UTF-8?q?=20realm=20=E7=9A=84=20Headers=20/=20Blob=20/=20FormData=20?=
 =?UTF-8?q?=E9=99=8D=E7=BA=A7=E6=88=90=20Node=20=E5=8E=9F=E7=94=9F?=
 =?UTF-8?q?=E5=80=BC=20-=20=E6=B5=8B=E8=AF=95=EF=BC=9Aplatform-oss=2074?=
 =?UTF-8?q?=E3=80=81api-server=20game=5Fdistribution=2023=E3=80=81AGC=20?=
 =?UTF-8?q?=E5=8E=9F=E7=94=9F=204=E3=80=81=E5=8F=91=E5=B8=83=E7=9B=B8?=
 =?UTF-8?q?=E5=85=B3=E5=89=8D=E7=AB=AF=2020=EF=BC=9Blive=20=E7=94=A8?=
 =?UTF-8?q?=E4=BE=8B=E8=A1=A5=E7=9C=9F=E5=AE=9E=E6=A0=88=E3=80=8C=E4=B8=AD?=
 =?UTF-8?q?=E6=96=AD=20=E2=86=92=20=E7=BB=AD=E4=BC=A0=20=E2=86=92=20?=
 =?UTF-8?q?=E7=A1=AE=E8=AE=A4=E3=80=8D=E6=96=AD=E8=A8=80=EF=BC=88=E5=88=86?=
 =?UTF-8?q?=E7=89=87=E5=81=8F=E7=A7=BB=E5=BA=8F=E5=88=97=20[0,=208388608]?=
 =?UTF-8?q?=EF=BC=89=20-=20=E6=96=87=E6=A1=A3=EF=BC=9A=E7=8E=A9=E6=B3=95?=
 =?UTF-8?q?=E5=88=9B=E4=BD=9C=E4=B8=BB=E8=A7=84=E8=8C=83=E7=9A=84=E4=B8=8A?=
 =?UTF-8?q?=E4=BC=A0=E5=90=88=E5=90=8C=E3=80=81=E8=BF=90=E7=BB=B4=E4=B8=8E?=
 =?UTF-8?q?=20Pingora=20=E6=96=87=E6=A1=A3=E3=80=81=E5=86=B3=E7=AD=96?=
 =?UTF-8?q?=E8=AE=B0=E5=BD=95=E3=80=81=E5=8F=91=E8=A1=8C=E9=87=8C=E7=A8=8B?=
 =?UTF-8?q?=E7=A2=91=E5=8F=A3=E5=BE=84=EF=BC=8C=E4=BB=A5=E5=8F=8A=E6=96=B0?=
 =?UTF-8?q?=E5=A2=9E=E7=9A=84=E7=BB=AD=E4=BC=A0=E9=87=8C=E7=A8=8B=E7=A2=91?=
 =?UTF-8?q?=E4=B8=8E=E5=AE=9E=E6=96=BD=E8=AE=A1=E5=88=92?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../src-tauri/src/commands.rs                 |  73 ++-
 .../src-tauri/src/game_package_upload.rs      | 533 +++++++++++++++++
 .../src-tauri/src/main.rs                     |   4 +-
 apps/ai-game-creator-shell/src/app/types.ts   |  17 +-
 .../src/services/gameDistributionPublish.ts   |  60 +-
 .../tests/gameDistributionPublish.test.ts     |  78 +--
 .../tests/gameDistributionPublishLive.test.ts | 296 +++++++++-
 deploy/container/nginx.conf                   |   5 +-
 deploy/nginx/README.md                        |   4 +-
 deploy/nginx/genarrative-dev-http.conf        |   5 +-
 deploy/nginx/genarrative.conf                 |   5 +-
 deploy/pingora/nginx-route-parity.matrix.json |   4 +-
 deploy/pingora/pingora-gateway.env.example    |   2 +-
 ...žæ–½è®¡åˆ’】AGCå�‘行包分片续传上传-2026-09-23.md |  49 ++
 ...里程碑】AGC�行包分片续传上传-2026-09-23.md |  58 ++
 ...‹ç¢‘】游æˆ�分å�‘目录详情与在线游玩-2026-09-18.md |   2 +-
 .../shared-memory/decision-log.md             |  15 +
 ...开��维】Pingora独立网关试点-2026-06-11.md |   2 +-
 ...��维】本地开�验�与生产�维-2026-05-15.md |   2 +-
 ...�玩法创作】平�入�与玩法链路-2026-05-15.md |   7 +-
 .../src/modules/game_distribution.rs          | 536 ++++++++++++++++--
 .../module-game-distribution/src/package.rs   |  49 +-
 server-rs/crates/pingora-gateway/src/main.rs  |   4 +-
 server-rs/crates/platform-oss/src/lib.rs      | 124 +++-
 .../game-distribution/gameZipPackage.test.ts  |  10 +-
 .../game-distribution/gameZipPackage.ts       |   4 +-
 26 files changed, 1779 insertions(+), 169 deletions(-)
 create mode 100644 apps/ai-game-creator-shell/src-tauri/src/game_package_upload.rs
 create mode 100644 docs/project-memory/plans/�实施计划】AGC�行包分片续传上传-2026-09-23.md
 create mode 100644 docs/project-memory/plans/�里程碑】AGC�行包分片续传上传-2026-09-23.md

diff --git a/apps/ai-game-creator-shell/src-tauri/src/commands.rs b/apps/ai-game-creator-shell/src-tauri/src/commands.rs
index a18bdb369..4dbb39ad7 100644
--- a/apps/ai-game-creator-shell/src-tauri/src/commands.rs
+++ b/apps/ai-game-creator-shell/src-tauri/src/commands.rs
@@ -5935,14 +5935,81 @@ pub(crate) async fn export_local_project_package(
     export_local_project_package_for_publish_at(root).await
 }
 
+/// 把归一化�的�行包�到内容寻�的暂存文件，返回分片续传所需的元数�。
+///
+/// �布链路从此�把「暂存路径 + 摘� + 体积�交给渲染进程：整包字节���过
+/// WebView IPC，续传时也�用�一个暂存文件（���内容）。
 #[tauri::command]
-pub(crate) fn read_local_project_export_package(
+pub(crate) fn prepare_local_project_game_package(
+    app: tauri::AppHandle,
     project_path: String,
     package_relative_path: String,
-) -> Result<LocalProjectExportPackagePayload, String> {
+) -> Result<crate::game_package_upload::StagedGamePackage, String> {
     let root = Path::new(project_path.trim());
     enforce_project_permission_policy(root, "project.export_package")?;
-    read_local_project_export_package_at(root, package_relative_path.trim())
+    let payload = read_local_project_export_package_at(root, package_relative_path.trim())?;
+    let staging_dir = game_package_upload_staging_dir(&app)?;
+    let mut staged = crate::game_package_upload::stage_game_package_bytes(
+        &staging_dir,
+        &payload.package_sha256,
+        &payload.package_bytes,
+    )?;
+    staged.package_file_count = u32::try_from(payload.files.len()).unwrap_or(u32::MAX);
+    Ok(staged)
+}
+
+/// 分片续传上传暂存的�行包；进度通过 `game-package-upload-progress` 事件回传。
+#[tauri::command]
+pub(crate) async fn upload_local_project_game_package(
+    app: tauri::AppHandle,
+    staging_path: String,
+    version_id: String,
+    api_base_url: String,
+    access_token: String,
+    idempotency_key: String,
+) -> Result<crate::game_package_upload::GamePackageUploadOutcome, String> {
+    let staging_dir = game_package_upload_staging_dir(&app)?;
+    let resolved_path =
+        crate::game_package_upload::ensure_staging_path_in_dir(&staging_dir, &staging_path)?;
+    let client = reqwest::Client::builder()
+        .build()
+        .map_err(|error| format!("创建上传客户端失败：{error}"))?;
+    let version_id = version_id.trim().to_string();
+    if version_id.is_empty() {
+        return Err("缺少�行版本标识".to_string());
+    }
+    let emit_handle = app.clone();
+    let progress_version_id = version_id.clone();
+    crate::game_package_upload::upload_staged_game_package(
+        &client,
+        crate::game_package_upload::GamePackageUploadRequest {
+            staging_path: &resolved_path,
+            version_id: &version_id,
+            api_base_url: api_base_url.trim(),
+            access_token: access_token.trim(),
+            idempotency_key: idempotency_key.trim(),
+        },
+        move |received_bytes, total_bytes| {
+            let _ = emit_handle.emit(
+                crate::game_package_upload::GAME_PACKAGE_UPLOAD_PROGRESS_EVENT,
+                crate::game_package_upload::progress_event_payload(
+                    &progress_version_id,
+                    received_bytes,
+                    total_bytes,
+                ),
+            );
+        },
+    )
+    .await
+}
+
+fn game_package_upload_staging_dir(app: &tauri::AppHandle) -> Result<PathBuf, String> {
+    app.path()
+        .app_data_dir()
+        .map(|app_data_root| {
+            crate::game_package_upload::game_package_upload_staging_dir(&app_data_root)
+        })
+        .map_err(|error| format!("无法读� AGC 应用数�目录：{error}"))
 }
 
