diff --git a/apps/ai-game-creator-shell/src-tauri/src/agent/generation.rs b/apps/ai-game-creator-shell/src-tauri/src/agent/generation.rs
index 2831f11fb..31a97c103 100644
--- a/apps/ai-game-creator-shell/src-tauri/src/agent/generation.rs
+++ b/apps/ai-game-creator-shell/src-tauri/src/agent/generation.rs
@@ -29,7 +29,7 @@ pub(in crate::agent) use canvas_generation::{
     validate_platform_art_png_bytes_with_limits,
 };
 pub(in crate::agent) use draft_validation::validate_closed_game_script_blocks;
-pub(crate) use external_generation_state::platform_art_generation_external_configuration_fingerprint;
+pub(crate) use external_generation_state::platform_art_generation_external_service_fingerprint;
 pub(in crate::agent) use external_generation_state::{
     game_creator_agent_runtime_external_generation_exists,
     platform_art_generation_runtime_context_from_pending,
@@ -39,6 +39,7 @@ pub(in crate::agent) use external_generation_state::{
 };
 #[cfg(test)]
 pub(crate) use external_generation_state::{
+    platform_art_generation_external_configuration_fingerprint,
     setup_platform_art_generation_runtime_accepted_for_recovery_test,
     write_platform_art_generation_runtime_accepted_for_test,
     write_platform_art_generation_runtime_prepared_for_test,
diff --git a/apps/ai-game-creator-shell/src-tauri/src/agent/generation/canvas_generation.rs b/apps/ai-game-creator-shell/src-tauri/src/agent/generation/canvas_generation.rs
index 946cf06b0..6ffcd6ae4 100644
--- a/apps/ai-game-creator-shell/src-tauri/src/agent/generation/canvas_generation.rs
+++ b/apps/ai-game-creator-shell/src-tauri/src/agent/generation/canvas_generation.rs
@@ -1,13 +1,16 @@
+#[cfg(test)]
+use super::external_generation_state::platform_art_generation_external_configuration_fingerprint;
 use super::external_generation_state::{
     mark_platform_art_generation_runtime_accepted,
     mark_platform_art_generation_runtime_legacy_completed,
-    platform_art_generation_external_configuration_fingerprint,
+    migrate_platform_art_generation_external_configuration,
+    platform_art_generation_external_service_fingerprint,
     platform_art_generation_runtime_idempotency_key, platform_art_generation_runtime_legacy_result,
     platform_art_generation_runtime_request_body_json,
     platform_art_generation_runtime_request_snapshot, platform_art_generation_runtime_status,
     platform_art_generation_runtime_submission_payload,
     prepare_platform_art_generation_runtime_state, read_platform_art_generation_runtime_state,
-    validate_platform_art_generation_external_configuration, PlatformArtGenerationRuntimeState,
+    PlatformArtGenerationRuntimeState,
 };
 use super::*;
 
@@ -1155,12 +1158,19 @@ pub(in crate::agent) async fn request_platform_art_asset_with_runtime_options_at
     };
     let api_base_url = resolve_canvas_sync_api_base_url(None)?;
     let api_key = resolve_canvas_sync_api_key(None)?;
-    if let Some(state) = persisted_runtime_state.as_ref() {
-        validate_platform_art_generation_external_configuration(state, &api_base_url, &api_key)
-            .map_err(|error| format!("{EXTERNAL_GENERATION_RESULT_UNKNOWN_PREFIX} {error}"))?;
-    }
+    let persisted_runtime_state = persisted_runtime_state
+        .map(|state| {
+            migrate_platform_art_generation_external_configuration(
+                root,
+                state,
+                &api_base_url,
+                &api_key,
+            )
+            .map_err(|error| format!("{EXTERNAL_GENERATION_RESULT_UNKNOWN_PREFIX} {error}"))
+        })
+        .transpose()?;
     let external_configuration_fingerprint =
-        platform_art_generation_external_configuration_fingerprint(&api_base_url, &api_key);
+        platform_art_generation_external_service_fingerprint(&api_base_url);
     let client = reqwest::Client::builder()
         .timeout(Duration::from_secs(60))
         .build()
@@ -6512,7 +6522,7 @@ mod canvas_generation_tests {
     }
 
     #[tokio::test]
-    async fn accepted_runtime_generation_rejects_external_configuration_drift_before_get() {
+    async fn accepted_runtime_generation_rejects_external_service_drift_before_get() {
         let temporary = tempfile::tempdir().expect("create configuration drift project");
         let root = temporary.path();
         init_local_game_project_at(root, "configuration-drift", "External Editor 配置漂移")
@@ -6552,10 +6562,7 @@ mod canvas_generation_tests {
             action_fingerprint: "configuration-drift-fingerprint".to_string(),
         };
         let stale_configuration_fingerprint =
-            platform_art_generation_external_configuration_fingerprint(
-                "https://old-editor.example.test",
-                "old-editor-key",
-            );
+            platform_art_generation_external_service_fingerprint("https://old-editor.example.test");
         let (state, _) = prepare_platform_art_generation_runtime_state(
             root,
             &runtime_context,
@@ -6587,7 +6594,7 @@ mod canvas_generation_tests {
             Err(error) => error,
             Ok(_) => panic!("configuration drift must block GET-only recovery"),
         };
-        assert!(error.contains("baseUrl/API Key"), "{error}");
+        assert!(error.contains("服务地址身份"), "{error}");
         assert!(matches!(
             listener.accept(),
             Err(error) if error.kind() == std::io::ErrorKind::WouldBlock
diff --git a/apps/ai-game-creator-shell/src-tauri/src/agent/generation/external_generation_state.rs b/apps/ai-game-creator-shell/src-tauri/src/agent/generation/external_generation_state.rs
index 247b78fa0..5c4a81386 100644
--- a/apps/ai-game-creator-shell/src-tauri/src/agent/generation/external_generation_state.rs
+++ b/apps/ai-game-creator-shell/src-tauri/src/agent/generation/external_generation_state.rs
@@ -122,7 +122,12 @@ fn request_body_json_and_sha256(
     Ok((request_body_json, request_body_sha256))
 }
 
-pub(crate) fn platform_art_generation_external_configuration_fingerprint(
+pub(crate) fn platform_art_generation_external_service_fingerprint(api_base_url: &str) -> String {
+    let normalized_base_url = api_base_url.trim().trim_end_matches('/');
+    format!("{:x}", Sha256::digest(normalized_base_url.as_bytes()))
+}
+
+fn platform_art_generation_legacy_external_configuration_fingerprint(
     api_base_url: &str,
     api_key: &str,
 ) -> String {
@@ -134,18 +139,48 @@ pub(crate) fn platform_art_generation_external_configuration_fingerprint(
     )
 }
 
+// Keep the historical helper for persisted-agent call sites while changing its
+// identity semantics: credentials authorize an operation but do not own it.
+#[cfg(test)]
+pub(crate) fn platform_art_generation_external_configuration_fingerprint(
+    api_base_url: &str,
+    _api_key: &str,
+) -> String {
+    platform_art_generation_external_service_fingerprint(api_base_url)
+}
+
 pub(super) fn validate_platform_art_generation_external_configuration(
     state: &PlatformArtGenerationRuntimeState,
     api_base_url: &str,
     api_key: &str,
 ) -> Result<(), String> {
-    let current = platform_art_generation_external_configuration_fingerprint(api_base_url, api_key);
-    if state.external_configuration_fingerprint != current {
-        return Err("External Editor 生成账本与当前 baseUrl/API Key 身份不一致".to_string());
+    let current = platform_art_generation_external_service_fingerprint(api_base_url);
+    let legacy =
+        platform_art_generation_legacy_external_configuration_fingerprint(api_base_url, api_key);
+    if state.external_configuration_fingerprint != current
+        && state.external_configuration_fingerprint != legacy
+    {
+        return Err("External Editor 生成账本与当前服务地址身份不一致".to_string());
     }
     Ok(())
 }
 
+pub(super) fn migrate_platform_art_generation_external_configuration(
+    root: &Path,
+    mut state: PlatformArtGenerationRuntimeState,
+    api_base_url: &str,
+    api_key: &str,
+) -> Result<PlatformArtGenerationRuntimeState, String> {
+    validate_platform_art_generation_external_configuration(&state, api_base_url, api_key)?;
+    let current = platform_art_generation_external_service_fingerprint(api_base_url);
+    if state.external_configuration_fingerprint != current {
+        state.external_configuration_fingerprint = current;
+        state.updated_at = unix_timestamp();
+        write_platform_art_generation_runtime_state(root, &state)?;
+    }
+    Ok(state)
+}
+
 fn validate_platform_art_generation_runtime_identity(
     root: &Path,
     state: &PlatformArtGenerationRuntimeState,
@@ -667,9 +702,8 @@ pub(crate) fn write_platform_art_generation_runtime_accepted_for_test(
     let context = platform_art_generation_runtime_context_from_pending(pending);
     let api_base_url =
         resolve_canvas_sync_api_base_url(None).unwrap_or_else(|_| "http://127.0.0.1:1".to_string());
-    let api_key = resolve_canvas_sync_api_key(None).unwrap_or_else(|_| "test-api-key".to_string());
     let external_configuration_fingerprint =
-        platform_art_generation_external_configuration_fingerprint(&api_base_url, &api_key);
+        platform_art_generation_external_service_fingerprint(&api_base_url);
     let (state, created) = prepare_platform_art_generation_runtime_state(
         root,
         &context,
@@ -700,9 +734,8 @@ pub(crate) fn write_platform_art_generation_runtime_prepared_for_test(
     let context = platform_art_generation_runtime_context_from_pending(pending);
     let api_base_url =
         resolve_canvas_sync_api_base_url(None).unwrap_or_else(|_| "http://127.0.0.1:1".to_string());
-    let api_key = resolve_canvas_sync_api_key(None).unwrap_or_else(|_| "test-api-key".to_string());
     let external_configuration_fingerprint =
-        platform_art_generation_external_configuration_fingerprint(&api_base_url, &api_key);
+        platform_art_generation_external_service_fingerprint(&api_base_url);
     let (_, created) = prepare_platform_art_generation_runtime_state(
         root,
         &context,
@@ -786,6 +819,85 @@ pub(crate) fn setup_platform_art_generation_runtime_accepted_for_recovery_test(
 mod external_generation_state_tests {
     use super::*;
 
+    #[test]
+    fn external_service_fingerprint_ignores_key_rotation_and_normalizes_trailing_slash() {
+        let original = platform_art_generation_external_configuration_fingerprint(
+            "https://editor.example.test/",
+            "original-key",
+        );
+        let rotated = platform_art_generation_external_configuration_fingerprint(
+            "https://editor.example.test",
+            "rotated-key",
+        );
+        let different_service = platform_art_generation_external_service_fingerprint(
+            "https://other-editor.example.test",
+        );
+
+        assert_eq!(original, rotated);
+        assert_ne!(original, different_service);
+    }
+
+    #[test]
+    fn legacy_external_configuration_fingerprint_migrates_before_key_rotation() {
+        let temporary = crate::tests::canonical_test_tempdir("legacy-fingerprint-");
+        let root = temporary.path();
+        init_local_game_project_at(root, "legacy-fingerprint", "旧配置指纹迁移")
+            .expect("init project");
+        let pending = pending_canvas_generation(root);
+        let context = platform_art_generation_runtime_context_from_pending(&pending);
+        let api_base_url = "https://editor.example.test/";
+        let legacy_fingerprint = platform_art_generation_legacy_external_configuration_fingerprint(
+            api_base_url,
+            "original-key",
+        );
+        let (legacy_state, created) = prepare_platform_art_generation_runtime_state(
+            root,
+            &context,
+            "/api/external/v1/editor/images/generations",
+            "legacy-fingerprint-canvas",
+            "恢复旧请求",
+            &serde_json::json!({
+                "prompt": "恢复旧请求",
+                "kind": "spec",
+                "projectId": "canvas-project",
+                "assetFolderId": "asset-folder",
+                "referenceImageSrcs": []
+            }),
+            &legacy_fingerprint,
+        )
+        .expect("prepare legacy generation ledger");
+        assert!(created);
+
+        let migrated = migrate_platform_art_generation_external_configuration(
+            root,
+            legacy_state,
+            api_base_url,
+            "original-key",
+        )
+        .expect("migrate legacy fingerprint");
+        assert_eq!(
+            migrated.external_configuration_fingerprint,
+            platform_art_generation_external_service_fingerprint(api_base_url)
+        );
+        validate_platform_art_generation_external_configuration(
+            &migrated,
+            "https://editor.example.test",
+            "rotated-key",
+        )
+        .expect("rotated key must recover the migrated operation");
+        assert!(validate_platform_art_generation_external_configuration(
+            &migrated,
+            "https://other-editor.example.test",
+            "rotated-key",
+        )
+        .is_err());
+
+        let persisted = read_platform_art_generation_runtime_state(root, &context)
+            .expect("read migrated ledger")
+            .expect("migrated ledger exists");
+        assert_eq!(persisted, migrated);
+    }
+
     fn pending_canvas_generation(root: &Path) -> AgentRuntimePendingToolAction {
         let mut runtime = start_game_creator_agent_runtime_task_at(
             root,
@@ -915,12 +1027,12 @@ mod external_generation_state_tests {
             "test-api-key",
         )
         .is_err());
-        assert!(validate_platform_art_generation_external_configuration(
+        validate_platform_art_generation_external_configuration(
             &prepared,
             "https://editor.example.test",
             "different-api-key",
         )
-        .is_err());
+        .expect("rotated API Key must keep ownership of the accepted service operation");
         assert_eq!(
             platform_art_generation_runtime_recovery_at(root, &pending)
                 .expect("read prepared recovery"),
diff --git a/apps/ai-game-creator-shell/src-tauri/src/commands.rs b/apps/ai-game-creator-shell/src-tauri/src/commands.rs
index 943a363cd..466a6322f 100644
--- a/apps/ai-game-creator-shell/src-tauri/src/commands.rs
+++ b/apps/ai-game-creator-shell/src-tauri/src/commands.rs
@@ -1222,6 +1222,24 @@ pub(crate) async fn derive_local_project_resource(
     derive_local_project_resource_at(input).await
 }
 
+#[tauri::command]
+pub(crate) fn list_pending_local_project_resource_edits(
+    input: ListPendingLocalProjectResourceEditsInput,
+) -> Result<Vec<PendingLocalProjectResourceEdit>, String> {
+    let root = Path::new(input.project_path.trim());
+    enforce_project_permission_policy(root, "file.list")?;
+    list_pending_local_project_resource_edits_at(input)
+}
+
+#[tauri::command]
+pub(crate) async fn resume_local_project_resource_edit(
+    input: ResumeLocalProjectResourceEditInput,
+) -> Result<DeriveLocalProjectResourceResult, String> {
+    let root = Path::new(input.project_path.trim());
+    enforce_project_permission_policy(root, "asset.register")?;
+    resume_local_project_resource_edit_at(input).await
+}
+
 #[tauri::command]
 pub(crate) fn normalize_local_project_raster_resource(
     input: NormalizeLocalProjectRasterResourceInput,
diff --git a/apps/ai-game-creator-shell/src-tauri/src/main.rs b/apps/ai-game-creator-shell/src-tauri/src/main.rs
index 4f8e996c4..03da2dba4 100644
--- a/apps/ai-game-creator-shell/src-tauri/src/main.rs
+++ b/apps/ai-game-creator-shell/src-tauri/src/main.rs
@@ -2207,6 +2207,8 @@ fn main() {
             upload_local_asset,
             register_local_asset,
             derive_local_project_resource,
+            list_pending_local_project_resource_edits,
+            resume_local_project_resource_edit,
             normalize_local_project_raster_resource,
             import_canvas_asset,
             import_canvas_export,
diff --git a/apps/ai-game-creator-shell/src-tauri/src/project/asset_canvas.rs b/apps/ai-game-creator-shell/src-tauri/src/project/asset_canvas.rs
index 9506ffdc7..406166c3e 100644
--- a/apps/ai-game-creator-shell/src-tauri/src/project/asset_canvas.rs
+++ b/apps/ai-game-creator-shell/src-tauri/src/project/asset_canvas.rs
@@ -1273,7 +1273,9 @@ pub(crate) fn update_asset_canvas_draft_at(
     validate_safe_revision(draft.revision, "草稿 revision")?;
     draft.status = input.status.clone();
     draft.canvas = input.canvas.clone();
-    draft.generations = input.generations.clone();
+    // Generation records are advanced by the Rust generation ledger. A regular
+    // canvas autosave may carry an older frontend snapshot and must never erase
+    // accepted/running/reconciliation facts written by the backend.
     draft.updated_at = asset_canvas_now();
     write_asset_canvas_draft_locked(root, &draft)?;
     Ok(UpdateAssetCanvasDraftResult {
diff --git a/apps/ai-game-creator-shell/src-tauri/src/project/asset_canvas/generation.rs b/apps/ai-game-creator-shell/src-tauri/src/project/asset_canvas/generation.rs
index 8679d13ce..7a6450d01 100644
--- a/apps/ai-game-creator-shell/src-tauri/src/project/asset_canvas/generation.rs
+++ b/apps/ai-game-creator-shell/src-tauri/src/project/asset_canvas/generation.rs
@@ -304,7 +304,8 @@ fn resolve_generation_api_mode() -> Result<(String, CanvasGenerationApiMode), St
 }
 
 fn canvas_api_identity_fingerprint(api_base_url: &str, mode: &CanvasGenerationApiMode) -> String {
-    platform_art_generation_external_configuration_fingerprint(api_base_url, mode.bearer_token())
+    let _ = mode;
+    platform_art_generation_external_service_fingerprint(api_base_url)
 }
 
 fn authorize_canvas_request(
@@ -842,6 +843,7 @@ fn stable_manifest_reference(asset: &GameCreationAppAssetManifestEntry) -> Optio
             !value.is_empty()
                 && !value.starts_with("local-asset:")
                 && !value.starts_with("draft-media:")
+                && !value.starts_with("task:")
         })
         .map(str::to_string)
 }
diff --git a/apps/ai-game-creator-shell/src-tauri/src/project/asset_canvas_tests.rs b/apps/ai-game-creator-shell/src-tauri/src/project/asset_canvas_tests.rs
index f8b4d0f23..9bce10dce 100644
--- a/apps/ai-game-creator-shell/src-tauri/src/project/asset_canvas_tests.rs
+++ b/apps/ai-game-creator-shell/src-tauri/src/project/asset_canvas_tests.rs
@@ -938,3 +938,44 @@ fn rejects_bad_signature_oversize_identity_replacement_and_linked_sidecars() {
         );
     }
 }
+
+#[test]
+fn ordinary_draft_update_preserves_backend_authoritative_generation_records() {
+    let fixture = initialize_fixture();
+    let mut authoritative = fixture.draft.clone();
+    authoritative.generations.push(AssetCanvasGenerationRecord {
+        generation_id: Uuid::new_v4().to_string(),
+        intent_id: Uuid::new_v4().to_string(),
+        phase: AssetCanvasGenerationStatus::GenerationRunning,
+        reference_resource_ids: Vec::new(),
+        output_asset_id: None,
+        error_code: None,
+        created_at: 1,
+        updated_at: 2,
+        idempotency_key: None,
+        status: None,
+        prompt: None,
+        operation_id: None,
+        output_media_ids: Vec::new(),
+    });
+    write_asset_canvas_draft_locked(fixture.root(), &authoritative)
+        .expect("write authoritative generation record");
+
+    let mut canvas = authoritative.canvas.clone();
+    canvas.viewport.x = 42.0;
+    let updated = update_asset_canvas_draft_at(
+        fixture.root(),
+        &UpdateAssetCanvasDraftInput {
+            project_path: project_path(fixture.root()),
+            expected_project_id: PROJECT_ID.to_string(),
+            draft_id: authoritative.draft_id.clone(),
+            expected_draft_revision: authoritative.revision,
+            status: AssetCanvasDraftStatus::Editing,
+            canvas,
+            generations: Vec::new(),
+        },
+    )
+    .expect("save stale frontend draft");
+    assert_eq!(updated.draft.generations, authoritative.generations);
+    assert_eq!(updated.draft.canvas.viewport.x, 42.0);
+}
diff --git a/apps/ai-game-creator-shell/src-tauri/src/project/resource_editor.rs b/apps/ai-game-creator-shell/src-tauri/src/project/resource_editor.rs
index 5b74eb5e5..7424b46e2 100644
--- a/apps/ai-game-creator-shell/src-tauri/src/project/resource_editor.rs
+++ b/apps/ai-game-creator-shell/src-tauri/src/project/resource_editor.rs
@@ -14,6 +14,9 @@ const RESOURCE_EDIT_ROOT: &str = ".agent/resource-edits";
 const RESOURCE_EDIT_QUEUE_SOURCE: &str = "game-creator-resource-editor";
 const RESOURCE_EDIT_UPLOAD_LEGACY_PREFIX: &str = "generated-character-drafts";
 const RESOURCE_EDIT_UPLOAD_NAMESPACE: &str = "resource-editor-references";
+const RESOURCE_EDIT_LEDGER_SCAN_MAX_ENTRIES: usize = 4_096;
+const RESOURCE_EDIT_VERSION_JOURNAL_SCHEMA_VERSION: &str =
+    "game-creator-resource-edit-version-transaction.v1";
 
 static RESOURCE_EDIT_LOCK: OnceLock<tokio::sync::Mutex<()>> = OnceLock::new();
 
@@ -94,6 +97,32 @@ pub(crate) struct DeriveLocalProjectResourceResult {
     pub(crate) manifest: GameCreationAppManifest,
 }
 
+#[derive(Clone, Debug, Deserialize)]
+#[serde(deny_unknown_fields, rename_all = "camelCase")]
+pub(crate) struct ListPendingLocalProjectResourceEditsInput {
+    pub(crate) project_path: String,
+    pub(crate) expected_project_id: String,
+}
+
+#[derive(Clone, Debug, PartialEq, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub(crate) struct PendingLocalProjectResourceEdit {
+    pub(crate) operation_id: String,
+    pub(crate) edit_kind: LocalProjectResourceEditKind,
+    pub(crate) source_resource_id: String,
+    pub(crate) asset_name: String,
+    pub(crate) phase: String,
+    pub(crate) created_at: u64,
+}
+
+#[derive(Clone, Debug, Deserialize)]
+#[serde(deny_unknown_fields, rename_all = "camelCase")]
+pub(crate) struct ResumeLocalProjectResourceEditInput {
+    pub(crate) project_path: String,
+    pub(crate) expected_project_id: String,
+    pub(crate) operation_id: String,
+}
+
 #[derive(Clone, Debug, Deserialize)]
 #[serde(deny_unknown_fields, rename_all = "camelCase")]
 pub(crate) struct NormalizeLocalProjectRasterResourceInput {
@@ -140,6 +169,19 @@ enum ResourceEditLedgerPhase {
     ReconciliationRequired,
 }
 