 #[tauri::command]
diff --git a/apps/ai-game-creator-shell/src-tauri/src/game_package_upload.rs b/apps/ai-game-creator-shell/src-tauri/src/game_package_upload.rs
new file mode 100644
index 000000000..c52745b45
--- /dev/null
+++ b/apps/ai-game-creator-shell/src-tauri/src/game_package_upload.rs
@@ -0,0 +1,533 @@
+//! AGC �行包的分片续传上传。
+//!
+//! 一键�布��把整包字节交给 WebView：这里在原生进程中读�本地（或暂存）的试玩包，
+//! 按�务端下�的分片大�顺���，并以�务端返回的**���移**续传；进度通过事件
+//! 回传渲染进程。传输失败�应用����新�布都�补传缺失字节，��放整包。
+
+use std::{
+    fs::{self, File},
+    io::{Read, Seek, SeekFrom, Write},
+    path::{Path, PathBuf},
+    time::Duration,
+};
+
+use serde::{Deserialize, Serialize};
+use serde_json::{json, Value};
+
+pub(crate) const GAME_PACKAGE_UPLOAD_PROGRESS_EVENT: &str = "game-package-upload-progress";
+
+const AGC_CLIENT_MARKER_HEADER: &str = "X-Genarrative-Client";
+const AGC_CLIENT_MARKER_VALUE: &str = "agc";
+const UPLOAD_OFFSET_HEADER: &str = "x-genarrative-upload-offset";
+/// �务端下�的分片大�上�；客户端�按�务端给的值�，超过它必然被拒。
+const MAX_CHUNK_BYTES: u64 = 8 * 1024 * 1024;
+const CHUNK_MAX_ATTEMPTS: usize = 4;
+const CHUNK_RETRY_DELAY: Duration = Duration::from_millis(500);
+const UPLOAD_STAGING_DIR_NAME: &str = "game-package-staging";
+
+/// 已暂存（归一化�）的�行包：内容寻�，����一包�用�一个文件，续传�有�义。
+#[derive(Clone, Debug, Deserialize, PartialEq, Eq, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub(crate) struct StagedGamePackage {
+    pub(crate) staging_path: String,
+    pub(crate) package_sha256: String,
+    pub(crate) package_size_bytes: u64,
+    pub(crate) package_file_count: u32,
+}
+
+#[derive(Clone, Debug, Deserialize, PartialEq, Eq, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub(crate) struct GamePackageUploadOutcome {
+    pub(crate) version_id: String,
+    pub(crate) status: String,
+    pub(crate) uploaded_bytes: u64,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+struct ChunkPlan {
+    offset: u64,
+    length: u64,
+}
+
+#[derive(Clone, Debug, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+struct PackageUploadState {
+    #[serde(default)]
+    received_bytes: u64,
+    #[serde(default)]
+    chunk_bytes: u64,
+    #[serde(default)]
+    declared_package_bytes: u64,
+}
+
+/// 暂存目录：放在应用数�目录下，�写进项目�也��与项目快照�步。
+pub(crate) fn game_package_upload_staging_dir(app_data_dir: &Path) -> PathBuf {
+    app_data_dir.join(UPLOAD_STAGING_DIR_NAME)
+}
+
+/// 把归一化�的�行包暂存到内容寻�文件，返回续传所需的元数�。
+pub(crate) fn stage_game_package_bytes(
+    staging_dir: &Path,
+    package_sha256: &str,
+    package_bytes: &[u8],
+) -> Result<StagedGamePackage, String> {
+    if package_bytes.is_empty() {
+        return Err("�行包内容为空，请�新导出试玩包".to_string());
+    }
+    if package_sha256.len() != 64 || !package_sha256.chars().all(|c| c.is_ascii_hexdigit()) {
+        return Err("�行包摘�无效，请�新导出试玩包".to_string());
+    }
+    fs::create_dir_all(staging_dir).map_err(|error| format!("创建�行包暂存目录失败：{error}"))?;
+    let staging_path = staging_dir.join(format!("{package_sha256}.zip"));
+    if !staging_path.is_file() {
+        let temporary_path = staging_dir.join(format!("{package_sha256}.zip.tmp"));
+        let mut file = File::create(&temporary_path)
+            .map_err(|error| format!("写入�行包暂存文件失败：{error}"))?;
+        file.write_all(package_bytes)
+            .map_err(|error| format!("写入�行包暂存文件失败：{error}"))?;
+        file.sync_all()
+            .map_err(|error| format!("刷写�行包暂存文件失败：{error}"))?;
+        drop(file);
+        fs::rename(&temporary_path, &staging_path)
+            .map_err(|error| format!("�交�行包暂存文件失败：{error}"))?;
+    }
+    Ok(StagedGamePackage {
+        staging_path: staging_path.to_string_lossy().to_string(),
+        package_sha256: package_sha256.to_string(),
+        package_size_bytes: package_bytes.len() as u64,
+        package_file_count: 0,
+    })
+}
+
+/// 暂存文件必须�在暂存目录内；渲染进程�能借这�命令读任�路径。
+pub(crate) fn ensure_staging_path_in_dir(
+    staging_dir: &Path,
+    staging_path: &str,
+) -> Result<PathBuf, String> {
+    let candidate = PathBuf::from(staging_path.trim());
+    let parent = candidate
+        .parent()
+        .ok_or_else(|| "�行包暂存路径无效".to_string())?;
+    let canonical_parent = parent
+        .canonicalize()
+        .map_err(|error| format!("�行包暂存目录��用：{error}"))?;
+    let canonical_dir = staging_dir
+        .canonicalize()
+        .map_err(|error| format!("�行包暂存目录��用：{error}"))?;
+    if canonical_parent != canonical_dir {
+        return Err("�行包暂存路径越界".to_string());
+    }
+    if !candidate.is_file() {
+        return Err("�行包暂存文件�存在，请�新导出试玩包".to_string());
+    }
+    Ok(candidate)
+}
+
+/// 下一次���的分片；`None` 表示整包已收�。
+fn next_chunk_plan(received: u64, total: u64, chunk_bytes: u64) -> Option<ChunkPlan> {
+    if received >= total || chunk_bytes == 0 {
+        return None;
+    }
+    Some(ChunkPlan {
+        offset: received,
+        length: chunk_bytes.min(total - received),
+    })
+}
+
+fn read_chunk(file: &mut File, plan: ChunkPlan) -> Result<Vec<u8>, String> {
+    file.seek(SeekFrom::Start(plan.offset))
+        .map_err(|error| format!("读��行包失败：{error}"))?;
+    let mut buffer = vec![0_u8; usize::try_from(plan.length).unwrap_or(0)];
+    file.read_exact(&mut buffer)
+        .map_err(|error| format!("读��行包失败：{error}"))?;
+    Ok(buffer)
+}
+
+fn upload_url(base_url: &str, version_id: &str, suffix: &str) -> String {
+    format!(
+        "{}/api/game-distribution/versions/{version_id}/package{suffix}",
+        base_url.trim_end_matches('/')
+    )
+}
+
+/// �务端错误信�：兼容带 envelope 的 `{ error: { code, message } }` 与旧形状。
+fn parse_server_error(status: u16, body: &str) -> (Option<String>, Option<String>) {
+    let parsed = serde_json::from_str::<Value>(body).ok();
+    let error = parsed
+        .as_ref()
+        .and_then(|value| value.get("error"))
+        .cloned();
+    let code = error
+        .as_ref()
+        .and_then(|value| value.get("code"))
+        .or_else(|| parsed.as_ref().and_then(|value| value.get("code")))
+        .and_then(Value::as_str)
+        .map(str::to_string);
+    let message = error
+        .as_ref()
+        .and_then(|value| value.get("message"))
+        .or_else(|| parsed.as_ref().and_then(|value| value.get("message")))
+        .and_then(Value::as_str)
+        .map(str::to_string);
+    let _ = status;
+    (code, message)
+}
+
+/// 从 409 �应里���已收字节；��到就返回 `None`，由调用方按失败处�。
+fn parse_received_bytes(body: &str) -> Option<u64> {
+    let parsed = serde_json::from_str::<Value>(body).ok()?;
+    let error = parsed.get("error").unwrap_or(&parsed);
+    error
+        .get("details")
+        .and_then(|details| details.get("receivedBytes"))
+        .or_else(|| error.get("receivedBytes"))
+        .and_then(Value::as_u64)
+}
+
+fn platform_request(
+    client: &reqwest::Client,
+    access_token: &str,
+    method: reqwest::Method,
+    url: &str,
+) -> reqwest::RequestBuilder {
+    client
+        .request(method, url)
+        .header(AGC_CLIENT_MARKER_HEADER, AGC_CLIENT_MARKER_VALUE)
+        .header(
+            reqwest::header::AUTHORIZATION,
+            format!("Bearer {access_token}"),
+        )
+}
+
+async fn read_upload_state(
+    client: &reqwest::Client,
+    base_url: &str,
+    version_id: &str,
+    access_token: &str,
+) -> Result<PackageUploadState, String> {
+    let response = platform_request(
+        client,
+        access_token,
+        reqwest::Method::GET,
+        &upload_url(base_url, version_id, "/upload-state"),
+    )
+    .send()
+    .await
+    .map_err(|error| format!("无法连接登录�务，请确认�套�端或 API 代�已�动��试：{error}"))?;
+    let status = response.status().as_u16();
+    let body = response
+        .text()
+        .await
+        .map_err(|error| format!("读�上传状�失败：{error}"))?;
+    if status >= 400 {
+        let (_, message) = parse_server_error(status, &body);
+        return Err(message.unwrap_or_else(|| format!("读�上传状�失败（HTTP {status}）")));
+    }
+    let parsed: Value = serde_json::from_str(&body)
+        .map_err(|error| format!("上传状��应�是�法 JSON：{error}"))?;
+    let payload = parsed.get("data").unwrap_or(&parsed);
+    serde_json::from_value(payload.clone())
+        .map_err(|error| format!("上传状��应缺少字段：{error}"))
+}
+
+/// 上传一个分片；返回�务端确认�的已收字节。
+async fn upload_chunk(
+    client: &reqwest::Client,
+    base_url: &str,
+    version_id: &str,
+    access_token: &str,
+    idempotency_key: &str,
+    plan: ChunkPlan,
+    body: Vec<u8>,
+) -> Result<u64, ChunkUploadError> {
+    let response = platform_request(
+        client,
+        access_token,
+        reqwest::Method::PUT,
+        &upload_url(base_url, version_id, "/chunk"),
+    )
+    .header(reqwest::header::CONTENT_TYPE, "application/octet-stream")
+    .header(UPLOAD_OFFSET_HEADER, plan.offset.to_string())
+    .header("Idempotency-Key", format!("{idempotency_key}:chunk"))
+    .body(body)
+    .send()
+    .await
+    .map_err(|error| ChunkUploadError::Retryable(format!("�行包分片��失败：{error}")))?;
+    let status = response.status().as_u16();
+    let text = response
+        .text()
+        .await
+        .map_err(|error| ChunkUploadError::Retryable(format!("读�分片�应失败：{error}")))?;
+    if status == 409 {
+        let (code, message) = parse_server_error(status, &text);
+        if code.as_deref() == Some("PACKAGE_UPLOAD_OFFSET_MISMATCH") {
+            let received = parse_received_bytes(&text).ok_or_else(|| {
+                ChunkUploadError::Fatal("分片�移�一致，但�务端未返回���移".to_string())
+            })?;
+            return Ok(received);
+        }
+        return Err(ChunkUploadError::Fatal(
+            message.unwrap_or_else(|| "�行包分片被拒�".to_string()),
+        ));
+    }
+    if status >= 500 || status == 408 || status == 429 {
+        let (_, message) = parse_server_error(status, &text);
+        return Err(ChunkUploadError::Retryable(
+            message.unwrap_or_else(|| format!("�行包分片上传失败（HTTP {status}）")),
+        ));
+    }
+    if status >= 400 {
+        let (_, message) = parse_server_error(status, &text);
+        return Err(ChunkUploadError::Fatal(
+            message.unwrap_or_else(|| format!("�行包分片被拒�（HTTP {status}）")),
+        ));
+    }
+    let parsed: Value = serde_json::from_str(&text)
+        .map_err(|error| ChunkUploadError::Retryable(format!("分片�应�是�法 JSON：{error}")))?;
+    let payload = parsed.get("data").unwrap_or(&parsed);
+    payload
+        .get("receivedBytes")
+        .and_then(Value::as_u64)
+        .ok_or_else(|| ChunkUploadError::Fatal("分片�应缺少 receivedBytes".to_string()))
+}
+
+enum ChunkUploadError {
+    Retryable(String),
+    Fatal(String),
+}
+
+async fn complete_upload(
+    client: &reqwest::Client,
+    base_url: &str,
+    version_id: &str,
+    access_token: &str,
+    idempotency_key: &str,
+) -> Result<GamePackageUploadOutcome, String> {
+    let response = platform_request(
+        client,
+        access_token,
+        reqwest::Method::POST,
+        &upload_url(base_url, version_id, "/complete"),
+    )
+    .header("Idempotency-Key", format!("{idempotency_key}:complete"))
+    .send()
+    .await
+    .map_err(|error| format!("完��行包上传失败：{error}"))?;
+    let status = response.status().as_u16();
+    let text = response
+        .text()
+        .await
+        .map_err(|error| format!("读�完��应失败：{error}"))?;
+    if status >= 400 {
+        let (_, message) = parse_server_error(status, &text);
+        return Err(message.unwrap_or_else(|| format!("完��行包上传失败（HTTP {status}）")));
+    }
+    let parsed: Value =
+        serde_json::from_str(&text).map_err(|error| format!("完��应�是�法 JSON：{error}"))?;
+    let payload = parsed.get("data").unwrap_or(&parsed);
+    Ok(GamePackageUploadOutcome {
+        version_id: payload
+            .get("versionId")
+            .and_then(Value::as_str)
+            .unwrap_or(version_id)
+            .to_string(),
+        status: payload
+            .get("status")
+            .and_then(Value::as_str)
+            .unwrap_or("uploaded")
+            .to_string(),
+        uploaded_bytes: 0,
+    })
+}
+
+pub(crate) struct GamePackageUploadRequest<'a> {
+    pub(crate) staging_path: &'a Path,
+    pub(crate) version_id: &'a str,
+    pub(crate) api_base_url: &'a str,
+    pub(crate) access_token: &'a str,
+    pub(crate) idempotency_key: &'a str,
+}
+
+/// 分片续传主循环：���移�自�务端，失败按��试分类退�，�移�符立�按���移继续。
+pub(crate) async fn upload_staged_game_package(
+    client: &reqwest::Client,
+    request: GamePackageUploadRequest<'_>,
+    mut on_progress: impl FnMut(u64, u64),
+) -> Result<GamePackageUploadOutcome, String> {
+    let total_bytes = fs::metadata(request.staging_path)
+        .map_err(|error| format!("读��行包暂存文件失败：{error}"))?
+        .len();
+    if total_bytes == 0 {
+        return Err("�行包暂存文件为空，请�新导出试玩包".to_string());
+    }
+    let state = read_upload_state(
+        client,
+        request.api_base_url,
+        request.version_id,
+        request.access_token,
+    )
+    .await?;
+    if state.declared_package_bytes != 0 && state.declared_package_bytes != total_bytes {
+        return Err(format!(
+            "本地�行包与版本声明的体积�一致（本地 {} 字节，声明 {} 字节），请�新导出���布",
+            total_bytes, state.declared_package_bytes
+        ));
+    }
+    let chunk_bytes = if state.chunk_bytes == 0 {
+        MAX_CHUNK_BYTES
+    } else {
+        state.chunk_bytes.min(MAX_CHUNK_BYTES)
+    };
+    let mut received = state.received_bytes.min(total_bytes);
+    on_progress(received, total_bytes);
+    let mut file = File::open(request.staging_path)
+        .map_err(|error| format!("打开�行包暂存文件失败：{error}"))?;
+    while let Some(plan) = next_chunk_plan(received, total_bytes, chunk_bytes) {
+        let body = read_chunk(&mut file, plan)?;
+        let mut attempt = 1_usize;
+        loop {
+            match upload_chunk(
+                client,
+                request.api_base_url,
+                request.version_id,
+                request.access_token,
+                request.idempotency_key,
+                plan,
+                body.clone(),
+            )
+            .await
+            {
+                Ok(next_received) => {
+                    received = next_received.min(total_bytes);
+                    on_progress(received, total_bytes);
+                    break;
+                }
+                Err(ChunkUploadError::Fatal(error)) => return Err(error),
+                Err(ChunkUploadError::Retryable(error)) => {
+                    if attempt >= CHUNK_MAX_ATTEMPTS {
+                        return Err(format!("{error}（已�试 {attempt} 次，��新�布续传）"));
+                    }
+                    attempt += 1;
+                    tokio::time::sleep(CHUNK_RETRY_DELAY).await;
+                }
+            }
+        }
+        // ���移�能在�试期间�进（例如�应丢失��务端已写入），按�务端�径对�。
+        let authoritative = read_upload_state(
+            client,
+            request.api_base_url,
+            request.version_id,
+            request.access_token,
+        )
+        .await?;
+        received = authoritative.received_bytes.min(total_bytes);
+        on_progress(received, total_bytes);
+    }
+    let mut outcome = complete_upload(
+        client,
+        request.api_base_url,
+        request.version_id,
+        request.access_token,
+        request.idempotency_key,
+    )
+    .await?;
+    outcome.uploaded_bytes = total_bytes;
+    Ok(outcome)
+}
+
+/// 进度事件的载�形状（渲染进程按它显示进度）。
+pub(crate) fn progress_event_payload(
+    version_id: &str,
+    received_bytes: u64,
+    total_bytes: u64,
+) -> Value {
+    json!({
+        "versionId": version_id,
+        "receivedBytes": received_bytes,
+        "totalBytes": total_bytes,
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn chunk_plan_covers_whole_package_without_gaps_or_overlap() {
+        let total = 20 * 1024 * 1024 + 3;
+        let chunk = 8 * 1024 * 1024;
+        let mut received = 0_u64;
+        let mut plans = Vec::new();
+        while let Some(plan) = next_chunk_plan(received, total, chunk) {
+            plans.push(plan);
+            received += plan.length;
+        }
+        assert_eq!(received, total);
+        assert_eq!(plans.len(), 3);
+        assert_eq!(plans[0].offset, 0);
+        assert_eq!(plans[1].offset, chunk);
+        assert_eq!(plans[2].length, 4 * 1024 * 1024 + 3);
+        assert!(next_chunk_plan(total, total, chunk).is_none());
+        assert!(next_chunk_plan(0, total, 0).is_none());
+    }
+
+    #[test]
+    fn offset_mismatch_response_yields_authoritative_position() {
+        let body = r#"{"error":{"code":"PACKAGE_UPLOAD_OFFSET_MISMATCH","message":"�移�一致","details":{"provider":"game-distribution","receivedBytes":16777216}}}"#;
+        assert_eq!(parse_received_bytes(body), Some(16_777_216));
+        let (code, message) = parse_server_error(409, body);
+        assert_eq!(code.as_deref(), Some("PACKAGE_UPLOAD_OFFSET_MISMATCH"));
+        assert_eq!(message.as_deref(), Some("�移�一致"));
+
+        let legacy =
+            r#"{"error":{"code":"PACKAGE_UPLOAD_INCOMPLETE","message":"未收�"},"meta":{}}"#;
+        assert_eq!(parse_received_bytes(legacy), None);
+        assert_eq!(
+            parse_server_error(409, legacy).0.as_deref(),
+            Some("PACKAGE_UPLOAD_INCOMPLETE")
+        );
+    }
+
+    #[test]
+    fn upload_url_joins_base_without_double_slash() {
+        assert_eq!(
+            upload_url("https://dev.genarrative.world/", "ver-1", "/chunk"),
+            "https://dev.genarrative.world/api/game-distribution/versions/ver-1/package/chunk"
+        );
+        assert_eq!(
+            upload_url("http://127.0.0.1:10001", "ver 1", "/complete"),
+            "http://127.0.0.1:10001/api/game-distribution/versions/ver 1/package/complete"
+        );
+    }
+
+    #[test]
+    fn staging_file_is_content_addressed_and_reused() {
+        let dir = std::env::temp_dir().join(format!(
+            "agc-game-package-staging-test-{}",
+            std::process::id()
+        ));
+        let _ = fs::remove_dir_all(&dir);
+        let sha = "a".repeat(64);
+        let first = stage_game_package_bytes(&dir, &sha, b"package-bytes").expect("首次暂存应�功");
+        let second =
+            stage_game_package_bytes(&dir, &sha, b"package-bytes").expect("��暂存应�用");
+        assert_eq!(first.staging_path, second.staging_path);
+        assert_eq!(first.package_size_bytes, 13);
+        assert!(Path::new(&first.staging_path).is_file());
+        assert_eq!(
+            fs::read(&first.staging_path).expect("读�暂存文件"),
+            b"package-bytes"
+        );
+
+        let bad = stage_game_package_bytes(&dir, "not-a-sha", b"x");
+        assert!(bad.is_err());
+        let empty = stage_game_package_bytes(&dir, &sha, b"");
+        assert!(empty.is_err());
+
+        let outside = ensure_staging_path_in_dir(&dir, "/etc/passwd");
+        assert!(outside.is_err());
+        let inside = ensure_staging_path_in_dir(&dir, &first.staging_path);
+        assert!(inside.is_ok());
+        let _ = fs::remove_dir_all(&dir);
+    }
+}
diff --git a/apps/ai-game-creator-shell/src-tauri/src/main.rs b/apps/ai-game-creator-shell/src-tauri/src/main.rs
index 256c38c3d..3b356fcd6 100644
--- a/apps/ai-game-creator-shell/src-tauri/src/main.rs
+++ b/apps/ai-game-creator-shell/src-tauri/src/main.rs
@@ -132,6 +132,7 @@ mod editor_adapter;
 mod editor_adapters;
 mod environment_check;
 pub mod error_report;
+mod game_package_upload;
 mod git_inspect;
 mod goal;
 mod http_client;
@@ -2757,7 +2758,8 @@ fn main() {
             build_local_project_index,
             create_local_project_checkpoint,
             export_local_project_package,
-            read_local_project_export_package,
+            prepare_local_project_game_package,
+            upload_local_project_game_package,
             list_local_project_export_packages,
             diff_local_project_checkpoint,
             restore_local_project_checkpoint,
diff --git a/apps/ai-game-creator-shell/src/app/types.ts b/apps/ai-game-creator-shell/src/app/types.ts
index d1a93d69f..73f45325f 100644
--- a/apps/ai-game-creator-shell/src/app/types.ts
+++ b/apps/ai-game-creator-shell/src/app/types.ts
@@ -796,12 +796,21 @@ export interface LocalProjectExportPackageFileDigest {
   sha256: string;
 }
 
-export interface LocalProjectExportPackagePayload {
-  packageRelativePath: string;
-  packageBytes: number[];
+/**
+ * 已暂存的归一化�行包：�布链路�传递这个摘�与路径，整包字节留在原生进程里，
+ * ���过 WebView IPC。
+ */
+export interface StagedGamePackage {
+  stagingPath: string;
   packageSha256: string;
   packageSizeBytes: number;
-  files: LocalProjectExportPackageFileDigest[];
+  packageFileCount: number;
+}
+
+export interface GamePackageUploadOutcome {
+  versionId: string;
+  status: string;
+  uploadedBytes: number;
 }
 
 export interface LocalProjectExportPackageSummary {
diff --git a/apps/ai-game-creator-shell/src/services/gameDistributionPublish.ts b/apps/ai-game-creator-shell/src/services/gameDistributionPublish.ts
index 5e1a96402..993ccd754 100644
--- a/apps/ai-game-creator-shell/src/services/gameDistributionPublish.ts
+++ b/apps/ai-game-creator-shell/src/services/gameDistributionPublish.ts
@@ -7,10 +7,12 @@ import type {
   GameDistributionOrientation,
 } from '../../../../packages/shared/src/contracts/gameDistribution';
 import type {
-  LocalProjectExportPackagePayload,
+  GamePackageUploadOutcome,
+  StagedGamePackage,
   TauriInvoke,
 } from '../app/types';
-import { requestClientApi } from './clientApi';
+import { getStoredAuthAccessToken, requestClientApi } from './clientApi';
+import { getClientServerBaseUrl } from './clientHttp';
 
 export type GameDistributionPublishMetadata = {
   title: string;
@@ -328,20 +330,20 @@ export async function publishLocalProjectGame(args: {
   if (!projectPath || !packageRelativePath) {
     throw new Error('�布需�绑定本地项目和试玩包');
   }
-  const payload = await args.invoke<LocalProjectExportPackagePayload>(
-    'read_local_project_export_package',
+  // 整包字节�留在原生进程：这里拿到的是归一化�的摘�与内容寻�暂存路径，
+  // 上传由原生侧按�务端分片大�完�，中断��一暂存文件�直接续传。
+  const staged = await args.invoke<StagedGamePackage>(
+    'prepare_local_project_game_package',
     { projectPath, packageRelativePath },
   );
   if (
-    !payload.packageBytes.length ||
-    payload.packageSizeBytes !== payload.packageBytes.length ||
-    payload.files.length === 0
+    !staged.stagingPath.trim() ||
+    staged.packageSha256.length !== 64 ||
+    staged.packageSizeBytes <= 0 ||
+    staged.packageFileCount <= 0
   ) {
     throw new Error('本地�行包摘�无效，请�新导出试玩包');
   }
-  if (payload.packageRelativePath !== packageRelativePath) {
-    throw new Error('本地�行包路径已�化，请�新导出试玩包');
-  }
 
   const metadata = normalizeMetadata(args.manifest, args.metadata);
   const localProjectId = args.manifest.projectId.trim();
@@ -369,9 +371,9 @@ export async function publishLocalProjectGame(args: {
 
   const versionRequest: GameDistributionCreateVersionRequest = {
     localProjectId,
-    packageSha256: payload.packageSha256,
-    packageBytes: payload.packageSizeBytes,
-    packageFileCount: payload.files.length,
+    packageSha256: staged.packageSha256,
+    packageBytes: staged.packageSizeBytes,
+    packageFileCount: staged.packageFileCount,
     packageEntryPath: 'index.html',
     gameMetadata,
   };
@@ -391,23 +393,19 @@ export async function publishLocalProjectGame(args: {
     throw new Error('创建�行版本未返回版本 ID');
   }
 
-  const packageBody = new Blob([new Uint8Array(payload.packageBytes)], {
-    type: 'application/zip',
-  });
-  const uploaded = await requestClientApi<{
-    versionId: string;
-    status: string;
-  }>(
-    `/api/game-distribution/versions/${encodeURIComponent(version.versionId)}/package`,
+  const accessToken = getStoredAuthAccessToken();
+  if (!accessToken) {
+    throw new Error('陶泥儿登录凭�缺失，请�新登录');
+  }
+  const uploaded = await args.invoke<GamePackageUploadOutcome>(
+    'upload_local_project_game_package',
     {
-      method: 'PUT',
-      headers: {
-        'Content-Type': 'application/zip',
-        'Idempotency-Key': `${rootKey}:upload`,
-      },
-      body: packageBody,
+      stagingPath: staged.stagingPath,
+      versionId: version.versionId,
+      apiBaseUrl: getClientServerBaseUrl(),
+      accessToken,
+      idempotencyKey: `${rootKey}:upload`,
     },
-    '上传游��行包失败',
   );
   const submitted = await requestClientApi<{
     game?: { publicationRevision?: number };
@@ -431,8 +429,8 @@ export async function publishLocalProjectGame(args: {
     versionId: version.versionId,
     versionNumber: version.versionNumber,
     status: submitted?.version?.status ?? uploaded?.status ?? 'pending_review',
-    packageSha256: payload.packageSha256,
-    packageSizeBytes: payload.packageSizeBytes,
-    fileCount: payload.files.length,
+    packageSha256: staged.packageSha256,
+    packageSizeBytes: staged.packageSizeBytes,
+    fileCount: staged.packageFileCount,
   };
 }
diff --git a/apps/ai-game-creator-shell/tests/gameDistributionPublish.test.ts b/apps/ai-game-creator-shell/tests/gameDistributionPublish.test.ts
index 9110172ea..e4aa8e332 100644
--- a/apps/ai-game-creator-shell/tests/gameDistributionPublish.test.ts
+++ b/apps/ai-game-creator-shell/tests/gameDistributionPublish.test.ts
@@ -14,6 +14,12 @@ vi.mock('../src/services/errorReporting', () => ({
   captureClientError: vi.fn(),
 }));
 