+impl ResourceEditLedgerPhase {
+    fn as_str(&self) -> &'static str {
+        match self {
+            Self::Prepared => "prepared",
+            Self::Accepted => "accepted",
+            Self::RemoteCompleted => "remote-completed",
+            Self::MediaDownloaded => "media-downloaded",
+            Self::Committed => "committed",
+            Self::ReconciliationRequired => "reconciliation-required",
+        }
+    }
+}
+
 #[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
 #[serde(deny_unknown_fields, rename_all = "camelCase")]
 struct ResourceEditLedger {
@@ -151,7 +193,17 @@ struct ResourceEditLedger {
     project_id: String,
     expected_project_revision: u64,
     source_resource_id: String,
+    #[serde(default)]
+    source_asset_id: Option<String>,
     source_path: Option<String>,
+    #[serde(default)]
+    source_media_type: Option<String>,
+    #[serde(default)]
+    source_asset_kind: Option<String>,
+    #[serde(default)]
+    producer_task_id: Option<String>,
+    #[serde(default)]
+    source_version_id: Option<String>,
     source_sha256: String,
     prompt: String,
     asset_name: String,
@@ -174,6 +226,30 @@ struct ResourceEditLedger {
     updated_at: u64,
 }
 
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "kebab-case")]
+enum ResourceEditVersionJournalPhase {
+    Prepared,
+    ManifestWritten,
+    RevisionWritten,
+    Committed,
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(deny_unknown_fields, rename_all = "camelCase")]
+struct ResourceEditVersionJournal {
+    schema_version: String,
+    operation_id: String,
+    project_id: String,
+    source_version_id: String,
+    base_project_revision: u64,
+    target_project_revision: u64,
+    version: shared_contracts::game_creation_app::GameIterationVersion,
+    phase: ResourceEditVersionJournalPhase,
+    created_at: u64,
+    updated_at: u64,
+}
+
 #[derive(Debug, Deserialize)]
 #[serde(deny_unknown_fields)]
 struct ResourceEditTextEnvelope {
@@ -197,6 +273,102 @@ fn resource_edit_staging_path(operation_id: &str) -> String {
     format!("{RESOURCE_EDIT_ROOT}/staging/{operation_id}.bin")
 }
 
+fn resource_edit_version_journal_path(operation_id: &str) -> String {
+    format!("{RESOURCE_EDIT_ROOT}/version-transactions/{operation_id}.json")
+}
+
+fn read_resource_edit_version_journal(
+    root: &Path,
+    operation_id: &str,
+) -> Result<Option<ResourceEditVersionJournal>, String> {
+    read_agent_runtime_json_sidecar_with_max_bytes(
+        root,
+        &resource_edit_version_journal_path(operation_id),
+        "资源编辑版本事务日志",
+        RESOURCE_EDIT_LEDGER_MAX_BYTES,
+    )
+}
+
+fn write_resource_edit_version_journal(
+    root: &Path,
+    journal: &ResourceEditVersionJournal,
+) -> Result<(), String> {
+    write_agent_runtime_json_sidecar_with_max_bytes(
+        root,
+        &resource_edit_version_journal_path(&journal.operation_id),
+        "资源编辑版本事务日志",
+        journal,
+        RESOURCE_EDIT_LEDGER_MAX_BYTES,
+    )
+}
+
+fn update_resource_edit_version_journal_phase(
+    root: &Path,
+    journal: &mut ResourceEditVersionJournal,
+    phase: ResourceEditVersionJournalPhase,
+) -> Result<(), String> {
+    journal.phase = phase;
+    journal.updated_at = unix_timestamp();
+    write_resource_edit_version_journal(root, journal)
+}
+
+fn stable_resource_edit_object_key(value: &str) -> Option<String> {
+    let value = value.trim();
+    (!value.is_empty()
+        && !value.starts_with(['/', '\\'])
+        && !value.starts_with("http://")
+        && !value.starts_with("https://")
+        && !value.contains(['?', '#', '\\'])
+        && !value.chars().any(char::is_control)
+        && !value.split('/').any(|segment| segment == ".."))
+    .then(|| value.to_string())
+}
+
+fn committed_resource_edit_object_key_for_asset(
+    root: &Path,
+    asset_id: &str,
+) -> Result<Option<String>, String> {
+    let directory = resolve_local_project_path(root, &format!("{RESOURCE_EDIT_ROOT}/operations"))?;
+    let entries = match fs::read_dir(&directory) {
+        Ok(entries) => entries,
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => return Ok(None),
+        Err(error) => return Err(format!("读取资源编辑账本目录失败：{error}")),
+    };
+    let mut inspected = 0_usize;
+    for entry in entries {
+        let entry = entry.map_err(|error| format!("读取资源编辑账本失败：{error}"))?;
+        let file_type = entry
+            .file_type()
+            .map_err(|error| format!("读取资源编辑账本类型失败：{error}"))?;
+        if !file_type.is_file()
+            || entry.path().extension().and_then(|value| value.to_str()) != Some("json")
+        {
+            continue;
+        }
+        inspected += 1;
+        if inspected > 4_096 {
+            return Err("资源编辑账本数量超过安全扫描上限".to_string());
+        }
+        let entry_path = entry.path();
+        let Some(operation_id) = entry_path.file_stem().and_then(|value| value.to_str()) else {
+            continue;
+        };
+        let Some(ledger) = read_resource_edit_ledger(root, operation_id)? else {
+            continue;
+        };
+        if ledger.schema_version == RESOURCE_EDIT_SCHEMA_VERSION
+            && ledger.phase == ResourceEditLedgerPhase::Committed
+            && ledger.result_asset_id.as_deref() == Some(asset_id)
+        {
+            return Ok(ledger
+                .remote_object_key
+                .as_deref()
+                .and_then(stable_resource_edit_object_key));
+        }
+    }
+    Ok(None)
+}
+
 fn validate_resource_edit_uuid(value: &str, label: &str) -> Result<(), String> {
     let parsed = Uuid::parse_str(value).map_err(|_| format!("{label} 必须是 UUID v4"))?;
     if parsed.get_version_num() != 4 || parsed.hyphenated().to_string() != value {
@@ -263,7 +435,6 @@ fn resource_edit_request_fingerprint(
     let payload = serde_json::to_vec(&serde_json::json!({
         "schemaVersion": RESOURCE_EDIT_SCHEMA_VERSION,
         "projectId": input.expected_project_id,
-        "expectedProjectRevision": input.expected_project_revision,
         "operationId": input.operation_id,
         "editKind": input.edit_kind,
         "sourceResourceId": source.canonical_resource_id,
@@ -276,6 +447,28 @@ fn resource_edit_request_fingerprint(
     Ok(sha256_hex(&payload))
 }
 
+fn legacy_resource_edit_request_fingerprint(
+    input: &DeriveLocalProjectResourceInput,
+    source: &ResourceEditSourceSnapshot,
+    prompt: &str,
+    asset_name: &str,
+) -> Result<String, String> {
+    let payload = serde_json::to_vec(&serde_json::json!({
+        "schemaVersion": RESOURCE_EDIT_SCHEMA_VERSION,
+        "projectId": input.expected_project_id,
+        "expectedProjectRevision": input.expected_project_revision,
+        "operationId": input.operation_id,
+        "editKind": input.edit_kind,
+        "sourceResourceId": source.canonical_resource_id,
+        "sourcePath": source.source_path,
+        "sourceSha256": source.source_sha256,
+        "prompt": prompt,
+        "assetName": asset_name,
+    }))
+    .map_err(|error| format!("序列化旧资源编辑请求失败：{error}"))?;
+    Ok(sha256_hex(&payload))
+}
+
 fn read_resource_edit_ledger(
     root: &Path,
     operation_id: &str,
@@ -377,6 +570,66 @@ fn resource_edit_audio_kind(asset_kind: &str, path: &str) -> LocalProjectResourc
     }
 }
 
+fn infer_resource_edit_source_media_type(
+    edit_kind: &LocalProjectResourceEditKind,
+    source_path: Option<&str>,
+) -> Option<String> {
+    let extension = source_path
+        .and_then(|path| Path::new(path).extension())
+        .and_then(|value| value.to_str())
+        .map(str::to_ascii_lowercase);
+    let media_type = match (edit_kind, extension.as_deref()) {
+        (LocalProjectResourceEditKind::ImageReference, Some("png")) => "image/png",
+        (LocalProjectResourceEditKind::ImageReference, Some("jpg" | "jpeg")) => "image/jpeg",
+        (LocalProjectResourceEditKind::ImageReference, Some("webp")) => "image/webp",
+        (LocalProjectResourceEditKind::Svg, Some("svg")) => "image/svg+xml",
+        (LocalProjectResourceEditKind::Video, Some("mp4")) => "video/mp4",
+        (LocalProjectResourceEditKind::Video, Some("webm")) => "video/webm",
+        (LocalProjectResourceEditKind::Video, Some("mov")) => "video/quicktime",
+        (
+            LocalProjectResourceEditKind::SoundEffect
+            | LocalProjectResourceEditKind::BackgroundMusic,
+            Some("wav"),
+        ) => "audio/wav",
+        (
+            LocalProjectResourceEditKind::SoundEffect
+            | LocalProjectResourceEditKind::BackgroundMusic,
+            Some("mp3"),
+        ) => "audio/mpeg",
+        (
+            LocalProjectResourceEditKind::SoundEffect
+            | LocalProjectResourceEditKind::BackgroundMusic,
+            Some("ogg"),
+        ) => "audio/ogg",
+        (
+            LocalProjectResourceEditKind::SoundEffect
+            | LocalProjectResourceEditKind::BackgroundMusic,
+            Some("flac"),
+        ) => "audio/flac",
+        (
+            LocalProjectResourceEditKind::SoundEffect
+            | LocalProjectResourceEditKind::BackgroundMusic,
+            Some("m4a" | "mp4"),
+        ) => "audio/mp4",
+        _ => return None,
+    };
+    Some(media_type.to_string())
+}
+
+fn infer_resource_edit_source_asset_kind(edit_kind: &LocalProjectResourceEditKind) -> String {
+    match edit_kind {
+        LocalProjectResourceEditKind::ImageReference => "art-image",
+        LocalProjectResourceEditKind::Svg => "svg",
+        LocalProjectResourceEditKind::Video => "video",
+        LocalProjectResourceEditKind::SoundEffect => "sound-effect",
+        LocalProjectResourceEditKind::BackgroundMusic => "background-music",
+        LocalProjectResourceEditKind::Text => "text",
+        LocalProjectResourceEditKind::AgentResult => "agent-result-derivative",
+        LocalProjectResourceEditKind::Version => "project-version",
+    }
+    .to_string()
+}
+
 fn resolve_agent_result_source(
     root: &Path,
     source_resource_id: &str,
@@ -968,6 +1221,11 @@ async fn ensure_resource_edit_source_reference(
         return Ok(reference);
     }
     if let Some(asset) = source.source_asset.as_ref() {
+        if let Some(reference) = committed_resource_edit_object_key_for_asset(root, &asset.id)? {
+            ledger.source_stable_reference = Some(reference.clone());
+            write_resource_edit_ledger(root, ledger)?;
+            return Ok(reference);
+        }
         if let Some(reference) = asset
             .source
             .resource_id
@@ -977,6 +1235,7 @@ async fn ensure_resource_edit_source_reference(
                 !value.is_empty()
                     && !value.starts_with("local-asset:")
                     && !value.starts_with("draft-media:")
+                    && !value.starts_with("task:")
             })
             .map(str::to_string)
             .or_else(|| asset.source.asset_object_id.clone())
@@ -1355,14 +1614,14 @@ async fn prepare_remote_resource_edit(
     let api_key = resolve_canvas_sync_api_key(None)
         .map_err(|_| "External Editor API Key 配置缺失".to_string())?;
     let api_identity_fingerprint =
-        platform_art_generation_external_configuration_fingerprint(&api_base_url, &api_key);
+        platform_art_generation_external_service_fingerprint(&api_base_url);
     if ledger
         .api_identity_fingerprint
         .as_ref()
         .is_some_and(|value| value != &api_identity_fingerprint)
     {
         return Err(
-            "result-unknown: External Editor 配置已变更，必须保留原 operation 对账".to_string(),
+            "result-unknown: External Editor 服务地址已变更，必须保留原 operation 对账".to_string(),
         );
     }
     if ledger
@@ -1615,14 +1874,14 @@ pub(crate) fn normalize_local_project_raster_resource_at(
         .filter(|value| !value.is_empty() && *value != "task-artifact")
         .unwrap_or("art-image");
     let asset = GameCreationAppAssetManifestEntry {
-        id: asset_id,
+        id: asset_id.clone(),
         kind: source_subtype.to_string(),
         media_type: verified_media_type,
         local_path: source_path,
         source: GameCreationAppAssetSource {
             kind: GameCreationAppAssetSourceKind::Generated,
             canvas_project_id: None,
-            resource_id: Some(source_resource_id.to_string()),
+            resource_id: Some(format!("local-asset:{asset_id}")),
             asset_object_id: None,
             task_id: Some(producer_task_id.to_string()),
             prompt: None,
@@ -1679,7 +1938,6 @@ fn commit_resource_edit_asset(
         staged_extension
     );
     let _project_lock = acquire_project_write_lock(root, "resource.edit")?;
-    let current_revision = read_game_creator_agent_runtime_project_revision(root)?;
     let mut manifest = read_existing_manifest_for_project(root)?;
     if manifest.project_id != input.expected_project_id {
         return Err("project-identity-conflict".to_string());
@@ -1695,9 +1953,6 @@ fn commit_resource_edit_asset(
             None,
         );
     }
-    if current_revision.revision != input.expected_project_revision {
-        return Err("project-revision-conflict".to_string());
-    }
     let fresh_source = resolve_resource_edit_source(root, &manifest, input)?;
     if fresh_source.canonical_resource_id != source.canonical_resource_id
         || fresh_source.source_sha256 != source.source_sha256
@@ -1815,15 +2070,16 @@ fn commit_resource_edit_version(
 ) -> Result<DeriveLocalProjectResourceResult, String> {
     let version_id = format!("edit-{}", input.operation_id);
     let _project_lock = acquire_project_write_lock(root, "resource.edit.version")?;
-    let current_revision = read_game_creator_agent_runtime_project_revision(root)?;
     let mut manifest = read_existing_manifest_for_project(root)?;
     if manifest.project_id != input.expected_project_id {
         return Err("project-identity-conflict".to_string());
     }
+    let existing_journal = read_resource_edit_version_journal(root, &input.operation_id)?;
     if let Some(existing) = manifest
         .versions
         .iter()
         .find(|version| version.version_id == version_id)
+        .filter(|_| existing_journal.is_none())
     {
         ledger.result_version_id = Some(existing.version_id.clone());
         update_resource_edit_phase(root, ledger, ResourceEditLedgerPhase::Committed)?;
@@ -1835,8 +2091,11 @@ fn commit_resource_edit_version(
             Some(&existing.version_id),
         );
     }
-    if current_revision.revision != input.expected_project_revision {
-        return Err("project-revision-conflict".to_string());
+    let fresh_source = resolve_resource_edit_source(root, &manifest, input)?;
+    if fresh_source.canonical_resource_id != source.canonical_resource_id
+        || fresh_source.source_sha256 != source.source_sha256
+    {
+        return Err("source-resource-conflict".to_string());
     }
     let source_version = manifest
         .versions
@@ -1849,47 +2108,257 @@ fn commit_resource_edit_version(
         })
         .cloned()
         .ok_or_else(|| "源项目版本不存在".to_string())?;
-    let target_revision = current_revision
-        .revision
-        .checked_add(1)
-        .ok_or_else(|| "项目 revision 已达到上限".to_string())?;
-    let version = shared_contracts::game_creation_app::GameIterationVersion {
-        version_id: version_id.clone(),
-        parent_version_id: Some(source_version.version_id),
-        project_revision: target_revision,
-        resource_bindings: source_version.resource_bindings,
-        created_reason:
-            shared_contracts::game_creation_app::GameIterationVersionCreatedReason::AgentRevision,
-        created_at: unix_timestamp(),
-        edit_prompt: Some(prompt.to_string()),
-    };
-    manifest.versions.push(version.clone());
-    let mut target_revision_state = current_revision.clone();
-    target_revision_state.revision = target_revision;
-    target_revision_state.updated_at = unix_timestamp();
-    write_game_creator_agent_runtime_project_revision(root, &target_revision_state)?;
-    if let Err(error) = write_manifest(&root.join(".agent/manifest.json"), &manifest) {
-        let rollback = write_game_creator_agent_runtime_project_revision(root, &current_revision);
-        return Err(match rollback {
-            Ok(()) => error,
-            Err(rollback_error) => {
-                format!("{error}；回滚项目 revision 失败，需要对账：{rollback_error}")
+    let mut journal = match existing_journal {
+        Some(journal) => {
+            if journal.schema_version != RESOURCE_EDIT_VERSION_JOURNAL_SCHEMA_VERSION
+                || journal.operation_id != input.operation_id
+                || journal.project_id != input.expected_project_id
+                || journal.source_version_id != source_version.version_id
+                || journal.version.version_id != version_id
+                || journal.version.parent_version_id.as_deref()
+                    != Some(source_version.version_id.as_str())
+                || journal.version.edit_prompt.as_deref() != Some(prompt)
+            {
+                return Err("reconciliation-required: 资源编辑版本事务日志身份不一致".to_string());
             }
-        });
+            journal
+        }
+        None => {
+            let current_revision = read_game_creator_agent_runtime_project_revision(root)?;
+            let target_revision = current_revision
+                .revision
+                .checked_add(1)
+                .ok_or_else(|| "项目 revision 已达到上限".to_string())?;
+            let now = unix_timestamp();
+            let journal = ResourceEditVersionJournal {
+                schema_version: RESOURCE_EDIT_VERSION_JOURNAL_SCHEMA_VERSION.to_string(),
+                operation_id: input.operation_id.clone(),
+                project_id: input.expected_project_id.clone(),
+                source_version_id: source_version.version_id.clone(),
+                base_project_revision: current_revision.revision,
+                target_project_revision: target_revision,
+                version: shared_contracts::game_creation_app::GameIterationVersion {
+                    version_id: version_id.clone(),
+                    parent_version_id: Some(source_version.version_id.clone()),
+                    project_revision: target_revision,
+                    resource_bindings: source_version.resource_bindings.clone(),
+                    created_reason: shared_contracts::game_creation_app::GameIterationVersionCreatedReason::AgentRevision,
+                    created_at: now,
+                    edit_prompt: Some(prompt.to_string()),
+                },
+                phase: ResourceEditVersionJournalPhase::Prepared,
+                created_at: now,
+                updated_at: now,
+            };
+            write_resource_edit_version_journal(root, &journal)?;
+            journal
+        }
+    };
+
+    let matching_versions = manifest
+        .versions
+        .iter()
+        .filter(|version| version.version_id == version_id)
+        .collect::<Vec<_>>();
+    if matching_versions.len() > 1
+        || matching_versions
+            .first()
+            .is_some_and(|version| **version != journal.version)
+    {
+        return Err("reconciliation-required: 派生子版本出现重复或内容冲突".to_string());
     }
+    if matching_versions.is_empty() {
+        let current_revision = read_game_creator_agent_runtime_project_revision(root)?;
+        if current_revision.revision != journal.base_project_revision {
+            return Err("reconciliation-required: 子版本写入前项目 revision 已偏移".to_string());
+        }
+        manifest.versions.push(journal.version.clone());
+        write_manifest(&root.join(".agent/manifest.json"), &manifest)?;
+        update_resource_edit_version_journal_phase(
+            root,
+            &mut journal,
+            ResourceEditVersionJournalPhase::ManifestWritten,
+        )?;
+    }
+
+    let mut current_revision = read_game_creator_agent_runtime_project_revision(root)?;
+    if current_revision.revision == journal.base_project_revision {
+        current_revision.revision = journal.target_project_revision;
+        current_revision.updated_at = unix_timestamp();
+        write_game_creator_agent_runtime_project_revision(root, &current_revision)?;
+        update_resource_edit_version_journal_phase(
+            root,
+            &mut journal,
+            ResourceEditVersionJournalPhase::RevisionWritten,
+        )?;
+    } else if current_revision.revision < journal.target_project_revision {
+        return Err("reconciliation-required: 子版本事务 revision 状态无效".to_string());
+    }
+    update_resource_edit_version_journal_phase(
+        root,
+        &mut journal,
+        ResourceEditVersionJournalPhase::Committed,
+    )?;
+    let version = journal.version.clone();
     ledger.result_version_id = Some(version.version_id.clone());
     update_resource_edit_phase(root, ledger, ResourceEditLedgerPhase::Committed)?;
     Ok(DeriveLocalProjectResourceResult {
         operation_id: input.operation_id.clone(),
         edit_kind: input.edit_kind.clone(),
         source_resource_id: source.canonical_resource_id.clone(),
-        committed_project_revision: target_revision,
+        committed_project_revision: current_revision.revision,
         asset: None,
         version: Some(version),
         manifest,
     })
 }
 