+// 原生侧上传需�登录凭�；这里�钉�「�到了 token�这一件事。
+vi.mock('../src/services/clientApi', async (importOriginal) => ({
+  ...(await importOriginal<typeof import('../src/services/clientApi')>()),
+  getStoredAuthAccessToken: () => 'test-access-token',
+}));
+
 import type { GameCreationAppManifest } from '../../../packages/shared/src/contracts/gameCreationApp';
 import {
   generateGameDistributionCover,
@@ -29,6 +35,14 @@ const MANIFEST = {
   goal: '守�轨�城',
 } as unknown as GameCreationAppManifest;
 
+/** 归一化�行包的暂存摘�；�布链路�应传递它，��传整包字节。 */
+const STAGED_PACKAGE = {
+  stagingPath: 'C:/app-data/game-package-staging/aaaa.zip',
+  packageSha256: 'a'.repeat(64),
+  packageSizeBytes: 1024,
+  packageFileCount: 1,
+};
+
 function jsonResponse(payload: unknown) {
   return new Response(
     JSON.stringify({
@@ -66,23 +80,25 @@ test('�布时�带本地项目标识，让���布�用�一个平�
         status: 'awaiting_upload',
       }),
     )
-    .mockResolvedValueOnce(
-      jsonResponse({ versionId: 'gamever_1', status: 'uploaded' }),
-    )
     .mockResolvedValueOnce(
       jsonResponse({ version: { status: 'pending_review' } }),
     );
 
+  const invokeCalls: Array<{ command: string; args: unknown }> = [];
   const result = await publishLocalProjectGame({
-    invoke: (async (command: string) => {
-      expect(command).toBe('read_local_project_export_package');
-      return {
-        packageRelativePath: 'exports/playtest-package-1.zip',
-        packageBytes: [1, 2, 3],
-        packageSha256: 'a'.repeat(64),
-        packageSizeBytes: 3,
-        files: [{ path: 'index.html', sizeBytes: 3, sha256: 'a'.repeat(64) }],
-      };
+    invoke: (async (command: string, args?: Record<string, unknown>) => {
+      invokeCalls.push({ command, args });
+      if (command === 'prepare_local_project_game_package') {
+        return STAGED_PACKAGE;
+      }
+      if (command === 'upload_local_project_game_package') {
+        return {
+          versionId: 'gamever_1',
+          status: 'uploaded',
+          uploadedBytes: STAGED_PACKAGE.packageSizeBytes,
+        };
+      }
+      throw new Error(`未预期的命令：${command}`);
     }) as never,
     projectPath: '/tmp/project',
     packageRelativePath: 'exports/playtest-package-1.zip',
@@ -113,18 +129,26 @@ test('�布时�带本地项目标识，让���布�用�一个平�
 
   expect(result.gameId).toBe('game_1');
   expect(result.versionId).toBe('gamever_1');
+
+  // 关键回归：整包字节���过 IPC，上传交给原生侧按版本 ID + 暂存路径完�。
+  const uploadCall = invokeCalls.find(
+    (call) => call.command === 'upload_local_project_game_package',
+  );
+  expect(uploadCall?.args).toMatchObject({
+    stagingPath: STAGED_PACKAGE.stagingPath,
+    versionId: 'gamever_1',
+    apiBaseUrl: 'https://dev.genarrative.world',
+    accessToken: 'test-access-token',
+  });
+  expect(Object.keys(uploadCall?.args ?? {})).not.toContain('packageBytes');
+  // 三次 HTTP：创建游��创建版本��审；上传���用一� HTTP 调用。
+  expect(fetchClientHttp).toHaveBeenCalledTimes(3);
 });
 
 test('缺少本地项目标识时在�起请求�失败关闭', async () => {
   await expect(
     publishLocalProjectGame({
-      invoke: (async () => ({
-        packageRelativePath: 'exports/playtest-package-1.zip',
-        packageBytes: [1],
-        packageSha256: 'a'.repeat(64),
-        packageSizeBytes: 1,
-        files: [{ path: 'index.html', sizeBytes: 1, sha256: 'a'.repeat(64) }],
-      })) as never,
+      invoke: (async () => STAGED_PACKAGE) as never,
       projectPath: '/tmp/project',
       packageRelativePath: 'exports/playtest-package-1.zip',
       manifest: { ...MANIFEST, projectId: '   ' } as GameCreationAppManifest,
@@ -137,13 +161,7 @@ test('缺少本地项目标识时在�起请求�失败关闭', async () => {
 test('缺少��时在创建游��失败关闭', async () => {
   await expect(
     publishLocalProjectGame({
-      invoke: (async () => ({
-        packageRelativePath: 'exports/playtest-package-1.zip',
-        packageBytes: [1],
-        packageSha256: 'a'.repeat(64),
-        packageSizeBytes: 1,
-        files: [{ path: 'index.html', sizeBytes: 1, sha256: 'a'.repeat(64) }],
-      })) as never,
+      invoke: (async () => STAGED_PACKAGE) as never,
       projectPath: '/tmp/project',
       packageRelativePath: 'exports/playtest-package-1.zip',
       manifest: MANIFEST,
@@ -156,13 +174,7 @@ test('缺少��时在创建游��失败关闭', async () => {
 test('截图超过 6 张时在创建游��失败关闭', async () => {
   await expect(
     publishLocalProjectGame({
-      invoke: (async () => ({
-        packageRelativePath: 'exports/playtest-package-1.zip',
-        packageBytes: [1],
-        packageSha256: 'a'.repeat(64),
-        packageSizeBytes: 1,
-        files: [{ path: 'index.html', sizeBytes: 1, sha256: 'a'.repeat(64) }],
-      })) as never,
+      invoke: (async () => STAGED_PACKAGE) as never,
       projectPath: '/tmp/project',
       packageRelativePath: 'exports/playtest-package-1.zip',
       manifest: MANIFEST,
diff --git a/apps/ai-game-creator-shell/tests/gameDistributionPublishLive.test.ts b/apps/ai-game-creator-shell/tests/gameDistributionPublishLive.test.ts
index 552b6c26c..b79228dd1 100644
--- a/apps/ai-game-creator-shell/tests/gameDistributionPublishLive.test.ts
+++ b/apps/ai-game-creator-shell/tests/gameDistributionPublishLive.test.ts
@@ -7,18 +7,23 @@
  *     npx vitest run apps/ai-game-creator-shell/tests/gameDistributionPublishLive.test.ts
  *
  * 开��测试会注册一个临时作者，并通过真实的 `clientApi` / `clientHttp`（而�是
- * mock 请求层）调用 AGC 的�布函数，覆盖：本地导出包读��创建游���
- * `localProjectId` �用游�身份�真实 ZIP 上传��审与版本回读。
+ * mock 请求层）调用 AGC 的�布函数，覆盖：本地�行包暂存摘��创建游���
+ * `localProjectId` �用游�身份�真实分片上传��审与版本回读。
+ *
+ * jsdom 里没有 Tauri �行时，`upload_local_project_game_package` 由本测试按�务端
+ * 分片�议（upload-state → chunk → complete）代跑，等�于原生上传器的行为；
+ * 原生实现自身的分片规划����移续传与错误分类在 Rust �测里覆盖。
  */
-import { createHash } from 'node:crypto';
+import { createHash, randomBytes } from 'node:crypto';
 
 import JSZip from 'jszip';
 import { expect, test, vi } from 'vitest';
 
 import type { GameCreationAppManifest } from '../../../packages/shared/src/contracts/gameCreationApp';
-import type { LocalProjectExportPackagePayload } from '../src/app/types';
+import type { StagedGamePackage } from '../src/app/types';
 import { uploadPlatformMediaAsset } from '../src/services/assetDirectUpload';
 import { setStoredAuthAccessToken } from '../src/services/clientAuth';
+import { setClientServerSelection } from '../src/services/clientHttp';
 import { publishLocalProjectGame } from '../src/services/gameDistributionPublish';
 
 /** 1x1 �明 PNG：真实上传一张�法图片作为��，���赖本地素�文件。 */
@@ -37,6 +42,12 @@ const liveBaseUrl = (process.env.GENARRATIVE_AGC_PUBLISH_E2E_BASE_URL ?? '')
   .replace(/\/+$/u, '');
 const liveTest = liveBaseUrl ? test : test.skip;
 
+// AGC �务默认按渠�选 dev / release 域�；跑真实链路时把「平��务器�切到传入的本地栈，
+// �则请求会打到线上域�而�是这�机器上的 api-server。
+if (liveBaseUrl) {
+  setClientServerSelection({ preset: 'custom', customBaseUrl: liveBaseUrl });
+}
+
 const realFetch = globalThis.fetch.bind(globalThis);
 const ENVELOPE_HEADERS = { 'x-genarrative-response-envelope': 'v1' };
 
@@ -55,21 +66,73 @@ function installFetchBridge() {
           : input instanceof URL
             ? input.toString()
             : input;
+      // jsdom realm 的 Headers / AbortSignal / Blob 都�是 undici 认得的类型（� 2026-09-20
+      // 那�「跨 realm BodyInit 被 undici 拒��的�）：统一�级� Node 侧能接�的原生值。
+      const headers = init?.headers
+        ? Object.fromEntries(Array.from(new Headers(init.headers).entries()))
+        : undefined;
+      const signal = undefined;
       const body = init?.body;
+      if (typeof FormData !== 'undefined' && body instanceof FormData) {
+        // jsdom 的 FormData �样�被 undici 接�：这里手工�列化� multipart 字节。
+        const multipart = await serializeFormData(body);
+        return realFetch(url as string, {
+          ...init,
+          headers: { ...headers, 'Content-Type': multipart.contentType },
+          signal,
+          body: multipart.body,
+        });
+      }
       if (typeof Blob !== 'undefined' && body instanceof Blob) {
         // jsdom 的 Blob/ArrayBuffer 属于�一个 realm，且旧版 jsdom 没有
         // Blob.arrayBuffer；统一读�字节��制为 Node 侧 Buffer �转�。
         const bytes = await readBlobBytes(body);
         return realFetch(url as string, {
           ...init,
+          headers,
+          signal,
           body: Buffer.from(bytes),
         });
       }
-      return realFetch(url as string, init);
+      return realFetch(url as string, { ...init, headers, signal });
     },
   );
 }
 
+async function serializeFormData(form: FormData): Promise<{
+  body: Buffer;
+  contentType: string;
+}> {
+  const boundary = `----agcLive${Date.now().toString(16)}`;
+  const chunks: Buffer[] = [];
+  for (const [name, value] of form.entries()) {
+    if (typeof value === 'string') {
+      chunks.push(
+        Buffer.from(
+          `--${boundary}\r\nContent-Disposition: form-data; name="${name}"\r\n\r\n${value}\r\n`,
+        ),
+      );
+      continue;
+    }
+    const bytes = await readBlobBytes(value);
+    const fileName =
+      (value as File).name || `agc-live-${Date.now().toString(16)}.bin`;
+    const contentType = value.type || 'application/octet-stream';
+    chunks.push(
+      Buffer.from(
+        `--${boundary}\r\nContent-Disposition: form-data; name="${name}"; filename="${fileName}"\r\nContent-Type: ${contentType}\r\n\r\n`,
+      ),
+    );
+    chunks.push(Buffer.from(bytes));
+    chunks.push(Buffer.from('\r\n'));
+  }
+  chunks.push(Buffer.from(`--${boundary}--\r\n`));
+  return {
+    body: Buffer.concat(chunks),
+    contentType: `multipart/form-data; boundary=${boundary}`,
+  };
+}
+
 async function readBlobBytes(blob: Blob): Promise<Uint8Array> {
   const maybeArrayBuffer = (
     blob as Blob & { arrayBuffer?: () => Promise<ArrayBuffer> }
@@ -120,7 +183,10 @@ async function registerAuthor(): Promise<string> {
   return data.token;
 }
 
-async function buildExportPayload(): Promise<LocalProjectExportPackagePayload> {
+async function buildStagedPackage(): Promise<{
+  staged: StagedGamePackage;
+  bytes: Uint8Array;
+}> {
   const zip = new JSZip();
   const indexHtml =
     '<!doctype html><html><head><meta charset="utf-8"><title>AGC Live</title>' +
@@ -129,28 +195,169 @@ async function buildExportPayload(): Promise<LocalProjectExportPackagePayload> {
     'window.__agcLive=1;document.documentElement.dataset.booted="agc";';
   zip.file('index.html', indexHtml);
   zip.file('assets/app.js', appJs);
+  // 让�行包超过�个分片（8 MiB）：分片续传�有跨片�有�义，�机字节����压缩。
+  zip.file('assets/bulk.bin', randomBytes(9 * 1024 * 1024));
   const bytes = await zip.generateAsync({ type: 'uint8array' });
   const sha256 = createHash('sha256').update(bytes).digest('hex');
   return {
-    packageRelativePath: 'dist/game.zip',
-    packageBytes: Array.from(bytes),
-    packageSha256: sha256,
-    packageSizeBytes: bytes.length,
-    files: [
-      {
-        path: 'index.html',
-        sizeBytes: Buffer.byteLength(indexHtml),
-        sha256: createHash('sha256').update(indexHtml).digest('hex'),
-      },
-      {
-        path: 'assets/app.js',
-        sizeBytes: Buffer.byteLength(appJs),
-        sha256: createHash('sha256').update(appJs).digest('hex'),
-      },
-    ],
+    staged: {
+      stagingPath: '/tmp/agc-live-staging/game.zip',
+      packageSha256: sha256,
+      packageSizeBytes: bytes.length,
+      packageFileCount: 3,
+    },
+    bytes,
   };
 }
 
+type PackageUploadState = {
+  receivedBytes: number;
+  chunkBytes: number;
+  declaredPackageBytes: number;
+};
+
+function packageAuthHeaders(token: string) {
+  return {
+    Authorization: `Bearer ${token}`,
+    ...ENVELOPE_HEADERS,
+  };
+}
+
+/** 读��务端��已收字节（原生上传器�样以它为准）。 */
+async function readPackageUploadState(
+  versionId: string,
+  token: string,
+): Promise<PackageUploadState> {
+  return await unwrap<PackageUploadState>(
+    await realFetch(
+      apiUrl(
+        `/api/game-distribution/versions/${versionId}/package/upload-state`,
+      ),
+      { headers: packageAuthHeaders(token) },
+    ),
+  );
+}
+
+/** 上传一个分片；�移由调用方按���移给出。 */
+async function uploadPackageChunk(input: {
+  versionId: string;
+  token: string;
+  idempotencyKey: string;
+  offset: number;
+  body: Uint8Array;
+}): Promise<number> {
+  const response = await realFetch(
+    apiUrl(`/api/game-distribution/versions/${input.versionId}/package/chunk`),
+    {
+      method: 'PUT',
+      headers: {
+        ...packageAuthHeaders(input.token),
+        'Content-Type': 'application/octet-stream',
+        'x-genarrative-upload-offset': String(input.offset),
+        'Idempotency-Key': `${input.idempotencyKey}:chunk`,
+      },
+      body: Buffer.from(input.body),
+    },
+  );
+  if (!response.ok) {
+    throw new Error(
+      `分片上传失败：${response.status} ${await response.text()}`,
+    );
+  }
+  const payload = (await response.json()) as {
+    data?: { receivedBytes?: number };
+    receivedBytes?: number;
+  };
+  return payload.data?.receivedBytes ?? payload.receivedBytes ?? input.offset;
+}
+
+async function completePackageUpload(input: {
+  versionId: string;
+  token: string;
+  idempotencyKey: string;
+}) {
+  return await unwrap<{ versionId: string; status: string }>(
+    await realFetch(
+      apiUrl(
+        `/api/game-distribution/versions/${input.versionId}/package/complete`,
+      ),
+      {
+        method: 'POST',
+        headers: {
+          ...packageAuthHeaders(input.token),
+          'Idempotency-Key': `${input.idempotencyKey}:complete`,
+        },
+      },
+    ),
+  );
+}
+
+/** 从���移继续��剩余分片，返回本次实际��过的�移�列。 */
+async function uploadRemainingChunks(input: {
+  versionId: string;
+  bytes: Uint8Array;
+  token: string;
+  idempotencyKey: string;
+}): Promise<number[]> {
+  const state = await readPackageUploadState(input.versionId, input.token);
+  const sentOffsets: number[] = [];
+  let received = state.receivedBytes;
+  while (received < input.bytes.length) {
+    const length = Math.min(state.chunkBytes, input.bytes.length - received);
+    await uploadPackageChunk({
+      versionId: input.versionId,
+      token: input.token,
+      idempotencyKey: input.idempotencyKey,
+      offset: received,
+      body: input.bytes.subarray(received, received + length),
+    });
+    sentOffsets.push(received);
+    received = (await readPackageUploadState(input.versionId, input.token))
+      .receivedBytes;
+  }
+  return sentOffsets;
+}
+
+/**
+ * 按�务端分片�议上传整包：与原生上传器�一套请求形状，用于验��务端��。
+ * 第一次调用会**�传第一片就�下**，模拟传输中断；�续调用按���移续传，
+ * 因此这里能直接�明「中断���传已收字节�。
+ */
+async function uploadStagedPackageViaProtocol(input: {
+  versionId: string;
+  bytes: Uint8Array;
+  token: string;
+  idempotencyKey: string;
+  sentOffsets: number[];
+}) {
+  const state = await readPackageUploadState(input.versionId, input.token);
+  if (state.receivedBytes === 0) {
+    const firstLength = Math.min(state.chunkBytes, input.bytes.length);
+    await uploadPackageChunk({
+      versionId: input.versionId,
+      token: input.token,
+      idempotencyKey: input.idempotencyKey,
+      offset: 0,
+      body: input.bytes.subarray(0, firstLength),
+    });
+    input.sentOffsets.push(0);
+  }
+  input.sentOffsets.push(
+    ...(await uploadRemainingChunks({
+      versionId: input.versionId,
+      bytes: input.bytes,
+      token: input.token,
+      idempotencyKey: input.idempotencyKey,
+    })),
+  );
+  const completed = await completePackageUpload({
+    versionId: input.versionId,
+    token: input.token,
+    idempotencyKey: input.idempotencyKey,
+  });
+  return { versionId: completed.versionId, status: completed.status };
+}
+
 liveTest(
   'AGC �布函数在真实�端完�创建�上传��审并在���布时�用游�身份',
   async () => {
@@ -158,22 +365,46 @@ liveTest(
     const token = await registerAuthor();
     setStoredAccessToken(token);
 