+pub(crate) fn list_pending_local_project_resource_edits_at(
+    input: ListPendingLocalProjectResourceEditsInput,
+) -> Result<Vec<PendingLocalProjectResourceEdit>, String> {
+    let root = Path::new(input.project_path.trim());
+    validate_project_root(root)?;
+    let manifest = read_existing_manifest_for_project(root)?;
+    if manifest.project_id != input.expected_project_id {
+        return Err("project-identity-conflict".to_string());
+    }
+    let directory = resolve_local_project_path(root, &format!("{RESOURCE_EDIT_ROOT}/operations"))?;
+    let entries = match fs::read_dir(&directory) {
+        Ok(entries) => entries,
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => return Ok(Vec::new()),
+        Err(error) => return Err(format!("读取资源编辑账本目录失败：{error}")),
+    };
+    let mut pending = Vec::new();
+    let mut scanned_entries = 0_usize;
+    for entry in entries {
+        let entry = entry.map_err(|error| format!("读取资源编辑账本失败：{error}"))?;
+        scanned_entries += 1;
+        if scanned_entries > RESOURCE_EDIT_LEDGER_SCAN_MAX_ENTRIES {
+            return Err("资源编辑账本数量超过安全扫描上限".to_string());
+        }
+        if !entry
+            .file_type()
+            .map_err(|error| format!("读取资源编辑账本类型失败：{error}"))?
+            .is_file()
+            || entry.path().extension().and_then(|value| value.to_str()) != Some("json")
+        {
+            continue;
+        }
+        let entry_path = entry.path();
+        let operation_id = entry_path
+            .file_stem()
+            .and_then(|value| value.to_str())
+            .ok_or_else(|| "资源编辑账本文件名无效".to_string())?;
+        let ledger = read_resource_edit_ledger(root, operation_id)?
+            .ok_or_else(|| "资源编辑账本扫描结果不一致".to_string())?;
+        if ledger.schema_version != RESOURCE_EDIT_SCHEMA_VERSION
+            || ledger.operation_id != operation_id
+            || ledger.project_id != input.expected_project_id
+        {
+            return Err("资源编辑账本身份无效".to_string());
+        }
+        if ledger.phase != ResourceEditLedgerPhase::Committed {
+            pending.push(PendingLocalProjectResourceEdit {
+                operation_id: ledger.operation_id,
+                edit_kind: ledger.edit_kind,
+                source_resource_id: ledger.source_resource_id,
+                asset_name: ledger.asset_name,
+                phase: ledger.phase.as_str().to_string(),
+                created_at: ledger.created_at,
+            });
+        }
+    }
+    pending.sort_by_key(|edit| (edit.created_at, edit.operation_id.clone()));
+    Ok(pending)
+}
+
+pub(crate) async fn resume_local_project_resource_edit_at(
+    input: ResumeLocalProjectResourceEditInput,
+) -> Result<DeriveLocalProjectResourceResult, String> {
+    validate_resource_edit_uuid(&input.operation_id, "operationId")?;
+    let root = Path::new(input.project_path.trim());
+    validate_project_root(root)?;
+    let manifest = read_existing_manifest_for_project(root)?;
+    if manifest.project_id != input.expected_project_id {
+        return Err("project-identity-conflict".to_string());
+    }
+    let ledger = read_resource_edit_ledger(root, &input.operation_id)?
+        .ok_or_else(|| "待恢复的资源编辑账本不存在".to_string())?;
+    if ledger.schema_version != RESOURCE_EDIT_SCHEMA_VERSION
+        || ledger.project_id != input.expected_project_id
+        || ledger.operation_id != input.operation_id
+    {
+        return Err("待恢复的资源编辑账本身份无效".to_string());
+    }
+    let source_asset = ledger
+        .source_asset_id
+        .as_deref()
+        .and_then(|asset_id| manifest.assets.iter().find(|asset| asset.id == asset_id))
+        .or_else(|| {
+            manifest.assets.iter().find(|asset| {
+                source_asset_canonical_resource_id(asset) == ledger.source_resource_id
+                    || ledger.source_path.as_deref() == Some(asset.local_path.as_str())
+            })
+        })
+        .cloned();
+    let producer_task_id = ledger.producer_task_id.clone().or_else(|| {
+        source_asset
+            .as_ref()
+            .and_then(|asset| asset.source.task_id.clone())
+            .or_else(|| {
+                ledger.source_path.as_deref().and_then(|path| {
+                    manifest
+                        .tasks
+                        .iter()
+                        .find(|task| task.artifacts.iter().any(|artifact| artifact == path))
+                        .map(|task| task.id.clone())
+                })
+            })
+    });
+    let source_version_id = ledger.source_version_id.clone().or_else(|| {
+        (ledger.edit_kind == LocalProjectResourceEditKind::Version)
+            .then(|| {
+                ledger
+                    .source_resource_id
+                    .strip_prefix("version:")
+                    .map(str::to_string)
+            })
+            .flatten()
+    });
+    let source_media_type = ledger
+        .source_media_type
+        .clone()
+        .or_else(|| source_asset.as_ref().map(|asset| asset.media_type.clone()))
+        .or_else(|| {
+            infer_resource_edit_source_media_type(&ledger.edit_kind, ledger.source_path.as_deref())
+        });
+    let source_subtype = ledger
+        .source_asset_kind
+        .clone()
+        .or_else(|| source_asset.as_ref().map(|asset| asset.kind.clone()))
+        .or_else(|| Some(infer_resource_edit_source_asset_kind(&ledger.edit_kind)));
+    derive_local_project_resource_at(DeriveLocalProjectResourceInput {
+        project_path: input.project_path,
+        expected_project_id: input.expected_project_id,
+        expected_project_revision: ledger.expected_project_revision,
+        operation_id: ledger.operation_id,
+        idempotency_key: ledger.idempotency_key,
+        edit_kind: ledger.edit_kind,
+        source_resource_id: ledger.source_resource_id,
+        source_asset_id: ledger
+            .source_asset_id
+            .or_else(|| source_asset.as_ref().map(|asset| asset.id.clone())),
+        source_path: ledger.source_path,
+        source_media_type,
+        source_subtype,
+        producer_task_id,
+        source_version_id,
+        prompt: ledger.prompt,
+        asset_name: ledger.asset_name,
+    })
+    .await
+}
+
 pub(crate) async fn derive_local_project_resource_at(
     input: DeriveLocalProjectResourceInput,
 ) -> Result<DeriveLocalProjectResourceResult, String> {
@@ -1913,11 +2382,22 @@ pub(crate) async fn derive_local_project_resource_at(
     let source = resolve_resource_edit_source(root, &manifest, &input)?;
     let request_fingerprint =
         resource_edit_request_fingerprint(&input, &source, &prompt, &asset_name)?;
+    let legacy_request_fingerprint =
+        legacy_resource_edit_request_fingerprint(&input, &source, &prompt, &asset_name)?;
     let now = unix_timestamp();
-    let mut ledger = match read_resource_edit_ledger(root, &input.operation_id)? {
+    let existing_ledger = read_resource_edit_ledger(root, &input.operation_id)?;
+    if existing_ledger.is_none()
+        && read_game_creator_agent_runtime_project_revision(root)?.revision
+            != input.expected_project_revision
+    {
+        return Err("project-revision-conflict".to_string());
+    }
+    let mut ledger = match existing_ledger {
         Some(ledger) => {
-            if ledger.request_fingerprint != request_fingerprint
-                || ledger.idempotency_key != input.idempotency_key
+            if !matches!(
+                ledger.request_fingerprint.as_str(),
+                value if value == request_fingerprint || value == legacy_request_fingerprint
+            ) || ledger.idempotency_key != input.idempotency_key
                 || ledger.project_id != input.expected_project_id
             {
                 return Err("operationId 或幂等键已绑定到不同资源编辑请求".to_string());
@@ -1934,7 +2414,22 @@ pub(crate) async fn derive_local_project_resource_at(
                 project_id: input.expected_project_id.clone(),
                 expected_project_revision: input.expected_project_revision,
                 source_resource_id: source.canonical_resource_id.clone(),
+                source_asset_id: source.source_asset.as_ref().map(|asset| asset.id.clone()),
                 source_path: source.source_path.clone(),
+                source_media_type: Some(source.media_type.clone()),
+                source_asset_kind: Some(source.asset_kind.clone()),
+                producer_task_id: input.producer_task_id.clone().or_else(|| {
+                    source
+                        .source_asset
+                        .as_ref()
+                        .and_then(|asset| asset.source.task_id.clone())
+                }),
+                source_version_id: input.source_version_id.clone().or_else(|| {
+                    source
+                        .source_version
+                        .as_ref()
+                        .map(|version| version.version_id.clone())
+                }),
                 source_sha256: source.source_sha256.clone(),
                 prompt: prompt.clone(),
                 asset_name: asset_name.clone(),
@@ -2113,7 +2608,22 @@ mod tests {
             project_id: input.expected_project_id.clone(),
             expected_project_revision: input.expected_project_revision,
             source_resource_id: source.canonical_resource_id.clone(),
+            source_asset_id: source.source_asset.as_ref().map(|asset| asset.id.clone()),
             source_path: source.source_path.clone(),
+            source_media_type: Some(source.media_type.clone()),
+            source_asset_kind: Some(source.asset_kind.clone()),
+            producer_task_id: input.producer_task_id.clone().or_else(|| {
+                source
+                    .source_asset
+                    .as_ref()
+                    .and_then(|asset| asset.source.task_id.clone())
+            }),
+            source_version_id: input.source_version_id.clone().or_else(|| {
+                source
+                    .source_version
+                    .as_ref()
+                    .map(|version| version.version_id.clone())
+            }),
             source_sha256: source.source_sha256.clone(),
             prompt: input.prompt.clone(),
             asset_name: input.asset_name.clone(),
@@ -2211,6 +2721,141 @@ mod tests {
         assert!(error.contains("内容冲突"));
     }
 