-    const payload = await buildExportPayload();
+    const { staged, bytes } = await buildStagedPackage();
     const stamp = String(Date.now());
     const manifest = {
       projectId: `agc-live-${stamp}`,
       name: `AGC 真实�布${stamp.slice(-4)}`,
       goal: '验� AGC 一键�布链路',
     } as unknown as GameCreationAppManifest;
-    const invoke = vi.fn(async () => payload);
+    // 记录本次�布实际��过的分片�移，用��明「中断���传已收字节�。
+    const sentOffsets: number[] = [];
+    const invoke = vi.fn(
+      async (command: string, args?: Record<string, unknown>) => {
+        if (command === 'prepare_local_project_game_package') {
+          return staged;
+        }
+        if (command === 'upload_local_project_game_package') {
+          const uploaded = await uploadStagedPackageViaProtocol({
+            versionId: String(args?.versionId ?? ''),
+            bytes,
+            token,
+            idempotencyKey: String(args?.idempotencyKey ?? ''),
+            sentOffsets,
+          });
+          return {
+            versionId: uploaded.versionId,
+            status: uploaded.status,
+            uploadedBytes: bytes.length,
+          };
+        }
+        throw new Error(`未预期的命令：${command}`);
+      },
+    );
     // �务端�求�布必须带��：真实走一�凭� → 直传 → confirm。
     const uploadedCover = await uploadPlatformMediaAsset({
       file: buildLiveCoverFile(),
       assetKind: 'game_distribution_cover',
       pathSegments: ['game-distribution', 'cover', stamp],
       entityId: 'game-distribution-cover',
-      // jsdom 里没有 Tauri HTTP �件，�用测试注入的 fetch bridge 直连 dev OSS。
-      fetchImpl: (input, init) => realFetch(apiUrl(input), init),
+      // jsdom 里没有 Tauri HTTP �件：直传也走�一个桥，跨 realm 的 FormData 会被
+      // 先�列化� Node 侧 multipart 字节，�则 OSS 会以 405 拒�。
+      fetchImpl: (input, init) => globalThis.fetch(input, init),
     });
     expect(uploadedCover.assetObjectId).toMatch(/\S/u);
     const metadata = {
@@ -198,7 +429,18 @@ liveTest(
     });
     expect(first.status).toBe('pending_review');
     expect(first.versionNumber).toBe(1);
-    expect(first.packageSha256).toBe(payload.packageSha256);
+    expect(first.packageSha256).toBe(staged.packageSha256);
+    // 分片续传��：第一片（�移 0）���一次；中断�的续传从���移开始，
+    // 已收字节��放�也�跳段。
+    expect(sentOffsets[0]).toBe(0);
+    expect(sentOffsets.filter((offset) => offset === 0)).toHaveLength(1);
+    expect(sentOffsets[1]).toBeGreaterThan(0);
+    expect(sentOffsets).toEqual(
+      Array.from(
+        { length: Math.ceil(staged.packageSizeBytes / 8 / 1024 / 1024) },
+        (_, index) => index * 8 * 1024 * 1024,
+      ),
+    );
 
     const readResult = await unwrap<{
       version: { versionId: string; status: string; recoveryAction: string };
diff --git a/deploy/container/nginx.conf b/deploy/container/nginx.conf
index 9e34fbaca..6d3284ce0 100644
--- a/deploy/container/nginx.conf
+++ b/deploy/container/nginx.conf
@@ -90,8 +90,9 @@ http {
 
         location ~ ^/api(?:/|$) {
             default_type application/json;
-            # 中文注释：创作接�会�带�考图 Data URL，Nginx �放行到 api-server；真实大��制�由路由 DefaultBodyLimit 和业务字节校验负责。
-            client_max_body_size 64m;
+            # 中文注释：创作接�会�带�考图 Data URL，游��行包 PUT 更大，Nginx �负责放行到 api-server；
+            # 真实大��制�由路由 DefaultBodyLimit（�行包 200 MiB + 1 KiB）和业务字节校验负责。
+            client_max_body_size 210m;
             limit_conn genarrative_api_conn 64;
             limit_req zone=genarrative_api_rps burst=64 nodelay;
 
diff --git a/deploy/nginx/README.md b/deploy/nginx/README.md
index c3c4bff34..6d2b2dffe 100644
--- a/deploy/nginx/README.md
+++ b/deploy/nginx/README.md
@@ -4,8 +4,8 @@
 
 ## 请求体大�
 
-- 生产�开��和容器模�都在通用 `location ~ ^/api(?:/|$)` 内设置 `client_max_body_size 64m`。
-- 该值�用于让�带�考图 Data URL 的创作接�抵达 `api-server`；��把它当作业务上传上�。Rust 路由�通过 `DefaultBodyLimit` 和解��字节校验�制具体接�，例如拼图�考图路由�放宽到 12 MiB 请求体，图片字节继续按业务规则拒�。
+- 生产�开��和容器模�都在通用 `location ~ ^/api(?:/|$)` 内设置 `client_max_body_size 210m`。
+- 该值�用于让�带�考图 Data URL 的创作接�和游��行包 PUT（路由上� 200 MiB + 1 KiB）抵达 `api-server`；��把它当作业务上传上�。Rust 路由�通过 `DefaultBodyLimit` 和解��字节校验�制具体接�，例如拼图�考图路由�放宽到 12 MiB 请求体，图片字节继续按业务规则拒�。Pingora 网关侧的 `GENARRATIVE_PINGORA_GATEWAY_MAX_API_BODY_BYTES` 必须�样�低于该值，�则请求会在网关层被 413。
 - 若线上看到 `413 Request Entity Too Large`，并且 access log 里 `request_time=0.000 upstream_status=-`，通常是 Nginx 没有加载该模�或未 reload；先执行 `nginx -T | grep client_max_body_size` 和 `nginx -t` �检查 `api-server`。
 
 ## gzip
diff --git a/deploy/nginx/genarrative-dev-http.conf b/deploy/nginx/genarrative-dev-http.conf
index f210766ab..640ef088c 100644
--- a/deploy/nginx/genarrative-dev-http.conf
+++ b/deploy/nginx/genarrative-dev-http.conf
@@ -119,8 +119,9 @@ server {
     # 临时兼容主站�在使用的 /api/* HTTP facade；�端完� SpacetimeDB SDK �移�删除。
     location ~ ^/api(?:/|$) {
         default_type application/json;
-        # 中文注释：创作接�会�带�考图 Data URL，Nginx �放行到 api-server；真实大��制�由路由 DefaultBodyLimit 和业务字节校验负责。
-        client_max_body_size 64m;
+        # 中文注释：创作接�会�带�考图 Data URL，游��行包 PUT 更大，Nginx �负责放行到 api-server；
+        # 真实大��制�由路由 DefaultBodyLimit（�行包 200 MiB + 1 KiB）和业务字节校验负责。
+        client_max_body_size 210m;
         limit_conn genarrative_api_conn 64;
         limit_req zone=genarrative_api_rps burst=64 nodelay;
 
diff --git a/deploy/nginx/genarrative.conf b/deploy/nginx/genarrative.conf
index 87bf769e3..b7d1c433a 100644
--- a/deploy/nginx/genarrative.conf
+++ b/deploy/nginx/genarrative.conf
@@ -139,8 +139,9 @@ server {
     # 临时兼容主站�在使用的 /api/* HTTP facade；�端完� SpacetimeDB SDK �移�删除。
     location ~ ^/api(?:/|$) {
         default_type application/json;
-        # 中文注释：创作接�会�带�考图 Data URL，Nginx �放行到 api-server；真实大��制�由路由 DefaultBodyLimit 和业务字节校验负责。
-        client_max_body_size 64m;
+        # 中文注释：创作接�会�带�考图 Data URL，游��行包 PUT 更大，Nginx �负责放行到 api-server；
+        # 真实大��制�由路由 DefaultBodyLimit（�行包 200 MiB + 1 KiB）和业务字节校验负责。
+        client_max_body_size 210m;
         limit_conn genarrative_api_conn 64;
         limit_req zone=genarrative_api_rps burst=64 nodelay;
 
diff --git a/deploy/pingora/nginx-route-parity.matrix.json b/deploy/pingora/nginx-route-parity.matrix.json
index 59eaaa850..f1c90ee98 100644
--- a/deploy/pingora/nginx-route-parity.matrix.json
+++ b/deploy/pingora/nginx-route-parity.matrix.json
@@ -124,14 +124,14 @@
       "nginx": {
         "production": [
           "location ~ ^/api(?:/|$)",
-          "client_max_body_size 64m;",
+          "client_max_body_size 210m;",
           "limit_conn genarrative_api_conn 64;",
           "limit_req zone=genarrative_api_rps burst=64 nodelay;",
           "add_header X-Accel-Buffering no always;"
         ],
         "development": [
           "location ~ ^/api(?:/|$)",
-          "client_max_body_size 64m;",
+          "client_max_body_size 210m;",
           "limit_conn genarrative_api_conn 64;",
           "limit_req zone=genarrative_api_rps burst=64 nodelay;",
           "add_header X-Accel-Buffering no always;"
diff --git a/deploy/pingora/pingora-gateway.env.example b/deploy/pingora/pingora-gateway.env.example
index 467d559d2..d85eb293a 100644
--- a/deploy/pingora/pingora-gateway.env.example
+++ b/deploy/pingora/pingora-gateway.env.example
@@ -28,7 +28,7 @@ GENARRATIVE_PINGORA_GATEWAY_MAINTENANCE_FILE=/var/lib/genarrative/maintenance/en
 GENARRATIVE_PINGORA_GATEWAY_MAINTENANCE_PAGE_FILE=/var/lib/genarrative/maintenance/page.html
 
 GENARRATIVE_PINGORA_GATEWAY_FORWARDED_PROTO=http
-GENARRATIVE_PINGORA_GATEWAY_MAX_API_BODY_BYTES=67108864
+GENARRATIVE_PINGORA_GATEWAY_MAX_API_BODY_BYTES=220200960
 # gzip 默认开�；等级和最��应长度对� Nginx gzip_comp_level 5 / gzip_min_length 1024。
 # Pingora 正�化�径固定为 gzip-only；br / zstd �进入当�网关，Brotli 继续由 Nginx / �置代�承担。
 GENARRATIVE_PINGORA_GATEWAY_COMPRESSION_ALGORITHMS=gzip
diff --git a/docs/project-memory/plans/�实施计划】AGC�行包分片续传上传-2026-09-23.md b/docs/project-memory/plans/�实施计划】AGC�行包分片续传上传-2026-09-23.md
new file mode 100644
index 000000000..21aa5c760
--- /dev/null
+++ b/docs/project-memory/plans/�实施计划】AGC�行包分片续传上传-2026-09-23.md
@@ -0,0 +1,49 @@
+# AGC �行包分片续传上传实施计划
+
+| 字段 | 值 |
+| --- | --- |
+| Version | 1.0 |
+| Status | runtime-smoke-passed（存储原语��务端入��原生上传器�渲染进程接线与真实栈分片续传 smoke �已�地） |
+| Date | 2026-09-23 |
+| Parent Milestone | `docs/project-memory/plans/�里程碑】AGC�行包分片续传上传-2026-09-23.md` |
+
+## 修改边界与顺�
+
+1. **存储原语（已完�）**：`server-rs/crates/platform-oss/src/lib.rs` 新增 `append_internal_object` / `append_internal_object_with_retry` 与 `OssAppendInternalObjectRequest` / `OssAppendInternalObjectResponse`；�用现役 V4 签�助手 `signed_request_builder`（查询串已�与签�）与 `run_internal_put_with_retry` 的��试分类。`position = 0` 追加到末尾，`position > 0` 必须等于对象当�长度；返回 `next_position` 作为��已收字节。
+2. **�务端入�（已完�）**：`server-rs/crates/api-server/src/modules/game_distribution.rs`
+   - 新增 `GET .../package/upload-state`�`PUT .../package/chunk`�`POST .../package/complete`�`POST .../package/reset` 四个路由，沿用作者鉴��`game-distribution:publish` �度开关与 `Idempotency-Key` 约定；
+   - 分片大� `PACKAGE_UPLOAD_CHUNK_BYTES = 8 MiB`，分片请求体放行�为分片大� + 1 KiB；
+   - 从整包 `PUT` 抽出共享收� `confirm_validated_package`（声明比对 → 确认 → 结构化事件），两�入�共用；
+   - 新增 `game_distribution_oss_client` / `game_distribution_package_object_key` / `staged_package_bytes` / `require_octet_stream_content_type` / `package_upload_offset` 辅助函数；�移�一致返回 `409 PACKAGE_UPLOAD_OFFSET_MISMATCH` 与���移；未收�返回 `409 PACKAGE_UPLOAD_INCOMPLETE`；校验失败删除�包并� `upload_failed`。
+3. **AGC 原生上传器（已完�）**：新增 `apps/ai-game-creator-shell/src-tauri/src/game_package_upload.rs`：内容寻�暂存（`<appData>/game-package-staging/<sha256>.zip`，����包�用�一文件）�`upload-state → chunk → complete` 循环�409 ���移续传（�应丢失�按�务端已收字节对�，��放�跳段）�仅对传输/超时/408/429/5xx 退��试（默认 4 次�试）�`game-package-upload-progress` 进度事件；暂存路径必须�在暂存目录内。命令 `prepare_local_project_game_package` / `upload_local_project_game_package` 已注册，整包回传命令 `read_local_project_export_package` 退役（`read_local_project_export_package_at` �供暂存使用）。
+4. **渲染进程接线（已完�）**：`apps/ai-game-creator-shell/src/services/gameDistributionPublish.ts` 改为 `prepare`（拿摘�与暂存路径）→ 创建游� → 创建版本 → 原生分片上传 → �审；`LocalProjectExportPackagePayload` 整包类型退役，改为 `StagedGamePackage` / `GamePackageUploadOutcome`；��有任何整包字节进 IPC。
+5. **真实栈 smoke（已完�）**：本地 api-server + 真实 OSS bucket 上跑通「中断 → 续传 → 确认�。�法与��：
+   - 先用 `npm run dev:spacetime` 把当�模��布到本地库（`genarrative-game-creator-dev`，自动�移完�），�用 `npm run dev:api-server` 起 `127.0.0.1:8082`；
+   - 本地库的 `feature_gate_config` 原本为空（�布开关默认关闭），用 `spacetime call … upsert_feature_gate_config` 写入 `game-distribution:publish enabled=true rollout=100`；
+   - `GENARRATIVE_AGC_PUBLISH_E2E_BASE_URL=http://127.0.0.1:8082 npx vitest run apps/ai-game-creator-shell/tests/gameDistributionPublishLive.test.ts` → **1 passed / 3.9s**（�行包 9.0 MiB，跨 8 MiB 分片边界）；
+   - 用例断言实际��过的分片�移�列等于 `[0, 8388608]`：第一片��一次，中断�的续传从���移开始，��放也�跳段；
+   - api-server 侧�一轮日志：`package_chunk_stored offset=0 chunk_bytes=8388608 received_bytes=8388608 elapsed_ms=201`�`package_chunk_stored offset=8388608 chunk_bytes=1049210 received_bytes=9437818 elapsed_ms=82`�`package_confirmed package_bytes=9437818 file_count=3 oss_put_skipped=true elapsed_ms=884`。
+   - 为了能指�本地栈，用例还补了两处基础设施修正：把客户端平�基�切到传入的 base URL（`setClientServerSelection({preset:'custom'})`），以�桥接层把 jsdom realm 的 `Headers` / `Blob` / `FormData` �级� Node 侧原生值（`FormData` 手工�列化为 multipart 字节，�则 OSS 直传回 405）。
+
+## �改的部分
+
+- 网页端�布路径与整包 `PUT` 语义��；`MAX_PACKAGE_BYTES`�展开���文件与文件数上���。
+- 未新增 SpacetimeDB 表或字段：已收字节的事实��是 OSS 对象长度，版本状�机沿用既有 `awaiting_upload → uploaded → …`。
+- 未引入�包定时清�任务。
+
+## 验�命令
+
+- `cargo test -p platform-oss`（74 passed）
+- `cargo test -p api-server game_distribution`（23 passed，�新增 `package_chunk_size_stays_inside_declared_limits`�`package_upload_offset_requires_non_negative_integer`�`package_chunk_content_type_must_be_octet_stream`）
+- `cargo fmt --all -- --check`�`npm run check:encoding`�`npm run check:doc-index`�`git diff --check`
+- `cargo test game_package_upload`（AGC 原生侧 4 passed：分片规划无�无���409 ���移解��URL 拼接�内容寻�暂存与路径校验）
+- `npx tsc -p apps/ai-game-creator-shell/tsconfig.json --noEmit`�`npm run --workspace apps/ai-game-creator-shell typecheck`（� `check-config.mjs` 的命令登记门�）
+- `npx vitest run`（�布函数 6 passed��布�� 9 passed��布�馈 5 passed；真实链路用例在无 `GENARRATIVE_AGC_PUBLISH_E2E_BASE_URL` 时按设计跳过）
+- 待�：真实栈 smoke（本地 api-server + 真实 OSS bucket 上跑「中断 → 续传 → 完��，� `x-oss-next-append-position` 语义确认）
+
+## 风险与回滚点
+
+- **对象�追加性**：`platform-oss` 之�没有追加写，首次真实调用需�在真实 bucket 上确认 `x-oss-next-append-position` 语义；失败时回滚点是 `platform-oss` 新增函数与四�路由（整包 `PUT` ��影�，�独立回退）。
+- **�包对象**：分片写入直接�在版本键上，未完�时是�包。它�进公开目录���务�行网关；失败或作者�置时删除。若删除失败会记录 `package_staging_delete_failed` 告警，需�人工确认对象键状�。
+- **�置语义**：�有 `awaiting_upload` / `upload_failed` �许�置，��破�已确认事实。
+- **内存**：完�动作按 200 MiB 上�回读整包�校验，峰值与整包 `PUT` ��级；分片路径��让整包驻留客户端。
diff --git a/docs/project-memory/plans/�里程碑】AGC�行包分片续传上传-2026-09-23.md b/docs/project-memory/plans/�里程碑】AGC�行包分片续传上传-2026-09-23.md
new file mode 100644
index 000000000..a881e7e88
--- /dev/null
+++ b/docs/project-memory/plans/�里程碑】AGC�行包分片续传上传-2026-09-23.md
@@ -0,0 +1,58 @@
+# AGC �行包分片续传上传
+
+| 字段 | 值 |
+| --- | --- |
+| Version | 1.0 |
+| Status | runtime-smoke-passed（真实栈「中断 → 续传 → 确认�已通过；AGC 真机一键�布与 200 MiB 档容�数�未验�） |
+| Date | 2026-09-23 |
+| Parent Spec | `docs/�玩法创作】平�入�与玩法链路-2026-05-15.md`（真实�行包与资料��第 10 ��幂等并�与��） |
+
+## 背景与触�
+
+AGC 一键�布今天把整包字节从 WebView 侧�出：`read_local_project_export_package` 先把 `packageBytes` 整包过一� IPC 回到渲染进程，渲染进程�用 `@tauri-apps/plugin-http` �整包 `PUT`，而该�件会把 body �列化� `Array.from(new Uint8Array(buffer))` �走一次 IPC。两次整包 IPC 决定了 AGC 实际��布的包远�于�务端 200 MiB 上�，失败时表现为客户端侧传输错误（例如「无法连接登录�务�），�务端访问日志里没有这次请求；断��也�能整包白传。本里程碑把上传下沉到原生侧并支�分片续传。
+
+## 目标
+
+1. AGC 一键�布由原生进程直接读�本地试玩包�按�务端下�的固定分片大�上传，整包字节���过 WebView IPC。
+2. 传输中断�网络失败�客户端进程退出或应用���，�一 `versionId` �补传缺失字节，�白传整包。
+3. 分片入�与现役整包 `PUT` 共用�一版本状�机�摘��径�幂等键与包校验；网页端�布路径��。
+
+## �在本里程碑内
+
+- �改网页端�布路径（继续整包 `PUT`），�为�览器实现续传。
+- ��并行分片上传���客户端直传 OSS（分片�� `api-server` 转�，与今天整包路径�一出�）。
+- ��「��自动续传�：续传�在下一次�布动作或应用���的�试里�生，�引入常驻�传任务。
+- ��未完�分片会�的定时清�任务；�包对象的回收�独开里程碑。
+- �改�行包上��展开���文件与文件数上�。
+
+## ���点
+
+- **入�与状�**：分片续传对既有 `versionId` 生效，版本状�沿用 `awaiting_upload → uploaded → …`；分片入�与整包入�互斥，�一版本�时�能有一个写入者，第二个写入返回 `409 UPLOAD_IN_PROGRESS`。
+- **���移**：�务端记录的已收字节是唯一��。客户端分片�移与之�符时返回 `409` 与���移，客户端按���移续传；��分片�得造���写入。
+- **完�动作**：全部字节到���执行校验与确认；校验失败删除�包对象并把版本�到 `upload_failed`（`recoveryAction=reupload`）。�新上传�一版本�必须显��置分片会�，�置��移归零，��许在�包之上续写��字节。
+- **��性**：�包对象�进入公开目录���务�行网关��改�当�公开版本；与既有「未通过审核�改� `activeVersionId`��径一致。
+- **原生侧边界**：原生上传�读本地试玩包并�片��，进度以事件回传渲染进程；渲染进程���有整包字节。
+
+## �赖
+
+- `platform-oss`：需�一组�续写的对象写入原语（追加语义或等价的分片会�），以�读�已收字节的探测能力；现役�有整对象 `PUT`。
+- `api-server`：`modules/game_distribution.rs` 新增分片入�与完�动作，�用既有 `validate_release_zip`�OSS 上传�试分类�`package_confirmed` / `package_rejected` �观测事件。
+- AGC：`src-tauri` 新增原生上传命令与进度事件，`src/services/gameDistributionPublish.ts` 改为调用原生命令；`read_local_project_export_package` ��为�布回传整包字节。
+- �代/网关：分片请求体远�于现役 210 MiB 放行�，沿用现有�置，�改��。
+
+## 验收标准
+
+1. **��整包过 IPC**：�布 200 MiB 档包时，渲染进程侧�出现整包字节（对照 `read_local_project_export_package` 的返回体与 IPC 报文大�），上传由原生进程完�。
+2. **续传生效**：上传中途断开传输����一版本，�补传缺失分片；分片请求数�已传字节与最终包摘�三项���核。
+3. **跨��续传**：上传中断时退出应用并��，�新�布时�务端返回��已收字节，客户端从该�移继续，最终确认�功。
+4. **�移与��**：分片�移�符返回 `409` 与���移；���交�一分片�产生��写入；�版本第二个写入者返回 `409 UPLOAD_IN_PROGRESS`。
+5. **失败关闭**：完�动作里校验失败（�法 ZIP�超��压缩比越界等）删除�包对象�版本� `upload_failed`，�包�出现在公开目录，也�影�当�公开版本。
+6. **兼容与回归**：整包 `PUT` 路径与既有测试��绿；`npm run check:doc-index`�`npm run check:encoding`�`git diff --check` 通过；`check:spacetime-schema` 按是�新增�久字段决定是�纳入。
+7. **�行时��（已获得）**：本地 api-server（`127.0.0.1:8082`，库 `genarrative-game-creator-dev`）+ 真实 OSS bucket 上跑通 `gameDistributionPublishLive.test.ts`：9.0 MiB �行包跨 8 MiB 分片边界，第一片���一次，中断�续传从���移 `8388608` 继续�第二片 `received_bytes=9437818`，最� `package_confirmed`（`oss_put_skipped=true`）；整轮 3.9s。**未获得**：AGC 真机（Tauri �行时）一键�布的端到端�行，以� 200 MiB 档的耗时 / 内存容�数�。
+
+## 待评审的决策点
+
+1. **续写原语**：OSS 追加写（顺���对象�续传�需回读当�长度）对比 OSS Multipart（�并行�更通用但需�多组新�作）。建议追加写，顺�续传已满足本里程碑目标。
+2. **分片大�**：建议 8 MiB（200 MiB 上� → 最多 25 片，�片请求体远低于现役放行�）。
+3. **�置语义**：建议�有显��置（作者点「�新上传�或 `reupload` ��动作）�删除�包并归零；其余情况一律按���移续传。
+4. **�包回收**：本里程碑�标记未完�会�，��定时清�；回收�立里程碑（涉�「�得删除�被公开版本引用的对象��径）。
diff --git a/docs/project-memory/plans/�里程碑】游�分�目录详情与在线游玩-2026-09-18.md b/docs/project-memory/plans/�里程碑】游�分�目录详情与在线游玩-2026-09-18.md
index 226855815..e55f03b43 100644
--- a/docs/project-memory/plans/�里程碑】游�分�目录详情与在线游玩-2026-09-18.md
+++ b/docs/project-memory/plans/�里程碑】游�分�目录详情与在线游玩-2026-09-18.md
@@ -120,7 +120,7 @@
 ### 行为与验收
 
 - [ ] 真实环境中完整跑通“首次上传 → 校验 → 审核 → 公开 → 游客游玩 → 更新待审旧版在线 → 新版切� → 下架撤销�。
-- [ ] 100 MiB 包与获批文件数/展开�边界有��核耗时�内存和失败��；校验�会执行上传代�，�务资�有界。
+- [ ] 200 MiB 包（现行上�，� 2026-09-23 决策记录）与获批文件数/展开�边界有��核耗时�内存和失败��；校验�会执行上传代�，�务资�有界。已有��覆盖 100 MiB 档，上����的档�待�跑。
 - [ ] 校验执行器�����，审核积压与失败�观测，清��删除�被公开版本引用的文件。
 - [ ] CDN purge 失败时�在获批缓存 TTL 内拒�新资�；明确已下载脚本无法远程抹除的边界。
 - [ ] �布/回滚步骤�留当�公开版本，能关闭新�交和新版本激活；部署路由�缓存��应头�日志脱�和告警完�检查。
diff --git a/docs/project-memory/shared-memory/decision-log.md b/docs/project-memory/shared-memory/decision-log.md
index 265ec8690..a11c2b6ff 100644
--- a/docs/project-memory/shared-memory/decision-log.md
+++ b/docs/project-memory/shared-memory/decision-log.md
@@ -1,5 +1,20 @@
 # 决策记录
 
+## 2026-09-23 自绘标题�是窗�边框：弹层从它下方开始，焦点陷阱放行它
+
+- 背景：AGC 打开任�一个 `ThemedModal` 弹窗（�布����布进度�资�预览�账本�错误报告等）�，�上角「最�化 / 最大化 / 关闭�点击没有任何�应，标题�拖拽也�能移动窗�；关掉弹窗立刻��。原因是标题�在模�之外，而 `focus-trap-react` 在 document �获阶段监� `mousedown`/`touchstart`/`click`，模�外的点击被 `preventDefault()` 且 `click` 直接 `stopImmediatePropagation()` —— React 的监�在更内层，事件到�了它，所以表现是「点了没�应�而�是报错。�有 `.app-update-overlay` 用 `inset: 0` 真的把标题�盖�了。
+- 决策：把自绘标题�定为**窗�边框**，�属于弹层内容：① portal 到 body 的全�弹层一律 `top: var(--window-chrome-height)`，�止用 `inset: 0` 盖�标题�；② `ThemedModal` 的焦点陷阱用 `allowOutsideClick` �放行�在 `[data-window-chrome-bar]` 内的目标，工作区内容的点击继续被拦�；③ `WindowChrome` 的标题�加 `data-window-chrome-bar` 标记，作为这�约定的唯一契约点。
+- 影�范围：`apps/ai-game-creator-shell/src/components/modal/ThemedModal.tsx`�`apps/ai-game-creator-shell/src/components/WindowChrome.tsx`�`apps/ai-game-creator-shell/src/styles.css`（`:root` 注释�`.app-update-overlay`�`.game-publish-progress-overlay`）。
+- 验�方�：`tests/themedModal.test.tsx`（标题�点击放行�工作区点击�被拦）�`tests/WindowChrome.test.tsx`（弹窗打开时三个窗�按钮�调用原生窗� API）�`tests/windowChromeOverlayContract.test.ts`（7 个全�弹层都从标题�下方开始）�`tests/gamePublishFeedback.test.tsx` 与 appSurface（208 passed）；两处新增用例都�过「去掉修��失败�的��确认。`npm run --workspace apps/ai-game-creator-shell typecheck`�eslint�`npm run check:encoding`�`git diff --check` 通过。
+
+## 2026-09-23 游��行包上���到 200 MiB（�代放行�与�行缓存�步）
+
+- 背景：游�广场�行包上�原为 100 MiB（`module-game-distribution` 的 `MAX_PACKAGE_BYTES` 与网页端 `GAME_PACKAGE_MAX_BYTES`），而 Nginx 三份模�与 Pingora 网关的通用 `/api` 放行�是 64 MiB。上��改一层没有�义：包体超过 100 MiB 时先在�代层被 413，`api-server` 的 ZIP 校验根本�会执行。
+- 决策：�行包上� 100 MiB → 200 MiB；展开总� 250 MiB → 500 MiB（�� 2.5 �余�）；�文件 64 MiB�最多 10,000 个文件�展开/压缩比 100 三�内容规则��；�行包路由请求体上�继续从包上�派生（200 MiB + 1 KiB）。�代放行�统一放宽到 210 MiB：`deploy/nginx/genarrative.conf`�`deploy/nginx/genarrative-dev-http.conf`�`deploy/container/nginx.conf` 使用 `client_max_body_size 210m`，Pingora `DEFAULT_MAX_API_BODY_BYTES` 改为 `220200960` 并�步 `deploy/pingora/pingora-gateway.env.example`。�行��资�进程内缓存字节预算 200 MiB → 256 MiB，让 200 MiB 档�行包�能进缓存�且�独�整份预算。
+- 边界：包内�个文件��得超过 64 MiB；线上 Pingora 环境文件若�写 `67108864`，必须在��网关��步改值，�则�行包 PUT 会在网关层被 413。AGC 一键�布� `@tauri-apps/plugin-http` 传整包字节，实际��布体积还�该传输方��制，200 MiB 档的客户端容�需��独验�。
+- 影�范围：`server-rs/crates/module-game-distribution/src/package.rs`�`server-rs/crates/api-server/src/modules/game_distribution.rs`�`server-rs/crates/pingora-gateway/src/main.rs`�`src/components/game-distribution/gameZipPackage.ts`�`deploy/{nginx,container,pingora}`�`docs/�玩法创作】平�入�与玩法链路-2026-05-15.md`�`docs/�开��维】本地开�验�与生产�维-2026-05-15.md`�`docs/technical/�开��维】Pingora独立网关试点-2026-06-11.md`。
+- 验�方�：`cargo test -p module-game-distribution`（13 passed，其中 `accepts_package_above_the_previous_hundred_mib_limit` 用两个 50 MiB 存储型�目构造 100 MiB 出头的包；把上�临时改回 100 MiB 时该用例确实失败，�明它能守�新上�）�`cargo test -p api-server game_distribution`（20 passed，�新增的请求体上�覆盖包上�断言）�`cargo test -p pingora-gateway`（38 passed，� `matches_nginx_route_parity_matrix`）�`npx vitest run src/components/game-distribution`（46 passed）�`cargo fmt --all -- --check`�`npm run check:encoding`�`npm run check:doc-index`�`git diff --check` 通过。`npm run check:pingora-route-parity` �在 dev-http / 容器模�缺少 `/games` 等 SPA 路由处失败，改动��样失败，与本次�径无关。200 MiB 档真实栈容���（上传耗时�api-server 峰值内存�超� 413 �径）尚未�跑，�布�需按阶段 D 脚本�跑一轮。
+
 ## 2026-09-23 引用���许空白：素� / Skill / 附件共用 `normalizeMentionName`
 
 - 背景：自动评审�现 `buildContentFromTextTokens` 在�缀��时会多�一枚芯片——素�显示� `hero` 与 `hero v2` 并存时，粘贴 `看 @hero v2 这一版` 得到 `[chip hero]` + `[chip hero-v2]`（短�先按 index 平局抢�，长��了补到末尾的孤儿）。根因�是匹�算法，而是**引用�自己带空白**：token 的边界规则是「��为空白或行首行尾�，`@hero�` 在 `@hero v2` 内部也算一次�法命中。
diff --git a/docs/technical/�开��维】Pingora独立网关试点-2026-06-11.md b/docs/technical/�开��维】Pingora独立网关试点-2026-06-11.md
index 74b666676..d5d5e3f34 100644
--- a/docs/technical/�开��维】Pingora独立网关试点-2026-06-11.md
+++ b/docs/technical/�开��维】Pingora独立网关试点-2026-06-11.md
@@ -488,7 +488,7 @@ dev 根盘空间在安装�曾接近满盘；2026-06-17 进入 canary �已清
 | `GENARRATIVE_PINGORA_GATEWAY_ACME_ROOT`                             | `/var/www/html`                            | ACME challenge ��目录。                                                                                                              |
 | `GENARRATIVE_PINGORA_GATEWAY_MAINTENANCE_FILE`                      | `/var/lib/genarrative/maintenance/enabled` | 存在�进入维护模�。                                                                                                                   |
 | `GENARRATIVE_PINGORA_GATEWAY_FORWARDED_PROTO`                       | `http`                                     | 写入 `X-Forwarded-Proto` 的值。                                                                                                        |
-| `GENARRATIVE_PINGORA_GATEWAY_MAX_API_BODY_BYTES`                    | `67108864`                                 | `/api` 通用路由的 `Content-Length` 上�。                                                                                              |
+| `GENARRATIVE_PINGORA_GATEWAY_MAX_API_BODY_BYTES`                    | `220200960`                                | `/api` 通用路由的 `Content-Length` 上�（210 MiB，覆盖游��行包 PUT 的 200 MiB + 1 KiB 路由上�）。                                   |
 | `GENARRATIVE_PINGORA_GATEWAY_COMPRESSION_ALGORITHMS`                | `gzip`                                     | 当�唯一�许的压缩算法白��；Pingora 正�化�径固定为 gzip-only，Brotli 继续由 Nginx / �置代�承担。                                 |
 | `GENARRATIVE_PINGORA_GATEWAY_GZIP_ENABLED`                          | `true`                                     | 是��用 gzip �应压缩。                                                                                                               |
 | `GENARRATIVE_PINGORA_GATEWAY_GZIP_LEVEL`                            | `5`                                        | gzip 压缩等级，必须在 `0..=9`。                                                                                                        |
diff --git a/docs/�开��维】本地开�验�与生产�维-2026-05-15.md b/docs/�开��维】本地开�验�与生产�维-2026-05-15.md
index 8fcaf11f0..ee9e75881 100644
--- a/docs/�开��维】本地开�验�与生产�维-2026-05-15.md
+++ b/docs/�开��维】本地开�验�与生产�维-2026-05-15.md
@@ -893,7 +893,7 @@ worker 被硬�或断电�，lease 过期任务�有尚未耗尽 `max_attempt
 - Server provision ��通过 Windows helper 下载，也��通过 Linux build 节点中转 SpacetimeDB / otelcol 工具包；Linux build 节点�负责从内网 Git �准备 provision 脚本和�置并上传给目标 agent。`Prepare Provision Tools` 在目标 dev / release agent 工作区内先检查 `/usr/local/bin/otelcol-contrib` 与 `${SPACETIME_ROOT}/bin/current`：SpacetimeDB 必须�时匹��行版本 `2.8.3` 和 commit `8e410d28...` �能�用；�有缺失或版本 / commit �匹�时�使用 `PROVISION_DOWNLOADS_DIR` 里的本地包或从�置的下载�准备官方 `v2.8.3` 资产。`SPACETIME_EXPECTED_COMMIT` 与下载根必须�对调整，安装结果也执行�一 commit 门�。otelcol-contrib 当��定 `0.151.0`；如果目标�务器下载需�代�，在 `PROVISION_DOWNLOAD_PROXY` �置目标机�访问的 HTTP 代�。
 - 除 `Genarrative-Server-Provision` 外，`Genarrative-Stdb-Module-Build`�`Genarrative-Web-Build`�`Genarrative-Api-Build`�`Genarrative-*Deploy`�`Genarrative-Database-Import/Export`�`Genarrative-Full-Build-And-Deploy` 和 `Genarrative-Notify-Email` 的生产�水线现都以 Linux agent 为主，�按�自 Jenkinsfile 的 checkout �径执行。Server provision �使用公网备用 Git �，目标部署 agent 也��需�访问�� Git remote。
 - `otelcol-contrib.service` 作为�选系统�务加入 provision，默认监� `127.0.0.1:4317/4318` 并使用 `deploy/otelcol/genarrative-debug.yaml`。api-server 是��� OTLP �由 `GENARRATIVE_OTEL_ENABLED` 控制，�务 unit � `deploy/systemd/otelcol-contrib.service`。该�务必须存在系统用户 / 组 `otelcol`，并且 `/etc/otelcol/genarrative-debug.yaml` 已安装到目标机；若看到 `status=217/USER` 或 `Failed to determine user credentials`，优先检查 `getent passwd otelcol`，�补� `/etc/otelcol` �置目录并���务。
-- Nginx `/api/` 与 `/admin/api/` 通过 `genarrative_api` upstream 代�到 `127.0.0.1:8082`，upstream keepalive 为 64；通用 API 使用 `genarrative_api_rps`，�� API 使用 `genarrative_admin_rps`。通用 `/api` location �留 `client_max_body_size 64m` 作为编辑器图片�视频和文档请求的�代兜底，真实大��由路由与业务校验负责。若线上出现 `413 Request Entity Too Large` 且 access log 中 `request_time=0.000`�`upstream_status=-`，说明请求在 Nginx 层被拦截，先核对 release 模�与实际媒体大�。`limit_conn_status 429` 和 `limit_req_status 429` 必须在 HTTP 与 HTTPS server 中�时生效。
+- Nginx `/api/` 与 `/admin/api/` 通过 `genarrative_api` upstream 代�到 `127.0.0.1:8082`，upstream keepalive 为 64；通用 API 使用 `genarrative_api_rps`，�� API 使用 `genarrative_admin_rps`。通用 `/api` location �留 `client_max_body_size 210m` 作为编辑器图片�视频�文档请求与游��行包 PUT（路由上� 200 MiB + 1 KiB）的�代兜底，真实大��由路由与业务校验负责；使用 Pingora 网关时 `GENARRATIVE_PINGORA_GATEWAY_MAX_API_BODY_BYTES` 必须�步�低于该值，�则网关侧会先返回 413。若线上出现 `413 Request Entity Too Large` 且 access log 中 `request_time=0.000`�`upstream_status=-`，说明请求在 Nginx 层被拦截，先核对 release 模�与实际媒体大�。`limit_conn_status 429` 和 `limit_req_status 429` 必须在 HTTP 与 HTTPS server 中�时生效。
 