+    #[tokio::test]
+    async fn derived_video_reuses_committed_object_key_instead_of_asset_object_id() {
+        let directory = tempfile::tempdir().expect("create committed video fixture");
+        let root = directory.path();
+        init_local_game_project_at(root, PROJECT_ID, "派生视频二次编辑测试")
+            .expect("initialize project");
+        let source_bytes = b"\0\0\0\x18ftypisom\0\0\0\0isomiso2";
+        let uploaded = upload_local_asset_at(root, "derived-video.mp4", "video/mp4", source_bytes)
+            .expect("register derived video");
+        let manifest = read_existing_manifest_for_project(root).expect("read manifest");
+        let source_asset = manifest
+            .assets
+            .iter()
+            .find(|asset| asset.id == uploaded.id)
+            .cloned()
+            .expect("source asset");
+        let mut prior_input = input(
+            root,
+            Uuid::new_v4().to_string(),
+            LocalProjectResourceEditKind::Video,
+            format!("asset:{}", source_asset.id),
+        );
+        prior_input.source_asset_id = Some(source_asset.id.clone());
+        prior_input.source_path = Some(source_asset.local_path.clone());
+        prior_input.source_media_type = Some(source_asset.media_type.clone());
+        let source =
+            resolve_resource_edit_source(root, &manifest, &prior_input).expect("resolve source");
+        let mut committed = ledger_for(&prior_input, &source, ResourceEditLedgerPhase::Committed);
+        committed.result_asset_id = Some(source_asset.id.clone());
+        committed.remote_object_key = Some("generated/stable-video.mp4".to_string());
+        committed.remote_asset_object_id = Some("asset-object-must-not-be-used".to_string());
+        write_resource_edit_ledger(root, &committed).expect("write committed ledger");
+
+        let mut current_input = prior_input.clone();
+        current_input.operation_id = Uuid::new_v4().to_string();
+        current_input.idempotency_key = Uuid::new_v4().to_string();
+        let mut current = ledger_for(&current_input, &source, ResourceEditLedgerPhase::Prepared);
+        let reference = ensure_resource_edit_source_reference(
+            root,
+            &reqwest::Client::new(),
+            "http://127.0.0.1:9",
+            "unused-key",
+            &current_input,
+            &source,
+            &mut current,
+        )
+        .await
+        .expect("reuse committed object key without upload");
+
+        assert_eq!(reference, "generated/stable-video.mp4");
+        assert_ne!(reference, "asset-object-must-not-be-used");
+        assert_eq!(
+            current.source_stable_reference.as_deref(),
+            Some(reference.as_str())
+        );
+    }
+
+    #[tokio::test]
+    async fn authentication_and_missing_status_keep_the_original_operation_ledger() {
+        let directory = tempfile::tempdir().expect("create operation preservation fixture");
+        let root = directory.path();
+        init_local_game_project_at(root, PROJECT_ID, "远端错误保留 operation 测试")
+            .expect("initialize project");
+        let request = input(
+            root,
+            Uuid::new_v4().to_string(),
+            LocalProjectResourceEditKind::Video,
+            "local-asset:video-one".to_string(),
+        );
+        let source = ResourceEditSourceSnapshot {
+            canonical_resource_id: request.source_resource_id.clone(),
+            source_path: Some("assets/video-one.mp4".to_string()),
+            media_type: "video/mp4".to_string(),
+            asset_kind: "video".to_string(),
+            source_sha256: "a".repeat(64),
+            bytes: Some(b"\0\0\0\x18ftypisom".to_vec()),
+            text: None,
+            source_asset: None,
+            source_version: None,
+        };
+        let mut ledger = ledger_for(&request, &source, ResourceEditLedgerPhase::Prepared);
+        ledger.endpoint = Some("/api/external/v1/editor/videos/generations".to_string());
+        ledger.request_body_json = Some("{}".to_string());
+        write_resource_edit_ledger(root, &ledger).expect("write original ledger");
+        let client = reqwest::Client::new();
+
+        for status in ["401 Unauthorized", "403 Forbidden"] {
+            let listener = TcpListener::bind("127.0.0.1:0").expect("bind auth fixture");
+            let base_url = format!("http://{}", listener.local_addr().expect("auth address"));
+            let server = std::thread::spawn(move || {
+                let (mut stream, _) = listener.accept().expect("accept auth request");
+                let _ = read_http_request(&mut stream);
+                write_json(&mut stream, status, serde_json::json!({"error": "denied"}));
+            });
+            let error = submit_resource_edit_remote(&client, &base_url, "rotated-key", &ledger)
+                .await
+                .expect_err("authentication status must fail");
+            server.join().expect("join auth fixture");
+            assert!(error.contains("authentication-required"));
+        }
+
+        let listener = TcpListener::bind("127.0.0.1:0").expect("bind missing status fixture");
+        let base_url = format!(
+            "http://{}",
+            listener.local_addr().expect("missing status address")
+        );
+        let server = std::thread::spawn(move || {
+            let (mut stream, _) = listener.accept().expect("accept status request");
+            let _ = read_http_request(&mut stream);
+            write_json(
+                &mut stream,
+                "404 Not Found",
+                serde_json::json!({"error": "missing"}),
+            );
+        });
+        let error = wait_for_resource_edit_remote(&client, &base_url, "rotated-key", "remote-one")
+            .await
+            .expect_err("missing remote status must stay unknown");
+        server.join().expect("join missing status fixture");
+        assert!(error.contains("result-unknown"));
+
+        let operations = fs::read_dir(root.join(format!("{RESOURCE_EDIT_ROOT}/operations")))
+            .expect("read operations")
+            .collect::<Result<Vec<_>, _>>()
+            .expect("collect operations");
+        assert_eq!(operations.len(), 1);
+        assert_eq!(
+            read_resource_edit_ledger(root, &request.operation_id)
+                .expect("read ledger")
+                .expect("original ledger")
+                .operation_id,
+            request.operation_id
+        );
+    }
+
     #[test]
     fn remote_requests_keep_resource_editor_queue_identity_and_endpoint_limits() {
         let directory = tempfile::tempdir().expect("create resource editor fixture");
@@ -2551,8 +3196,14 @@ mod tests {
         );
         assert_eq!(
             first.asset.source.resource_id.as_deref(),
-            Some(request.source_resource_id.as_str())
+            Some(format!("local-asset:{}", first.asset.id).as_str())
         );
+        assert!(!first
+            .asset
+            .source
+            .resource_id
+            .as_deref()
+            .is_some_and(|resource_id| resource_id.starts_with("task:")));
         assert_eq!(
             fs::read(root.join("assets/task-hero.png")).expect("read source PNG"),
             [0x89, b'P', b'N', b'G', 0x0d, 0x0a, 0x1a, 0x0a, 0x00]
@@ -2612,6 +3263,8 @@ mod tests {
             b"# Original rules\n\nRed hair\n",
         )
         .expect("stage derivative");
+        advance_agent_runtime_project_revision_locked(root)
+            .expect("simulate unrelated project mutation during remote edit");
 
         let result = commit_resource_edit_asset(
             root,
@@ -2622,6 +3275,7 @@ mod tests {
             &mut ledger,
         )
         .expect("commit derivative");
+        assert_eq!(result.committed_project_revision, 2);
         let derivative = result.asset.expect("derivative asset");
         assert_ne!(derivative.id, source_asset.id);
         assert_ne!(derivative.local_path, source_asset.local_path);
@@ -2641,6 +3295,60 @@ mod tests {
         );
     }
 