 容器化隔离部署方案�独放在 `deploy/container/`，用于本机或预�模拟现有的 Linux release + Nginx + OTLP Collector � BgFilter 拓扑，�替�当�生产 `systemd + Nginx + Jenkins` �布路径。当� compose 没有 `bgfilter-worker`，�构�完整 BgFilter 预�拓扑，也�覆盖任何会触� BgFilter 的现役任务；它�用于� BgFilter 路径，或通过下述 unsupported job smoke 验�外部生�队列的 claim / fail 回写和 API-only 更新。当�容器模拟�数�留 `genarrative-release` 的 CPU�`nofile=4096` 与 `worker_connections=768` 采样�径，并在 compose 里�实到 `spacetimedb cpus=1.0 mem_limit=2g`�`api-server cpus=2.0 mem_limit=1g`�`external-generation-worker cpus=2.0 mem_limit=1g`�`nginx cpus=0.5 mem_limit=128m`�`otelcol cpus=0.25 mem_limit=128m`。完整模�首次实例化会超过旧 `896m` cgroup 上�，因此 SpacetimeDB 必须使用 `2g`；这�改�生产�务资���。容器 `api-server` 默认 `GENARRATIVE_API_WORKER_THREADS=4`，�增加 Tokio worker 调度并�，��破 `api-server cpus=2.0` 的 CPU ��；容器默认 `GENARRATIVE_EXTERNAL_GENERATION_MODE=queue`，�用 `npm run container:up -- --scale external-generation-worker=N external-generation-worker` 验���过 BgFilter 的外部生� worker 动�扩缩容，`inline` 模���与该验�：
 
diff --git a/docs/�玩法创作】平�入�与玩法链路-2026-05-15.md b/docs/�玩法创作】平�入�与玩法链路-2026-05-15.md
index accee82c1..e30e1e175 100644
--- a/docs/�玩法创作】平�入�与玩法链路-2026-05-15.md
+++ b/docs/�玩法创作】平�入�与玩法链路-2026-05-15.md
@@ -84,13 +84,14 @@
 
 1. AGC �布�当� npm 工程已�功构建的 `dist/` 内容，�新检查入�和实际字节；ZIP 内部必须把 `dist/index.html` 归一化为根 `index.html`，其余路径相对�行根����。�得上传整个项目���快照或仅��本地路径。网页 ZIP �样�求根 `index.html`，�猜测并自动剥离多层目录。
 2. 所有�行�赖都必须在�行包内。资� URL 使用与�行版本目录兼容的相对地�；�导 `/assets`�本地文件 URL�外部脚本/样�/媒体/字体地���属于�接��行��。客户端给出��作错误，�务器�独立校验；��校验�能代替�行时 CSP 阻断。
-3. 建议首版��：压缩包 100 MiB�展开总� 250 MiB��文件 64 MiB�最多 10,000 个文件�展开/压缩比�超过 100。�务端拒�加密 ZIP���或大�写冲�路径��对路径�`..`�符�链接/�解�点�设备文件和嵌套压缩包；拒� `.agent`�版本控制目录�`node_modules`�凭�文件与��映射文件。超�返回明确错误，�截断�继续�布。
+3. 现行��：压缩包 200 MiB�展开总� 500 MiB��文件 64 MiB�最多 10,000 个文件�展开/压缩比�超过 100。压缩包上��时决定 `api-server` 的�行包路由请求体上�（200 MiB + 1 KiB）与�代放行�：Nginx 通用 `/api` location 为 `client_max_body_size 210m`，Pingora 网关为 `GENARRATIVE_PINGORA_GATEWAY_MAX_API_BODY_BYTES=220200960`；三者必须�时满足，�则�法包会在�代或路由层被 413。�务端拒�加密 ZIP���或大�写冲�路径��对路径�`..`�符�链接/�解�点�设备文件和嵌套压缩包；拒� `.agent`�版本控制目录�`node_modules`�凭�文件与��映射文件。超�返回明确错误，�截断�继续�布。超过约 100 MiB 的包在 `api-server` 会带�数百 MB 的瞬时内存�用，�布窗�与实例规格需按容�验�基线预留。
 4. �交声明 ZIP 的 SHA-256 与字节数，�务端对收到的真实 ZIP �新计算，�对展开文件建立相对路径�字节数和 SHA-256 清�。摘��一致�缺文件或入���时�止；�有 metadata 而没有已确认完整对象的�交必须失败。
 5. 游�资料��行版本冻结：标题 2–40 字�短简介�超过 120 字�详细介��超过 2,000 字�一个分类�最多 5 个标签（�个�超过 20 字）�必需���最多 6 张截图��作方��超过 240 字。分类首版为休闲�益智�动作�冒险�模拟�策略�其他；��/截图�用平�图片上传与归属校验，�接�任�外链作为审核图片。作者�需�自己构建或打 ZIP：AGC �布时对 `game/` �工程按需执行 `npm install`（�用 `project.bootstrap`）与 `npm run build`（�用 `project.verify` 的�控 npm �行器，脚本白��� `build`��止项目级 `.npmrc` 改写语义），�把 `game/dist` 归一化�根 `index.html` 的�行包上传；已有�玩入�（`game/index.html` 或 `dist/index.html`）时跳过构建。Phaser 4 + Vite 已按此�径端到端验�（构建产物��行网关与网页沙箱播放）。�布入�按�度下�：�端�度�置键固定为 `game-distribution:publish`（��「�度�布�置��改，支� `enabled` / `rolloutPercent` / `allowUserIds` / `allowUserTags`）。�度默认关闭：未�置该键�或 `enabled=false` 时，未登录与已登录作者都拿到�开放（�布入��渲染�写入� 503）；��在��创建该键并 `enabled=true` �，�有白�� / �度比例 / 用户标签命中的作者拿到开放状�。�布入�的开放状�� `/api/runtime/frontend-config` 的 `gameDistributionPublishEnabled` 下�，网页广场/我的游�入�与 AGC �天头「�布到游�广场�按钮�此显示或��；写入��独立校验，收紧期间�交返回 503 与�读文案，读接��目录�详情��行网关与安全下架��影�。作者续�时按版本冻结快照回填��与截图并�用�一批素�；公开投影�暴露对象键，素� ID �在作者与管�员回读时返回，快照里缺素� ID 的旧版本必须�求作者�新选择��。AGC �布���展示 ZIP 路径�文件数或体积等技术摘�；一��简介与分类�根�有界�脱�的创作上下文�费生�（�扣用户泥点，��编辑），分类必须收敛到上述白��；游���支�基于项目上下文生�，生�走现役图片生�与泥点扣费链路，产物必须登记为当�账�平�素���能作为 `coverAssetId` �交。
 6. `supportedDevices` 至少包� `desktop` 或 `mobile`；`inputModes` �自 `keyboard`�`mouse`�`touch`；声明移动端必须包� `touch`。`orientation` 为 `landscape`�`portrait` 或 `responsive`。这些是待人工�核的作者声明，目录�显示已��版本审核通过的值。
 7. 原始 ZIP�未审核展开目录�审核资料�为�有对象；公开版本�暴露��镜�键�本地路径�访问凭�或�有账�元数�。�行文件�能由�行网关按游��版本和文件白��读�，�能绕过网关访问公开 OSS bucket。
 8. 现役�行网关由 `api-server` �供：`GET /api/game-distribution/releases/{gameId}`（�尾斜�）等价于该游�的 `index.html`，`GET /api/game-distribution/releases/{gameId}/{assetPath}` ��务当�已公开版本包内的文件，�有 ZIP 与未公开版本�因知� ID 而�读。�应按扩展�白��设定内容类型，未知扩展�返回 404；全部�应带 `X-Content-Type-Options: nosniff`�`Cross-Origin-Resource-Policy: cross-origin` 与�带 credentials 的 `Access-Control-Allow-Origin: *`（�行文档�行在 `allow-scripts` 的 opaque origin 沙箱里，`same-origin` 会让游�自己的脚本被�览器拦下），HTML 追加最��� CSP。带平� `Cookie` 的请求一律 `403`，���行文件被主站��读�；�行网关必须部署在独立��。�行包按对象键在进程内�有界缓存，�个超预算包�进入缓存。
 9. 审核通过时必须�交�对 HTTPS `entryUrl`，且�接�凭��query 和 fragment；�务端�根�请求 Host 或本地路径拼默认�行地�，��把内网地�或主站��写进公开投影。 �生产环境�外�许 http 回环地�（`127.0.0.1` / `localhost` / `[::1]`），�径与�端 `normalizeGameEntryUrl` 一致，便于本地在没有 TLS 的情况下验�内嵌游玩；生产环境�接� HTTPS。
+10. 上传有两�等价入�，共用�一版本状�机�摘��径�幂等键与校验规则：① 整包入�——网页端与旧客户端对 `versionId` 直接 `PUT` 整包字节，原����续传，���行包上�与请求体�制约�；② 分片续传入�——AGC 原生一键�布对�一 `versionId` 顺�上传固定大�的分片，�以�独的完�动作收�。分片大�由�务端下�且固定（现为 8 MiB，��行包上� 200 MiB �整到 25 片以内），客户端�得自行改�；分片续传入��补传缺失字节，任何分片��或乱�都�得造���写入。AGC 侧必须由原生进程直接读�本地试玩包并按分片��，整包字节�得�过 WebView IPC 往返，也�得整包驻留宿主内存。
 
 ### 身份�状��审核与更新
 
@@ -106,7 +107,9 @@
 ### 幂等�并�与��
 
 - 所有创建��交�审核�撤销和下架动作�带 `Idempotency-Key`。�务端以认�主体�动作和 key �存请求摘�与结果；� key �请求返回原结果，� key ��请求返回 `409 IDEMPOTENCY_CONFLICT`。至少�留 30 天；客户端超出��窗�先回读记录，�能把未知结果自动当作失败��。
-- �一个版本�能确认一份 ZIP：中断�传�使用� `versionId` 和摘�，已确认相�字节直接返回�功，��摘�返回 409。上传中�版本第二个写入返回 `409 UPLOAD_IN_PROGRESS`；未确认�包�会进入校验。首版整包�传，�宣称支�分片断点续传。
+- �一个版本�能确认一份 ZIP：中断�传�使用� `versionId` 和摘�，已确认相�字节直接返回�功，��摘�返回 409。上传中�版本第二个写入返回 `409 UPLOAD_IN_PROGRESS`；未确认�包�会进入校验。
+- 分片续传以「�务端已收字节�为唯一���移：客户端带上自己认为的�移上传分片，与�务端记录�一致时�务端返回 `409` 与���移，客户端按���移继续，��放也�跳段。传输失败�网络中断�客户端进程退出或应用���，�一 `versionId` �新�布�补传缺失分片；已收字节数由�务端�久化事实决定，��赖客户端本地记录。
+- 分片会�在全部字节到�并执行完�动作之�，�进入包校验��确认版本��改�任何公开��性，�包对象也��务给�行网关。完�动作里校验失败时删除该�包对象并把版本�到 `upload_failed`（`recoveryAction=reupload`）；作者��新上传�一版本时必须先显��置分片会�，�置�已收字节归零，��许在�包之上续写��字节。
 - ���交�一次 AGC �作�得创建第二个游�或版本；原生端�久�存�作 ID�目标游�/版本和 key，网页�存��标识并以�务端回读为准。相� ZIP 用于��资料修订时�许新版本，�能仅按包摘��掉新的�布�图。
 - 公开版本切��作者下架和管�员审核必须带 `expectedPublicationRevision`，在�久化事务中比较并推进。并��化返回 `409 PUBLICATION_CONFLICT`；旧�审版本�能在用户已�布更新或下架之��默覆盖状�。审核员�新查看现状��能�交新的明确动作。
 - 网络中断或�应丢失�先查询原�作/版本；�务端�� `validating` 的在途任务并按版本身份幂等续作，��建版本。登录失效�留�有�稿和��标识，�新登录�账��继续；�账��能读�或接管原账��作。
diff --git a/server-rs/crates/api-server/src/modules/game_distribution.rs b/server-rs/crates/api-server/src/modules/game_distribution.rs
index 108f29425..ac56a40c2 100644
--- a/server-rs/crates/api-server/src/modules/game_distribution.rs
+++ b/server-rs/crates/api-server/src/modules/game_distribution.rs
@@ -19,7 +19,10 @@ use module_game_distribution::{
     validate_release_zip,
 };
 use platform_llm::{EDITOR_AGENT_GPT5_MODEL, LlmMessage, LlmRunRequest};
-use platform_oss::{OssGetObjectRequest, OssInternalPutObjectRequest, OssObjectAccess};
+use platform_oss::{
+    OssAppendInternalObjectRequest, OssDeleteObjectRequest, OssGetObjectRequest,
+    OssInternalPutObjectRequest, OssObjectAccess,
+};
 use serde::Deserialize;
 use serde_json::{Value, json};
 use shared_contracts::game_distribution::{
@@ -49,6 +52,13 @@ use crate::{
 };
 
 pub(crate) const MAX_PACKAGE_REQUEST_BODY_BYTES: usize = MAX_PACKAGE_BYTES as usize + 1024;
+/// 分片续传的固定分片大�：200 MiB 上�下最多 25 片，�片远低于�代放行�。
+/// 客户端�能使用�务端下�的值，�得自行改�分片边界，�则���移会立刻对�上。
+pub(crate) const PACKAGE_UPLOAD_CHUNK_BYTES: usize = 8 * 1024 * 1024;
+/// 分片路由的请求体放行�：分片大� + 1 KiB 头部余�。
+pub(crate) const MAX_PACKAGE_CHUNK_REQUEST_BODY_BYTES: usize = PACKAGE_UPLOAD_CHUNK_BYTES + 1024;
+/// 分片�移由客户端显�声明，�务端以对象当�长度为唯一��。
+const PACKAGE_UPLOAD_OFFSET_HEADER: &str = "x-genarrative-upload-offset";
 const MAX_LIST_LIMIT: u32 = 48;
 const MAX_IDEMPOTENCY_KEY_CHARS: usize = 128;
 const MAX_PACKAGE_MANIFEST_JSON_BYTES: usize = 2 * 1024 * 1024;
@@ -60,7 +70,9 @@ const GAME_DISTRIBUTION_PUBLISHED_STATUS: &str = "published";
 const GAME_DISTRIBUTION_OSS_PUT_MAX_ATTEMPTS: usize = 3;
 const GAME_DISTRIBUTION_OSS_PUT_RETRY_DELAYS_MS: [u64; 2] = [250, 500];
 const RELEASE_PACKAGE_CACHE_MAX_ENTRIES: usize = 4;
-const RELEASE_PACKAGE_CACHE_MAX_BYTES: usize = 200 * 1024 * 1024;
+/// 缓存字节预算必须比�个�行包上�大出一档，�则 200 MiB 档的包�能刚好自�整份预算，
+/// 任何并�的�包都会被立刻挤掉。
+const RELEASE_PACKAGE_CACHE_MAX_BYTES: usize = 256 * 1024 * 1024;
 