+    #[test]
+    fn asset_commit_rejects_source_content_change_after_remote_generation() {
+        let directory = tempfile::tempdir().expect("create source conflict fixture");
+        let root = directory.path();
+        init_local_game_project_at(root, PROJECT_ID, "源资源冲突测试").expect("initialize project");
+        let uploaded = upload_local_asset_at(root, "rules.md", "text/markdown", b"original\n")
+            .expect("upload source");
+        let manifest = read_existing_manifest_for_project(root).expect("read manifest");
+        let source_asset = manifest
+            .assets
+            .iter()
+            .find(|asset| asset.id == uploaded.id)
+            .cloned()
+            .expect("source asset");
+        let mut request = input(
+            root,
+            Uuid::new_v4().to_string(),
+            LocalProjectResourceEditKind::Text,
+            format!("asset:{}", source_asset.id),
+        );
+        request.source_asset_id = Some(source_asset.id.clone());
+        request.source_path = Some(source_asset.local_path.clone());
+        request.source_media_type = Some(source_asset.media_type.clone());
+        let source = resolve_resource_edit_source(root, &manifest, &request).expect("source");
+        let mut ledger = ledger_for(&request, &source, ResourceEditLedgerPhase::MediaDownloaded);
+        ledger.staged_media_type = Some("text/markdown".to_string());
+        ledger.staged_extension = Some("md".to_string());
+        write_resource_edit_staging(root, &request.operation_id, b"derivative\n")
+            .expect("stage derivative");
+        fs::write(
+            root.join(&source_asset.local_path),
+            b"changed while generating\n",
+        )
+        .expect("mutate source");
+
+        let error = commit_resource_edit_asset(
+            root,
+            &request,
+            &source,
+            &request.prompt,
+            &request.asset_name,
+            &mut ledger,
+        )
+        .expect_err("changed source must fail closed");
+        assert_eq!(error, "source-resource-conflict");
+        assert_eq!(
+            read_existing_manifest_for_project(root)
+                .expect("read unchanged manifest")
+                .assets
+                .len(),
+            1
+        );
+    }
+
     #[test]
     fn version_commit_appends_child_without_mutating_parent() {
         let directory = tempfile::tempdir().expect("create resource editor fixture");
@@ -2680,4 +3388,302 @@ mod tests {
         assert_eq!(result.manifest.versions[0], parent);
         assert_eq!(result.manifest.versions.len(), 2);
     }
+
+    #[test]
+    fn version_commit_recovers_manifest_written_crash_without_duplicate_child() {
+        let directory = tempfile::tempdir().expect("create version journal fixture");
+        let root = directory.path();
+        init_local_game_project_at(root, PROJECT_ID, "版本事务恢复测试")
+            .expect("initialize project");
+        let mut manifest = read_existing_manifest_for_project(root).expect("read manifest");
+        let parent = shared_contracts::game_creation_app::GameIterationVersion {
+            version_id: "version-parent".to_string(),
+            parent_version_id: None,
+            project_revision: 0,
+            resource_bindings: Vec::new(),
+            created_reason:
+                shared_contracts::game_creation_app::GameIterationVersionCreatedReason::Initial,
+            created_at: 1,
+            edit_prompt: None,
+        };
+        manifest.versions.push(parent.clone());
+        write_manifest(&root.join(".agent/manifest.json"), &manifest).expect("write parent");
+        let mut request = input(
+            root,
+            Uuid::new_v4().to_string(),
+            LocalProjectResourceEditKind::Version,
+            "version:version-parent".to_string(),
+        );
+        request.source_version_id = Some(parent.version_id.clone());
+        let source = resolve_resource_edit_source(root, &manifest, &request).expect("source");
+        let mut ledger = ledger_for(&request, &source, ResourceEditLedgerPhase::Prepared);
+        let child = shared_contracts::game_creation_app::GameIterationVersion {
+            version_id: format!("edit-{}", request.operation_id),
+            parent_version_id: Some(parent.version_id.clone()),
+            project_revision: 1,
+            resource_bindings: Vec::new(),
+            created_reason:
+                shared_contracts::game_creation_app::GameIterationVersionCreatedReason::AgentRevision,
+            created_at: 2,
+            edit_prompt: Some(request.prompt.clone()),
+        };
+        write_resource_edit_version_journal(
+            root,
+            &ResourceEditVersionJournal {
+                schema_version: RESOURCE_EDIT_VERSION_JOURNAL_SCHEMA_VERSION.to_string(),
+                operation_id: request.operation_id.clone(),
+                project_id: PROJECT_ID.to_string(),
+                source_version_id: parent.version_id.clone(),
+                base_project_revision: 0,
+                target_project_revision: 1,
+                version: child.clone(),
+                phase: ResourceEditVersionJournalPhase::Prepared,
+                created_at: 2,
+                updated_at: 2,
+            },
+        )
+        .expect("prepare journal");
+        manifest.versions.push(child);
+        write_manifest(&root.join(".agent/manifest.json"), &manifest)
+            .expect("simulate manifest-written crash");
+
+        let result =
+            commit_resource_edit_version(root, &request, &source, &request.prompt, &mut ledger)
+                .expect("recover version transaction");
+        assert_eq!(result.committed_project_revision, 1);
+        assert_eq!(result.manifest.versions.len(), 2);
+        assert_eq!(
+            read_resource_edit_version_journal(root, &request.operation_id)
+                .expect("read journal")
+                .expect("journal")
+                .phase,
+            ResourceEditVersionJournalPhase::Committed
+        );
+
+        let replay =
+            commit_resource_edit_version(root, &request, &source, &request.prompt, &mut ledger)
+                .expect("replay committed journal");
+        assert_eq!(replay.committed_project_revision, 1);
+        assert_eq!(replay.manifest.versions.len(), 2);
+    }
+
+    #[tokio::test]
+    async fn pending_task_video_and_version_resume_from_persisted_source_snapshots() {
+        let task_directory = tempfile::tempdir().expect("create task video fixture");
+        let task_root = task_directory.path();
+        init_local_game_project_at(task_root, PROJECT_ID, "任务视频恢复测试")
+            .expect("initialize task project");
+        fs::create_dir_all(task_root.join("assets")).expect("create task assets");
+        let source_video = b"\0\0\0\x18ftypisom\0\0\0\0isomiso2";
+        fs::write(task_root.join("assets/task-video.mp4"), source_video).expect("write task video");
+        let mut task_manifest =
+            read_existing_manifest_for_project(task_root).expect("read task manifest");
+        let task = task_manifest.tasks.first_mut().expect("seed task");
+        task.status = GameCreationAppTaskStatus::Completed;
+        task.artifacts = vec!["assets/task-video.mp4".to_string()];
+        let task_id = task.id.clone();
+        write_manifest(&task_root.join(".agent/manifest.json"), &task_manifest)
+            .expect("write completed task");
+        let mut task_request = input(
+            task_root,
+            Uuid::new_v4().to_string(),
+            LocalProjectResourceEditKind::Video,
+            format!("task:{task_id}:assets/task-video.mp4"),
+        );
+        task_request.source_path = Some("assets/task-video.mp4".to_string());
+        task_request.source_media_type = Some("video/mp4".to_string());
+        task_request.source_subtype = Some("video".to_string());
+        task_request.producer_task_id = Some(task_id.clone());
+        let task_source = resolve_resource_edit_source(task_root, &task_manifest, &task_request)
+            .expect("resolve task video");
+        let mut task_ledger = ledger_for(
+            &task_request,
+            &task_source,
+            ResourceEditLedgerPhase::MediaDownloaded,
+        );
+        task_ledger.request_fingerprint = resource_edit_request_fingerprint(
+            &task_request,
+            &task_source,
+            &task_request.prompt,
+            &task_request.asset_name,
+        )
+        .expect("task fingerprint");
+        task_ledger.staged_media_type = Some("video/mp4".to_string());
+        task_ledger.staged_extension = Some("mp4".to_string());
+        write_resource_edit_ledger(task_root, &task_ledger).expect("write task ledger");
+        write_resource_edit_staging(task_root, &task_request.operation_id, source_video)
+            .expect("stage task derivative");
+
+        let task_result =
+            resume_local_project_resource_edit_at(ResumeLocalProjectResourceEditInput {
+                project_path: task_root.to_string_lossy().into_owned(),
+                expected_project_id: PROJECT_ID.to_string(),
+                operation_id: task_request.operation_id.clone(),
+            })
+            .await
+            .expect("resume task video");
+        let task_derivative = task_result.asset.expect("task derivative");
+        assert_eq!(task_derivative.media_type, "video/mp4");
+        assert_eq!(
+            task_derivative.source.task_id.as_deref(),
+            Some(task_id.as_str())
+        );
+
+        let version_directory = tempfile::tempdir().expect("create version fixture");
+        let version_root = version_directory.path();
+        init_local_game_project_at(version_root, PROJECT_ID, "版本恢复测试")
+            .expect("initialize version project");
+        let mut version_manifest =
+            read_existing_manifest_for_project(version_root).expect("read version manifest");
+        let parent = shared_contracts::game_creation_app::GameIterationVersion {
+            version_id: "version-resume-parent".to_string(),
+            parent_version_id: None,
+            project_revision: 0,
+            resource_bindings: Vec::new(),
+            created_reason:
+                shared_contracts::game_creation_app::GameIterationVersionCreatedReason::Initial,
+            created_at: 1,
+            edit_prompt: None,
+        };
+        version_manifest.versions.push(parent.clone());
+        write_manifest(
+            &version_root.join(".agent/manifest.json"),
+            &version_manifest,
+        )
+        .expect("write version parent");
+        let mut version_request = input(
+            version_root,
+            Uuid::new_v4().to_string(),
+            LocalProjectResourceEditKind::Version,
+            format!("version:{}", parent.version_id),
+        );
+        version_request.source_version_id = Some(parent.version_id.clone());
+        let version_source =
+            resolve_resource_edit_source(version_root, &version_manifest, &version_request)
+                .expect("resolve version source");
+        let mut version_ledger = ledger_for(
+            &version_request,
+            &version_source,
+            ResourceEditLedgerPhase::Prepared,
+        );
+        version_ledger.request_fingerprint = resource_edit_request_fingerprint(
+            &version_request,
+            &version_source,
+            &version_request.prompt,
+            &version_request.asset_name,
+        )
+        .expect("version fingerprint");
+        write_resource_edit_ledger(version_root, &version_ledger).expect("write version ledger");
+
+        let version_result =
+            resume_local_project_resource_edit_at(ResumeLocalProjectResourceEditInput {
+                project_path: version_root.to_string_lossy().into_owned(),
+                expected_project_id: PROJECT_ID.to_string(),
+                operation_id: version_request.operation_id,
+            })
+            .await
+            .expect("resume version");
+        assert_eq!(
+            version_result
+                .version
+                .expect("derived version")
+                .parent_version_id
+                .as_deref(),
+            Some(parent.version_id.as_str())
+        );
+    }
+
+    #[test]
+    fn pending_scan_caps_all_directory_entries_not_only_pending_json_ledgers() {
+        let directory = tempfile::tempdir().expect("create scan cap fixture");
+        let root = directory.path();
+        init_local_game_project_at(root, PROJECT_ID, "账本扫描上限测试")
+            .expect("initialize project");
+        let operations = root.join(format!("{RESOURCE_EDIT_ROOT}/operations"));
+        fs::create_dir_all(&operations).expect("create operations directory");
+        for index in 0..=RESOURCE_EDIT_LEDGER_SCAN_MAX_ENTRIES {
+            fs::write(operations.join(format!("ignored-{index}.txt")), b"ignored")
+                .expect("write ignored entry");
+        }
+
+        let error = list_pending_local_project_resource_edits_at(
+            ListPendingLocalProjectResourceEditsInput {
+                project_path: root.to_string_lossy().into_owned(),
+                expected_project_id: PROJECT_ID.to_string(),
+            },
+        )
+        .expect_err("all scanned entries must count toward the cap");
+        assert!(error.contains("安全扫描上限"));
+    }
+
+    #[tokio::test]
+    async fn pending_resource_edit_is_listed_and_resumed_from_ledger_only() {
+        let directory = tempfile::tempdir().expect("create pending edit fixture");
+        let root = directory.path();
+        init_local_game_project_at(root, PROJECT_ID, "资源编辑恢复测试")
+            .expect("initialize project");
+        let uploaded =
+            upload_local_asset_at(root, "rules.md", "text/markdown", b"# Original rules\n")
+                .expect("upload source");
+        let manifest = read_existing_manifest_for_project(root).expect("read manifest");
+        let source_asset = manifest
+            .assets
+            .iter()
+            .find(|asset| asset.id == uploaded.id)
+            .expect("source asset");
+        let mut request = input(
+            root,
+            Uuid::new_v4().to_string(),
+            LocalProjectResourceEditKind::Text,
+            format!("asset:{}", source_asset.id),
+        );
+        request.source_asset_id = Some(source_asset.id.clone());
+        request.source_path = Some(source_asset.local_path.clone());
+        request.source_media_type = Some(source_asset.media_type.clone());
+        let source = resolve_resource_edit_source(root, &manifest, &request).expect("source");
+        let mut ledger = ledger_for(&request, &source, ResourceEditLedgerPhase::MediaDownloaded);
+        ledger.request_fingerprint = resource_edit_request_fingerprint(
+            &request,
+            &source,
+            &request.prompt,
+            &request.asset_name,
+        )
+        .expect("fingerprint");
+        ledger.staged_media_type = Some("text/markdown".to_string());
+        ledger.staged_extension = Some("md".to_string());
+        write_resource_edit_ledger(root, &ledger).expect("write ledger");
+        write_resource_edit_staging(
+            root,
+            &request.operation_id,
+            b"# Original rules\n\nRecovered edit\n",
+        )
+        .expect("write staging");
+
+        let pending = list_pending_local_project_resource_edits_at(
+            ListPendingLocalProjectResourceEditsInput {
+                project_path: root.to_string_lossy().into_owned(),
+                expected_project_id: PROJECT_ID.to_string(),
+            },
+        )
+        .expect("list pending");
+        assert_eq!(pending.len(), 1);
+        assert_eq!(pending[0].operation_id, request.operation_id);
+
+        let result = resume_local_project_resource_edit_at(ResumeLocalProjectResourceEditInput {
+            project_path: root.to_string_lossy().into_owned(),
+            expected_project_id: PROJECT_ID.to_string(),
+            operation_id: request.operation_id.clone(),
+        })
+        .await
+        .expect("resume from ledger");
+        assert!(result.asset.is_some());
+        assert!(list_pending_local_project_resource_edits_at(
+            ListPendingLocalProjectResourceEditsInput {
+                project_path: root.to_string_lossy().into_owned(),
+                expected_project_id: PROJECT_ID.to_string(),
+            },
+        )
+        .expect("list after commit")
+        .is_empty());
+    }
 }
diff --git a/apps/ai-game-creator-shell/src/features/asset-canvas/AssetCanvasSurface.tsx b/apps/ai-game-creator-shell/src/features/asset-canvas/AssetCanvasSurface.tsx
index c11bf1217..901fc83af 100644
--- a/apps/ai-game-creator-shell/src/features/asset-canvas/AssetCanvasSurface.tsx
+++ b/apps/ai-game-creator-shell/src/features/asset-canvas/AssetCanvasSurface.tsx
@@ -18,6 +18,7 @@ import {
   moveViewportFromPan,
   removeCanvasLayers,
   resizeCanvasLayerBounds,
+  resolveViewportFromWheel,
   scaleViewportFromScreenPoint,
   transformCanvasLayers,
 } from '@genarrative/image-canvas-core';
@@ -387,6 +388,7 @@ export function AssetCanvasSurface({
   const draftRef = useRef(draft);
   const lifecycleRef = useRef(lifecycle);
   const documentVersionRef = useRef(documentVersion);
+  const persistedDocumentVersionRef = useRef(0);
   const epochRef = useRef(0);
   const dragRef = useRef<DragState | null>(null);
   const saveQueueRef = useRef<Promise<unknown>>(Promise.resolve());
@@ -402,6 +404,7 @@ export function AssetCanvasSurface({
   const pendingGenerationRef = useRef<PendingGenerationIdentity | null>(null);
   const generationStartingRef = useRef(false);
   const generationFocusEpochRef = useRef(0);
+  const generationStopButtonRef = useRef<HTMLButtonElement | null>(null);
   const onWalletBalanceMayHaveChanged = useWalletStore(
     (state) => state.onWalletBalanceMayHaveChanged,
   );
@@ -421,7 +424,12 @@ export function AssetCanvasSurface({
   documentVersionRef.current = documentVersion;
 
   const markDirty = useCallback(() => {
-    setDocumentVersion((value) => value + 1);
+    if (lifecycleRef.current.kind !== 'canvas.editing') return;
+    setDocumentVersion((value) => {
+      const next = value + 1;
+      documentVersionRef.current = next;
+      return next;
+    });
     setLifecycle({ kind: 'canvas.editing', dirty: true });
   }, []);
 