 /// �行��资�的进程内缓存。
 ///
@@ -179,6 +191,23 @@ pub fn router(state: AppState) -> Router<AppState> {
             "/api/game-distribution/versions/{version_id}/package",
             put(upload_package).layer(DefaultBodyLimit::max(MAX_PACKAGE_REQUEST_BODY_BYTES)),
         )
+        .route(
+            "/api/game-distribution/versions/{version_id}/package/upload-state",
+            get(package_upload_state),
+        )
+        .route(
+            "/api/game-distribution/versions/{version_id}/package/chunk",
+            put(upload_package_chunk)
+                .layer(DefaultBodyLimit::max(MAX_PACKAGE_CHUNK_REQUEST_BODY_BYTES)),
+        )
+        .route(
+            "/api/game-distribution/versions/{version_id}/package/complete",
+            post(complete_package_upload),
+        )
+        .route(
+            "/api/game-distribution/versions/{version_id}/package/reset",
+            post(reset_package_upload),
+        )
         .route(
             "/api/game-distribution/versions/{version_id}/submit",
             post(submit_version),
@@ -630,46 +659,10 @@ async fn upload_package(
             return Err(mapped);
         }
     };
-    if manifest.package_sha256 != expected.package_sha256
-        || manifest.package_bytes != expected.package_bytes
-        || u32::try_from(manifest.files.len()).unwrap_or(u32::MAX) != expected.package_file_count
-        || expected.package_entry_path != "index.html"
-    {
-        warn!(
-            request_id = ctx.request_id(),
-            operation = "package_rejected",
-            game_id = %expected.game_id,
-            version_id = %version_id,
-            code = "PACKAGE_MISMATCH",
-            declared_bytes = expected.package_bytes,
-            actual_bytes = manifest.package_bytes,
-            declared_file_count = expected.package_file_count,
-            actual_file_count = u32::try_from(manifest.files.len()).unwrap_or(u32::MAX),
-            elapsed_ms = ctx.elapsed(),
-            "�行包与版本声明�一致"
-        );
-        let error = AppError::from_status(StatusCode::CONFLICT)
-            .with_code("PACKAGE_MISMATCH")
-            .with_details(json!({
-                "provider": "game-distribution",
-                "message": "�行包摘��体积�文件数或入�与版本声明�一致",
-            }));
-        record_upload_failure(
-            &state,
-            &owner_user_id,
-            &version_id,
-            &idempotency_key,
-            "PACKAGE_MISMATCH",
-            "�行包摘��体积�文件数或入�与版本声明�一致".to_string(),
-        )
-        .await;
-        return Err(error);
-    }
     let package_object_key = format!(
         "{GAME_DISTRIBUTION_OBJECT_PREFIX}{}/{version_id}.zip",
         expected.game_id
     );
-    let package_manifest_json = package_manifest_json(&manifest)?;
     let oss = state.project_snapshot_oss_client().ok_or_else(|| {
         AppError::from_status(StatusCode::SERVICE_UNAVAILABLE).with_message("游��行包 OSS 未�置")
     })?;
@@ -697,7 +690,8 @@ async fn upload_package(
         None => false,
     };
     if !skipped {
-        // �次 100 MiB PUT 在本机实测 12 秒上下，��传输失败会让作者白传一次；
+        // �次 100 MiB 档 PUT 在本机实测 12 秒上下（上���到 200 MiB ��次耗时与失败
+        // 暴露��步放大），��传输失败会让作者白传一次；
         // 这里按 platform-oss 既有的��试分类��控�试（��试传输/超时/408/429/5xx）。
         oss.put_internal_object_with_retry(
             state.editor_oss_http_client(),
@@ -714,28 +708,93 @@ async fn upload_package(
         .await
         .map_err(|error| map_oss_error(error, "aliyun-oss"))?;
     }
+    confirm_validated_package(
+        &state,
+        &ctx,
+        &owner_user_id,
+        &version_id,
+        &expected,
+        &manifest,
+        package_object_key,
+        &idempotency_key,
+        skipped,
+    )
+    .await
+}
+
+/// 校验通过�的共�收�：声明比对 → 确认 → 结构化事件。
+///
+/// 整包 `PUT` 与分片续传的完�动作共用这�路径，两�入�的校验�幂等与事件�径必须一致；
+/// 任何入�都�得绕过它直接写版本状�。
+#[allow(clippy::too_many_arguments)]
+async fn confirm_validated_package(
+    state: &AppState,
+    ctx: &RequestContext,
+    owner_user_id: &str,
+    version_id: &str,
+    expected: &GameDistributionVersionRecord,
+    manifest: &ReleasePackageManifest,
+    package_object_key: String,
+    idempotency_key: &str,
+    oss_put_skipped: bool,
+) -> Result<Json<Value>, AppError> {
+    if manifest.package_sha256 != expected.package_sha256
+        || manifest.package_bytes != expected.package_bytes
+        || u32::try_from(manifest.files.len()).unwrap_or(u32::MAX) != expected.package_file_count
+        || expected.package_entry_path != "index.html"
+    {
+        warn!(
+            request_id = ctx.request_id(),
+            operation = "package_rejected",
+            game_id = %expected.game_id,
+            version_id = %version_id,
+            code = "PACKAGE_MISMATCH",
+            declared_bytes = expected.package_bytes,
+            actual_bytes = manifest.package_bytes,
+            declared_file_count = expected.package_file_count,
+            actual_file_count = u32::try_from(manifest.files.len()).unwrap_or(u32::MAX),
+            elapsed_ms = ctx.elapsed(),
+            "�行包与版本声明�一致"
+        );
+        let error = AppError::from_status(StatusCode::CONFLICT)
+            .with_code("PACKAGE_MISMATCH")
+            .with_details(json!({
+                "provider": "game-distribution",
+                "message": "�行包摘��体积�文件数或入�与版本声明�一致",
+            }));
+        record_upload_failure(
+            state,
+            owner_user_id,
+            version_id,
+            idempotency_key,
+            "PACKAGE_MISMATCH",
+            "�行包摘��体积�文件数或入�与版本声明�一致".to_string(),
+        )
+        .await;
+        return Err(error);
+    }
+    let package_manifest_json = package_manifest_json(manifest)?;
     let request_digest = compute_request_digest(
-        &serde_json::to_vec(&(version_id.as_str(), manifest.package_sha256.as_str()))
+        &serde_json::to_vec(&(version_id, manifest.package_sha256.as_str()))
             .map_err(|error| internal(error.to_string()))?,
     );
     let log_game_id = expected.game_id.clone();
     let log_package_bytes = manifest.package_bytes;
     let log_file_count = u32::try_from(manifest.files.len()).unwrap_or(u32::MAX);
     let log_sha_prefix = manifest.package_sha256.chars().take(12).collect::<String>();
-    let log_oss_put_skipped = skipped;
     let confirmed = state
         .spacetime_client()
         .confirm_game_distribution_package(
             spacetime_client::GameDistributionConfirmPackageRecordInput {
-                version_id,
-                owner_user_id,
-                package_sha256: manifest.package_sha256,
+                version_id: version_id.to_string(),
+                owner_user_id: owner_user_id.to_string(),
+                package_sha256: manifest.package_sha256.clone(),
                 package_bytes: manifest.package_bytes,
                 package_file_count: u32::try_from(manifest.files.len()).unwrap_or(u32::MAX),
                 package_entry_path: "index.html".to_string(),
                 package_object_key,
                 package_manifest_json,
-                idempotency_key,
+                idempotency_key: idempotency_key.to_string(),
                 request_digest,
                 updated_at_micros: now_micros(),
             },
@@ -750,16 +809,341 @@ async fn upload_package(
         package_bytes = log_package_bytes,
         file_count = log_file_count,
         sha256_prefix = %log_sha_prefix,
-        oss_put_skipped = log_oss_put_skipped,
+        oss_put_skipped,
         elapsed_ms = ctx.elapsed(),
         "�行包已确认"
     );
     Ok(json_success_body(
-        Some(&ctx),
+        Some(ctx),
         json!({ "versionId": confirmed.0.version_id, "status": confirmed.0.status }),
     ))
 }
 
+/// 分片续传的状�查询：客户端拿到的「已收字节��自 OSS 对象事实，��赖本地记录，
+/// 因此进程����机器或�网络�都能从���移继续。
+async fn package_upload_state(
+    State(state): State<AppState>,
+    Extension(ctx): Extension<RequestContext>,
+    Extension(auth): Extension<AuthenticatedAccessToken>,
+    Path(version_id): Path<String>,
+) -> Result<Json<Value>, AppError> {
+    let owner_user_id = auth.claims().user_id().to_string();
+    ensure_publish_enabled(&state, Some(owner_user_id.as_str())).await?;
+    let version = load_owner_version_or_404(&state, owner_user_id, version_id.clone()).await?;
+    let oss = game_distribution_oss_client(&state)?;
+    let object_key = game_distribution_package_object_key(&version.game_id, &version_id);
+    let received_bytes = staged_package_bytes(&state, oss, &object_key).await?;
+    Ok(json_success_body(
+        Some(&ctx),
+        json!({
+            "versionId": version_id,
+            "status": version.status,
+            "chunkBytes": PACKAGE_UPLOAD_CHUNK_BYTES,
+            "declaredPackageBytes": version.package_bytes,
+            "receivedBytes": received_bytes,
+        }),
+    ))
+}
+
+/// 分片写入。
+///
+/// 客户端声明的�移必须等于�务端已收字节；�一致时返回 409 与���移，
+/// 由客户端按���移续传 —— 这样�放与乱�都�会造���写入。
+async fn upload_package_chunk(
+    State(state): State<AppState>,
+    Extension(ctx): Extension<RequestContext>,
+    Extension(auth): Extension<AuthenticatedAccessToken>,
+    headers: HeaderMap,
+    Path(version_id): Path<String>,
+    body: Bytes,
+) -> Result<Json<Value>, AppError> {
+    require_octet_stream_content_type(&headers)?;
+    let owner_user_id = auth.claims().user_id().to_string();
+    ensure_publish_enabled(&state, Some(owner_user_id.as_str())).await?;
+    // 分片级�放由�移语义��，这里��求幂等键，��与其它写入�一致的调用约定。
+    let _idempotency_key = idempotency_key(&headers)?;
+    let offset = package_upload_offset(&headers)?;
+    if body.is_empty() {
+        return Err(bad_request("�行包分片内容�能为空"));
+    }
+    if body.len() > PACKAGE_UPLOAD_CHUNK_BYTES {
+        return Err(AppError::from_status(StatusCode::PAYLOAD_TOO_LARGE)
+            .with_code("PACKAGE_CHUNK_TOO_LARGE")
+            .with_message("�行包分片超过�务端下�的大�"));
+    }
+    let version = load_owner_version_or_404(&state, owner_user_id, version_id.clone()).await?;
+    let chunk_bytes = u64::try_from(body.len()).unwrap_or(u64::MAX);
+    let end = offset
+        .checked_add(chunk_bytes)
+        .ok_or_else(|| bad_request("�行包分片�移溢出"))?;
+    if end > version.package_bytes {
+        return Err(AppError::from_status(StatusCode::CONFLICT)
+            .with_code("PACKAGE_UPLOAD_EXCEEDS_DECLARED")
+            .with_details(json!({
+                "provider": "game-distribution",
+                "declaredPackageBytes": version.package_bytes,
+                "receivedBytes": offset,
+                "message": "分片写入会超过版本声明的�行包大�",
+            })));
+    }
+    let oss = game_distribution_oss_client(&state)?;
+    let object_key = game_distribution_package_object_key(&version.game_id, &version_id);
+    let received_bytes = staged_package_bytes(&state, oss, &object_key).await?;
+    if offset != received_bytes {
+        warn!(
+            request_id = ctx.request_id(),
+            operation = "package_chunk_offset_mismatch",
+            game_id = %version.game_id,
+            version_id = %version_id,
+            declared_offset = offset,
+            received_bytes,
+            "�行包分片�移与�务端已收字节�一致"
+        );
+        return Err(AppError::from_status(StatusCode::CONFLICT)
+            .with_code("PACKAGE_UPLOAD_OFFSET_MISMATCH")
+            .with_message("分片�移与�务端已收字节�一致，请按���移续传")
+            .with_details(json!({
+                "provider": "game-distribution",
+                "receivedBytes": received_bytes,
+            })));
+    }
+    let appended = oss
+        .append_internal_object_with_retry(
+            state.editor_oss_http_client(),
+            OssAppendInternalObjectRequest {
+                object_key,
+                content_type: Some("application/zip".to_string()),
+                position: offset,
+                body: body.to_vec(),
+            },
+            GAME_DISTRIBUTION_OSS_PUT_MAX_ATTEMPTS,
+            &GAME_DISTRIBUTION_OSS_PUT_RETRY_DELAYS_MS,
+        )
+        .await
+        .map_err(|error| map_oss_error(error, "aliyun-oss"))?;
+    info!(
+        request_id = ctx.request_id(),
+        operation = "package_chunk_stored",
+        game_id = %version.game_id,
+        version_id = %version_id,
+        offset,
+        chunk_bytes = appended.appended_bytes,
+        received_bytes = appended.next_position,
+        elapsed_ms = ctx.elapsed(),
+        "�行包分片已写入"
+    );
+    Ok(json_success_body(
+        Some(&ctx),
+        json!({
+            "versionId": version_id,
+            "chunkBytes": PACKAGE_UPLOAD_CHUNK_BYTES,
+            "receivedBytes": appended.next_position,
+        }),
+    ))
+}
+
+/// 分片续传的完�动作：全部字节到���回读整包�校验并确认。
+///
+/// 校验失败时删除�包对象并把版本�到 `upload_failed`，���包留在对象键上拖��续�传。
+async fn complete_package_upload(
+    State(state): State<AppState>,
+    Extension(ctx): Extension<RequestContext>,
+    Extension(auth): Extension<AuthenticatedAccessToken>,
+    headers: HeaderMap,
+    Path(version_id): Path<String>,
+) -> Result<Json<Value>, AppError> {
+    let owner_user_id = auth.claims().user_id().to_string();
+    ensure_publish_enabled(&state, Some(owner_user_id.as_str())).await?;
+    let idempotency_key = idempotency_key(&headers)?;
+    let version =
+        load_owner_version_or_404(&state, owner_user_id.clone(), version_id.clone()).await?;
+    let oss = game_distribution_oss_client(&state)?;
+    let object_key = game_distribution_package_object_key(&version.game_id, &version_id);
+    let received_bytes = staged_package_bytes(&state, oss, &object_key).await?;
+    if received_bytes == 0 {
+        return Err(AppError::from_status(StatusCode::CONFLICT)
+            .with_code("PACKAGE_UPLOAD_NOT_STARTED")
+            .with_details(json!({
+                "provider": "game-distribution",
+                "declaredPackageBytes": version.package_bytes,
+                "receivedBytes": 0,
+                "message": "该版本还没有任何已收分片",
+            })));
+    }
+    if received_bytes != version.package_bytes {
+        return Err(AppError::from_status(StatusCode::CONFLICT)
+            .with_code("PACKAGE_UPLOAD_INCOMPLETE")
+            .with_message("�行包分片尚未收�")
+            .with_details(json!({
+                "provider": "game-distribution",
+                "declaredPackageBytes": version.package_bytes,
+                "receivedBytes": received_bytes,
+            })));
+    }
+    let body = oss
+        .get_object(
+            state.editor_oss_http_client(),
+            OssGetObjectRequest {
+                object_key: object_key.clone(),
+                max_bytes: MAX_PACKAGE_BYTES as usize,
+            },
+        )
+        .await
+        .map_err(|error| map_oss_error(error, "aliyun-oss"))?;
+    let manifest = match validate_release_zip(&body) {
+        Ok(manifest) => manifest,
+        Err(error) => {
+            let reason = format!("{error:?}");
+            warn!(
+                request_id = ctx.request_id(),
+                operation = "package_rejected",
+                game_id = %version.game_id,
+                version_id = %version_id,
+                code = "PACKAGE_VALIDATION_FAILED",
+                reason = %reason,
+                uploaded_bytes = body.len(),
+                elapsed_ms = ctx.elapsed(),
+                "�行包校验失败"
+            );
+            let mapped = map_package_error(error);
+            if let Err(delete_error) = oss
+                .delete_object(
+                    state.editor_oss_http_client(),
+                    OssDeleteObjectRequest {
+                        object_key: object_key.clone(),
+                    },
+                )
+                .await
+            {
+                warn!(
+                    request_id = ctx.request_id(),
+                    operation = "package_staging_delete_failed",
+                    version_id = %version_id,
+                    error = %delete_error,
+                    "校验失败的�包对象删除失败，需�人工确认对象键状�"
+                );
+            }
+            record_upload_failure(
+                &state,
+                &owner_user_id,
+                &version_id,
+                &idempotency_key,
+                "PACKAGE_VALIDATION_FAILED",
+                reason,
+            )
+            .await;
+            return Err(mapped);
+        }
+    };
+    confirm_validated_package(
+        &state,
+        &ctx,
+        &owner_user_id,
+        &version_id,
+        &version,
+        &manifest,
+        object_key,
+        &idempotency_key,
+        true,
+    )
+    .await
+}
+
+/// 显��置分片会�：删除�包对象并把已收字节归零。
+///
+/// �有尚未确认过�行包的版本能�置；已确认的版本必须新建版本，�能在�包之上续写��字节。
+async fn reset_package_upload(
+    State(state): State<AppState>,
+    Extension(ctx): Extension<RequestContext>,
+    Extension(auth): Extension<AuthenticatedAccessToken>,
+    headers: HeaderMap,
+    Path(version_id): Path<String>,
+) -> Result<Json<Value>, AppError> {
+    let owner_user_id = auth.claims().user_id().to_string();
+    ensure_publish_enabled(&state, Some(owner_user_id.as_str())).await?;
+    let _idempotency_key = idempotency_key(&headers)?;
+    let version = load_owner_version_or_404(&state, owner_user_id, version_id.clone()).await?;
+    if !matches!(version.status.as_str(), "awaiting_upload" | "upload_failed") {
+        return Err(AppError::from_status(StatusCode::CONFLICT)
+            .with_code("PACKAGE_UPLOAD_RESET_NOT_ALLOWED")
+            .with_message("该版本已�确认过�行包，�新上传请新建版本"));
+    }
+    let oss = game_distribution_oss_client(&state)?;
+    let object_key = game_distribution_package_object_key(&version.game_id, &version_id);
+    oss.delete_object(
+        state.editor_oss_http_client(),
+        OssDeleteObjectRequest {
+            object_key: object_key.clone(),
+        },
+    )
+    .await
+    .map_err(|error| map_oss_error(error, "aliyun-oss"))?;
+    info!(
+        request_id = ctx.request_id(),
+        operation = "package_upload_reset",
+        game_id = %version.game_id,
+        version_id = %version_id,
+        elapsed_ms = ctx.elapsed(),
+        "�行包分片会�已�置"
+    );
+    Ok(json_success_body(
+        Some(&ctx),
+        json!({ "versionId": version_id, "receivedBytes": 0 }),
+    ))
+}
+
+fn game_distribution_oss_client(state: &AppState) -> Result<&platform_oss::OssClient, AppError> {
+    state.project_snapshot_oss_client().ok_or_else(|| {
+        AppError::from_status(StatusCode::SERVICE_UNAVAILABLE).with_message("游��行包 OSS 未�置")
+    })
+}
+
+fn game_distribution_package_object_key(game_id: &str, version_id: &str) -> String {
+    format!("{GAME_DISTRIBUTION_OBJECT_PREFIX}{game_id}/{version_id}.zip")
+}
+
+/// 已收字节的����：对象存在时的长度；确定�存在时是 0，其它失败按上游错误上报。
+async fn staged_package_bytes(
+    state: &AppState,
+    oss: &platform_oss::OssClient,
+    object_key: &str,
+) -> Result<u64, AppError> {
+    let head = oss
+        .head_internal_object(state.editor_oss_http_client(), object_key)
+        .await
+        .map_err(|error| map_oss_error(error, "aliyun-oss"))?;
+    Ok(head.map(|object| object.content_length).unwrap_or(0))
+}
+
+fn require_octet_stream_content_type(headers: &HeaderMap) -> Result<(), AppError> {
+    let content_type = headers
+        .get(header::CONTENT_TYPE)
+        .and_then(|value| value.to_str().ok())
+        .map(|value| {
+            value
+                .split(';')
+                .next()
+                .unwrap_or_default()
+                .trim()
+                .to_ascii_lowercase()
+        });
+    if content_type.as_deref() != Some("application/octet-stream") {
+        return Err(bad_request("�行包分片必须使用 application/octet-stream"));
+    }
+    Ok(())
+}
+
+fn package_upload_offset(headers: &HeaderMap) -> Result<u64, AppError> {
+    let raw = headers
+        .get(PACKAGE_UPLOAD_OFFSET_HEADER)
+        .and_then(|value| value.to_str().ok())
+        .map(str::trim)
+        .filter(|value| !value.is_empty())
+        .ok_or_else(|| bad_request("缺少�行包分片�移"))?;
+    raw.parse::<u64>()
+        .map_err(|_| bad_request("�行包分片�移必须是�负整数"))
+}
+
 async fn submit_version(
     State(state): State<AppState>,
     Extension(ctx): Extension<RequestContext>,
@@ -1969,6 +2353,64 @@ mod tests {
         }
     }
 
+    #[test]
+    fn package_request_body_limit_covers_max_package_bytes() {
+        // �径约�：�行包路由的请求体放行�必须覆盖包体上�，�则�法包会在
+        // `DefaultBodyLimit` 处被 413，而 ZIP 校验根本没机会执行。
+        assert!(MAX_PACKAGE_REQUEST_BODY_BYTES > MAX_PACKAGE_BYTES as usize);
+    }
+
+    #[test]
+    fn package_chunk_size_stays_inside_declared_limits() {
+        // 分片必须能整除�地覆盖 200 MiB 档�行包（最多 25 片），且分片放行��留出头部余�。
+        assert_eq!(PACKAGE_UPLOAD_CHUNK_BYTES, 8 * 1024 * 1024);
+        assert!(PACKAGE_UPLOAD_CHUNK_BYTES < MAX_PACKAGE_BYTES as usize);
+        assert!(MAX_PACKAGE_CHUNK_REQUEST_BODY_BYTES > PACKAGE_UPLOAD_CHUNK_BYTES);
+        assert!(
+            (MAX_PACKAGE_BYTES as usize).div_ceil(PACKAGE_UPLOAD_CHUNK_BYTES) <= 25,
+            "200 MiB 档�行包的分片数必须�超过 25 片"
+        );
+    }
+
+    #[test]
+    fn package_upload_offset_requires_non_negative_integer() {
+        let mut headers = HeaderMap::new();
+        assert!(package_upload_offset(&headers).is_err());
+
+        headers.insert(PACKAGE_UPLOAD_OFFSET_HEADER, HeaderValue::from_static("  "));
+        assert!(package_upload_offset(&headers).is_err());
+
+        headers.insert(PACKAGE_UPLOAD_OFFSET_HEADER, HeaderValue::from_static("-1"));
+        assert!(package_upload_offset(&headers).is_err());
+
+        headers.insert(
+            PACKAGE_UPLOAD_OFFSET_HEADER,
+            HeaderValue::from_static("8388608"),
+        );
+        assert_eq!(
+            package_upload_offset(&headers).expect("�法�移"),
+            PACKAGE_UPLOAD_CHUNK_BYTES as u64
+        );
+    }
+
+    #[test]
+    fn package_chunk_content_type_must_be_octet_stream() {
+        let mut headers = HeaderMap::new();
+        assert!(require_octet_stream_content_type(&headers).is_err());
+
+        headers.insert(
+            header::CONTENT_TYPE,
+            HeaderValue::from_static("application/zip"),
+        );
+        assert!(require_octet_stream_content_type(&headers).is_err());
+
+        headers.insert(
+            header::CONTENT_TYPE,
+            HeaderValue::from_static("application/octet-stream"),
+        );
+        assert!(require_octet_stream_content_type(&headers).is_ok());
+    }
+
     #[test]
     fn metadata_rejects_mobile_games_without_touch_support() {
         let mut payload = metadata();
diff --git a/server-rs/crates/module-game-distribution/src/package.rs b/server-rs/crates/module-game-distribution/src/package.rs
index 5e8faf9f5..feb85a54e 100644
--- a/server-rs/crates/module-game-distribution/src/package.rs
+++ b/server-rs/crates/module-game-distribution/src/package.rs
@@ -6,8 +6,13 @@ use std::{
 
 use sha2::{Digest, Sha256};
 
-pub const MAX_PACKAGE_BYTES: u64 = 100 * 1024 * 1024;
-pub const MAX_EXPANDED_BYTES: u64 = 250 * 1024 * 1024;
+/// �行包体积上�。�代放行�与路由请求体上�都从它派生：Nginx
+/// `client_max_body_size`�Pingora `MAX_API_BODY_BYTES` 必须�步放宽，�则�法包会在
+/// 到达 `api-server` 之�被拒。
+pub const MAX_PACKAGE_BYTES: u64 = 200 * 1024 * 1024;
+/// 展开总�上���压缩包上�的 2.5 �余�：包体本身基本���压时展开�约等于包体，
+/// 纯文本 / JSON 资��比高的包��有足够空间。
+pub const MAX_EXPANDED_BYTES: u64 = 500 * 1024 * 1024;
 pub const MAX_FILE_BYTES: u64 = 64 * 1024 * 1024;
 pub const MAX_FILE_COUNT: usize = 10_000;
 pub const MAX_COMPRESSION_RATIO: u64 = 100;
@@ -187,6 +192,23 @@ mod tests {
         output.into_inner()
     }
 
+    /// 存储型�目的压缩包；用于构造体积�控且��与 deflate 的大包。
+    fn stored_archive(files: &[(&str, &[u8])]) -> Vec<u8> {
+        let mut output = Cursor::new(Vec::new());
+        let mut writer = ZipWriter::new(&mut output);
+        for (path, content) in files {
+            writer
+                .start_file(
+                    *path,
+                    SimpleFileOptions::default().compression_method(zip::CompressionMethod::Stored),
+                )
+                .expect("zip entry");
+            writer.write_all(content).expect("zip content");
+        }
+        writer.finish().expect("finish zip");
+        output.into_inner()
+    }
+
     #[test]
     fn accepts_root_entry_and_returns_file_manifest() {
         let bytes = archive(&[("index.html", b"<html></html>"), ("assets/a.txt", b"a")]);
@@ -222,4 +244,27 @@ mod tests {
             Err(ReleasePackageError::InvalidPath)
         );
     }
+
+    #[test]
+    fn keeps_expansion_headroom_over_package_limit() {
+        // �径约�：�行包上�调整时，展开总�至少�留出两�余�，
+        // �则高文本�比的�法包会在展开�检查处被误拒。
+        assert!(MAX_EXPANDED_BYTES >= MAX_PACKAGE_BYTES.saturating_mul(2));
+    }
+
+    #[test]
+    fn accepts_package_above_the_previous_hundred_mib_limit() {
+        // 上�从 100 MiB �到 200 MiB 的回归防护：两个 50 MiB 存储型�目组� 100 MiB
+        // 出头的包，旧上�会在这里判 PackageTooLarge，新上�必须放行并给出完整清�。
+        let chunk = vec![0_u8; 50 * 1024 * 1024];
+        let bytes = stored_archive(&[
+            ("index.html", b"<html></html>"),
+            ("assets/a.bin", chunk.as_slice()),
+            ("assets/b.bin", chunk.as_slice()),
+        ]);
+        assert!(bytes.len() as u64 > 100 * 1024 * 1024);
+        let manifest = validate_release_zip(&bytes).expect("package above 100 MiB");
+        assert_eq!(manifest.package_bytes, bytes.len() as u64);
+        assert_eq!(manifest.files.len(), 3);
+    }
 }
diff --git a/server-rs/crates/pingora-gateway/src/main.rs b/server-rs/crates/pingora-gateway/src/main.rs
index 88af466f2..9c1a6e877 100644
--- a/server-rs/crates/pingora-gateway/src/main.rs
+++ b/server-rs/crates/pingora-gateway/src/main.rs
@@ -37,7 +37,9 @@ const DEFAULT_WEB_ROOT: &str = "/srv/genarrative/web";
 const DEFAULT_ACME_ROOT: &str = "/var/www/html";
 const DEFAULT_MAINTENANCE_FILE: &str = "/var/lib/genarrative/maintenance/enabled";
 const DEFAULT_MAINTENANCE_PAGE_FILE: &str = "/var/lib/genarrative/maintenance/page.html";
-const DEFAULT_MAX_API_BODY_BYTES: u64 = 64 * 1024 * 1024;
+// 通用 /api 路由的放行上�；必须覆盖游��行包 PUT（路由 `DefaultBodyLimit` 200 MiB + 1 KiB），
+// 具体接�的真实上��由 api-server �路由校验。
+const DEFAULT_MAX_API_BODY_BYTES: u64 = 210 * 1024 * 1024;
 const DEFAULT_GZIP_LEVEL: u32 = 5;
 const DEFAULT_GZIP_MIN_LENGTH_BYTES: u64 = 1024;
 const DEFAULT_UPSTREAM_CONNECT_TIMEOUT_MS: u64 = 3_000;
diff --git a/server-rs/crates/platform-oss/src/lib.rs b/server-rs/crates/platform-oss/src/lib.rs
index 32b3d02f6..4cce2d31a 100644
--- a/server-rs/crates/platform-oss/src/lib.rs
+++ b/server-rs/crates/platform-oss/src/lib.rs
@@ -132,6 +132,29 @@ pub struct OssInternalPutObjectRequest {
     pub body: Vec<u8>,
 }
 
+/// 内部对象的追加写请求（OSS AppendObject）。
+///
+/// `position = 0` 表示追加到当�末尾；`position > 0` 必须等于对象当�长度，
+/// �则上游直接失败 —— 分片续传�赖这�语义���放�会��写入。
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct OssAppendInternalObjectRequest {
+    pub object_key: String,
+    pub content_type: Option<String>,
+    pub position: u64,
+    pub body: Vec<u8>,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct OssAppendInternalObjectResponse {
+    pub provider: &'static str,
+    pub bucket: String,
+    pub endpoint: String,
+    pub object_key: String,
+    pub appended_bytes: u64,
+    /// 下一次�写�置，由 OSS 返回，是「已收字节�的��值。
+    pub next_position: u64,
+}
+
 #[derive(Clone, Debug, PartialEq, Eq)]
 pub struct OssPutObjectRequest {
     pub prefix: LegacyAssetPrefix,
@@ -1018,6 +1041,105 @@ impl OssClient {
         .await
     }
 
+    /// 内部对象追加写，返回 OSS 给出的下一次�写�置（已收字节的��值）。
+    ///
+    /// 与整对象 PUT 的区别是「�续写�：`position = 0` 追加到当�末尾，
+    /// `position > 0` 必须与对象当�长度一致（�一致时 OSS 判失败，�会��写入）。
+    /// 因此续传�需�回读对象长度，�从未写�置继续。
+    pub async fn append_internal_object(
+        &self,
+        client: &reqwest::Client,
+        request: OssAppendInternalObjectRequest,
+    ) -> Result<OssAppendInternalObjectResponse, OssError> {
+        let object_key = normalize_internal_object_key(&request.object_key)?;
+        if request.body.is_empty() {
+            return Err(OssError::InvalidRequest(
+                "�务端内部对象追加内容�能为空".to_string(),
+            ));
+        }
+        let content_type = normalize_optional_value(request.content_type);
+        let mut target_url =
+            build_object_url(&self.config.bucket, &self.config.endpoint, &object_key).map_err(
+                |error| {
+                    request_error(
+                        OssRequestOperation::Put,
+                        &format!("构造 OSS 对象 URL 失败：{error}"),
+                    )
+                },
+            )?;
+        target_url
+            .query_pairs_mut()
+            .append_pair("append", "")
+            .append_pair("position", &request.position.to_string());
+        let appended_bytes = u64::try_from(request.body.len())
+            .map_err(|_| OssError::InvalidRequest("追加内容大�超出�支�范围".to_string()))?;
+        let headers = BTreeMap::new();
+        let builder = signed_request_builder(
+            client,
+            &self.config,
+            Method::POST,
+            Some(&object_key),
+            target_url,
+            content_type.as_deref(),
+            &headers,
+        )?
+        .header(reqwest::header::CONTENT_LENGTH, appended_bytes)
+        .body(request.body);
+        let response = builder
+            .send()
+            .await
+            .map_err(|error| request_error_from_reqwest(OssRequestOperation::Put, error))?;
+        if !response.status().is_success() {
+            return Err(request_status_error(
+                OssRequestOperation::Put,
+                response.status().as_u16(),
+                format!("OSS AppendObject 失败，状��：{}", response.status()),
+            ));
+        }
+        let next_position = response
+            .headers()
+            .get("x-oss-next-append-position")
+            .and_then(|value| value.to_str().ok())
+            .and_then(|value| value.trim().parse::<u64>().ok())
+            .ok_or_else(|| {
+                OssError::InvalidRequest("OSS AppendObject 未返回 next-append-position".to_string())
+            })?;
+        Ok(OssAppendInternalObjectResponse {
+            provider: OSS_PROVIDER,
+            bucket: self.config.bucket.clone(),
+            endpoint: self.config.endpoint.clone(),
+            object_key,
+            appended_bytes,
+            next_position,
+        })
+    }
+
+    /// 内部对象追加写的�控�试，判定与退��径和 `put_internal_object_with_retry` 一致。
+    pub async fn append_internal_object_with_retry(
+        &self,
+        client: &reqwest::Client,
+        request: OssAppendInternalObjectRequest,
+        max_attempts: usize,
+        retry_delays_ms: &[u64],
+    ) -> Result<OssAppendInternalObjectResponse, OssError> {
+        if max_attempts == 0 {
+            return Err(OssError::InvalidConfig(
+                "内部对象追加�试次数至少为 1".to_string(),
+            ));
+        }
+        if retry_delays_ms.len() < max_attempts.saturating_sub(1) {
+            return Err(OssError::InvalidConfig(
+                "内部对象追加�试缺少退��置".to_string(),
+            ));
+        }
+        let log_key = request.object_key.clone();
+        run_internal_put_with_retry(max_attempts, retry_delays_ms, &log_key, move || {
+            let request = request.clone();
+            async move { self.append_internal_object(client, request).await }
+        })
+        .await
+    }
+
     async fn put_internal_object_bytes(
         &self,
         client: &reqwest::Client,
@@ -1709,7 +1831,7 @@ where
                     max_attempts,
                     retry_delay_ms = delay_ms,
                     error = %error,
-                    "OSS 内部对象 PUT 失败，按退��试"
+                    "OSS 内部对象写入失败，按退��试"
                 );
                 sleep(std::time::Duration::from_millis(delay_ms)).await;
                 attempt += 1;
diff --git a/src/components/game-distribution/gameZipPackage.test.ts b/src/components/game-distribution/gameZipPackage.test.ts
index d4f4181a0..ca2a4a826 100644
--- a/src/components/game-distribution/gameZipPackage.test.ts
+++ b/src/components/game-distribution/gameZipPackage.test.ts
@@ -3,7 +3,7 @@
 import JSZip from 'jszip';
 import { describe, expect, it } from 'vitest';
 
-import { prepareGamePackage } from './gameZipPackage';
+import { GAME_PACKAGE_MAX_BYTES, prepareGamePackage } from './gameZipPackage';
 
 async function buildZip(files: Record<string, string>) {
   const zip = new JSZip();
@@ -52,4 +52,12 @@ describe('prepareGamePackage', () => {
       ),
     ).rejects.toThrow('�行包�是有效的 ZIP');
   });
+
+  it('超过上�时在读�字节之�就失败关闭', async () => {
+    // �伪造体积，�真的分� 200 MiB；预检必须在读字节之�拦下。
+    const oversized = { size: GAME_PACKAGE_MAX_BYTES + 1 } as unknown as File;
+    await expect(prepareGamePackage(oversized)).rejects.toThrow(
+      '�行包�能超过 200 MiB',
+    );
+  });
 });
diff --git a/src/components/game-distribution/gameZipPackage.ts b/src/components/game-distribution/gameZipPackage.ts
index eb8497f18..fcc25c8da 100644
--- a/src/components/game-distribution/gameZipPackage.ts
+++ b/src/components/game-distribution/gameZipPackage.ts
@@ -1,6 +1,6 @@
 import JSZip from 'jszip';
 
-export const GAME_PACKAGE_MAX_BYTES = 100 * 1024 * 1024;
+export const GAME_PACKAGE_MAX_BYTES = 200 * 1024 * 1024;
 export const GAME_PACKAGE_MAX_FILE_COUNT = 10_000;
 
 export type PreparedGamePackage = {
@@ -59,7 +59,7 @@ export async function prepareGamePackage(
     throw new Error('请选择�空的�行包 ZIP');
   }
   if (file.size > GAME_PACKAGE_MAX_BYTES) {
-    throw new Error('�行包�能超过 100 MiB');
+    throw new Error('�行包�能超过 200 MiB');
   }
   const bytes = await readGamePackageBytes(file);
   let archive: JSZip;