@@ -441,8 +449,21 @@ export function AssetCanvasSurface({
       const nextDraft = { ...currentDraft, revision };
       draftRef.current = nextDraft;
       setDraft(nextDraft);
+      const epoch = epochRef.current;
+      void host.project.loadDraft(stableScope).then((loaded) => {
+        if (
+          epoch !== epochRef.current ||
+          loaded.status !== 'ok' ||
+          !loaded.value ||
+          loaded.value.revision < revision
+        ) {
+          return;
+        }
+        draftRef.current = loaded.value;
+        setDraft(loaded.value);
+      });
     },
-    [],
+    [host.project, stableScope],
   );
 
   const canvasHistoryRefs = useMemo(
@@ -538,6 +559,9 @@ export function AssetCanvasSurface({
       setBackgroundColor(nextDraft.canvas.backgroundColor);
       setSelectedLayerIds(nextDraft.canvas.selectedLayerIds);
       resetCanvasHistory();
+      documentVersionRef.current = 0;
+      persistedDocumentVersionRef.current = 0;
+      setDocumentVersion(0);
       setLifecycle({ kind: 'canvas.editing', dirty: false });
     },
     [host, resetCanvasHistory, stableScope],
@@ -552,6 +576,7 @@ export function AssetCanvasSurface({
     pendingCommitRef.current = null;
     pendingGenerationRef.current = null;
     generationStartingRef.current = false;
+    dragRef.current = null;
     generationFocusEpochRef.current += 1;
     hostRevisionRef.current = expectedHostRevision;
     deliveredEventsRef.current.clear();
@@ -710,7 +735,7 @@ export function AssetCanvasSurface({
   const persistDraft =
     useCallback(async (): Promise<ImageCanvasDraft | null> => {
       const epoch = epochRef.current;
-      const requestedVersion = documentVersion;
+      const requestedVersion = documentVersionRef.current;
       const task = saveQueueRef.current.then(async () => {
         const currentDraft = draftRef.current;
         if (!currentDraft || epoch !== epochRef.current) return null;
@@ -748,14 +773,21 @@ export function AssetCanvasSurface({
         }
         draftRef.current = result.value;
         setDraft(result.value);
-        if (requestedVersion === documentVersionRef.current) {
+        persistedDocumentVersionRef.current = Math.max(
+          persistedDocumentVersionRef.current,
+          requestedVersion,
+        );
+        if (
+          requestedVersion === documentVersionRef.current &&
+          lifecycleRef.current.kind === 'canvas.editing'
+        ) {
           setLifecycle({ kind: 'canvas.editing', dirty: false });
         }
         return result.value;
       });
       saveQueueRef.current = task.catch(() => undefined);
       return await task;
-    }, [documentVersion, host.project, stableScope]);
+    }, [host.project, stableScope]);
 
   useEffect(() => {
     if (lifecycle.kind !== 'canvas.editing' || !lifecycle.dirty || !draft) {
@@ -767,6 +799,10 @@ export function AssetCanvasSurface({
 
   useEffect(() => {
     const onMove = (event: PointerEvent) => {
+      if (lifecycleRef.current.kind !== 'canvas.editing') {
+        dragRef.current = null;
+        return;
+      }
       const drag = dragRef.current;
       if (!drag) return;
       if (drag.kind === 'pan') {
@@ -826,6 +862,10 @@ export function AssetCanvasSurface({
       }
     };
     const onUp = () => {
+      if (lifecycleRef.current.kind !== 'canvas.editing') {
+        dragRef.current = null;
+        return;
+      }
       if (!dragRef.current) return;
       dragRef.current = null;
       markDirty();
@@ -845,7 +885,12 @@ export function AssetCanvasSurface({
       const files = Array.from(event.target.files ?? []);
       event.target.value = '';
       const currentDraft = draftRef.current;
-      if (!currentDraft || !files.length) return;
+      if (
+        lifecycleRef.current.kind !== 'canvas.editing' ||
+        !currentDraft ||
+        !files.length
+      )
+        return;
       const images = await Promise.all(
         files.map(async (file) => {
           const mediaType = mediaTypeForFile(file);
@@ -931,7 +976,11 @@ export function AssetCanvasSurface({
   );
 
   const deleteSelected = useCallback(() => {
-    if (!selectionRef.current.length) return;
+    if (
+      lifecycleRef.current.kind !== 'canvas.editing' ||
+      !selectionRef.current.length
+    )
+      return;
     captureHistory({
       type: 'delete-image',
       count: selectionRef.current.length,
@@ -971,8 +1020,7 @@ export function AssetCanvasSurface({
       const epoch = saveEpoch;
       if (!draftRef.current) return;
       if (
-        lifecycleRef.current.kind === 'canvas.editing' &&
-        lifecycleRef.current.dirty
+        documentVersionRef.current !== persistedDocumentVersionRef.current
       ) {
         setLifecycle({ kind: 'canvas.saving', stage: 'draft' });
         const persisted = await persistDraft();
@@ -1053,6 +1101,7 @@ export function AssetCanvasSurface({
         });
       }
       pendingCommitRef.current = null;
+      persistedDocumentVersionRef.current = documentVersionRef.current;
       setNotice(
         result.value.commitStatus === 'already-committed'
           ? '素材已提交，本次返回原幂等结果'
@@ -1162,10 +1211,7 @@ export function AssetCanvasSurface({
     ) {
       return;
     }
-    if (
-      lifecycleRef.current.kind === 'canvas.editing' &&
-      lifecycleRef.current.dirty
-    ) {
+    if (documentVersionRef.current !== persistedDocumentVersionRef.current) {
       setExitDialogOpen(true);
       return;
     }
@@ -1237,9 +1283,9 @@ export function AssetCanvasSurface({
     const frozenAssetKind = assetKind;
     const frozenAssetName = assetName;
     const needsDraftPersist =
-      lifecycleRef.current.kind === 'canvas.editing' &&
-      lifecycleRef.current.dirty;
+      documentVersionRef.current !== persistedDocumentVersionRef.current;
     setGenerationDialog(null);
+    dragRef.current = null;
     setLifecycle({
       kind: 'canvas.generating',
       phase: 'confirmation-required',
@@ -1347,6 +1393,7 @@ export function AssetCanvasSurface({
         });
       }
       pendingGenerationRef.current = null;
+      persistedDocumentVersionRef.current = documentVersionRef.current;
       setLifecycle({ kind: 'canvas.editing', dirty: false });
       setNotice('AI 图片已正式提交并进入资源总览');
     })().catch((error: unknown) => {
@@ -1419,6 +1466,14 @@ export function AssetCanvasSurface({
     () => createMinimapModel({ layers, viewport, canvasSize }),
     [canvasSize, layers, viewport],
   );
+  const generationInteractionLocked = lifecycle.kind === 'canvas.generating';
+
+  useEffect(() => {
+    if (generationInteractionLocked) {
+      dragRef.current = null;
+      generationStopButtonRef.current?.focus();
+    }
+  }, [generationInteractionLocked]);
 
   if (
     !draft ||
@@ -1829,6 +1884,7 @@ export function AssetCanvasSurface({
             />
             <p>生成会由平台按当前账号扣除泥点，完成后自动保存到本地项目。</p>
             <CanvasChromeButton
+              ref={generationStopButtonRef}
               label="停止等待并返回"
               icon={<ArrowLeft size={15} aria-hidden="true" />}
               onClick={stopWaitingForGeneration}
@@ -1889,8 +1945,11 @@ export function AssetCanvasSurface({
         ref={viewportElementRef}
         className="asset-canvas-surface__viewport"
         backgroundColor={backgroundColor}
+        isInteractionPaused={generationInteractionLocked}
+        inert={generationInteractionLocked || undefined}
         isPanning={dragRef.current?.kind === 'pan'}
         onPointerDown={(event) => {
+          if (lifecycleRef.current.kind !== 'canvas.editing') return;
           if (event.target !== event.currentTarget) return;
           captureHistory({ type: 'change-viewport' });
           setSelectedLayerIds([]);
@@ -1903,17 +1962,23 @@ export function AssetCanvasSurface({
           };
         }}
         onWheel={(event) => {
+          if (lifecycleRef.current.kind !== 'canvas.editing') return;
           event.preventDefault();
           const rect = event.currentTarget.getBoundingClientRect();
-          setViewport((current) =>
-            scaleViewportFromScreenPoint({
-              viewport: current,
-              nextScale: current.scale * (event.deltaY < 0 ? 1.12 : 0.88),
-              screenPoint: {
-                x: event.clientX - rect.left,
-                y: event.clientY - rect.top,
-              },
-            }),
+          setViewport(
+            (current) =>
+              resolveViewportFromWheel({
+                viewport: current,
+                deltaX: event.deltaX,
+                deltaY: event.deltaY,
+                shiftKey: event.shiftKey,
+                ctrlKey: event.ctrlKey,
+                metaKey: event.metaKey,
+                screenPoint: {
+                  x: event.clientX - rect.left,
+                  y: event.clientY - rect.top,
+                },
+              }).viewport,
           );
           markDirty();
         }}
@@ -1936,6 +2001,11 @@ export function AssetCanvasSurface({
                   aria-label={`选择图层 ${layer.title}`}
                   aria-pressed={selected}
                   onClick={(event) => {
+                    if (
+                      event.detail !== 0 ||
+                      lifecycleRef.current.kind !== 'canvas.editing'
+                    )
+                      return;
                     const targetIds = event.shiftKey
                       ? selected
                         ? selectedLayerIds.filter((id) => id !== layer.id)
@@ -1952,6 +2022,7 @@ export function AssetCanvasSurface({
                     }
                   }}
                   onPointerDown={(event: ReactPointerEvent<HTMLButtonElement>) => {
+                    if (lifecycleRef.current.kind !== 'canvas.editing') return;
                     event.stopPropagation();
                     const targetIds = event.shiftKey
                       ? selected
@@ -2005,6 +2076,7 @@ export function AssetCanvasSurface({
                     aria-label={`缩放图层 ${layer.title}`}
                     className="asset-canvas-surface__resize-handle"
                     onPointerDown={(event) => {
+                      if (lifecycleRef.current.kind !== 'canvas.editing') return;
                       event.stopPropagation();
                       captureHistory({
                         type: 'resize-image',
@@ -2022,6 +2094,7 @@ export function AssetCanvasSurface({
                       };
                     }}
                     onKeyDown={(event) => {
+                      if (lifecycleRef.current.kind !== 'canvas.editing') return;
                       if (!event.key.startsWith('Arrow')) return;
                       event.preventDefault();
                       const direction =
@@ -2058,10 +2131,15 @@ export function AssetCanvasSurface({
         </CanvasWorld>
       </SharedCanvasViewport>
 
-      <aside className="asset-canvas-surface__viewport-tools">
+      <aside
+        className="asset-canvas-surface__viewport-tools"
+        inert={generationInteractionLocked || undefined}
+        aria-hidden={generationInteractionLocked || undefined}
+      >
         <ZoomControls
           viewport={viewport}
           onFit={() => {
+            if (lifecycleRef.current.kind !== 'canvas.editing') return;
             const next = fitViewportToLayers({ layers, canvasSize });
             if (next) {
               captureHistory({ type: 'change-viewport' });
@@ -2070,6 +2148,7 @@ export function AssetCanvasSurface({
             }
           }}
           onScaleFromCenter={(scale) => {
+            if (lifecycleRef.current.kind !== 'canvas.editing') return;
             captureHistory({ type: 'change-viewport' });
             setViewport((current) =>
               scaleViewportFromScreenPoint({
@@ -2114,6 +2193,7 @@ export function AssetCanvasSurface({
           <Minimap
             model={minimapModel}
             onPointerDown={(event) => {
+              if (lifecycleRef.current.kind !== 'canvas.editing') return;
               const rect = event.currentTarget.getBoundingClientRect();
               captureHistory({ type: 'change-viewport' });
               setViewport(
diff --git a/apps/ai-game-creator-shell/src/view/project-development/index.tsx b/apps/ai-game-creator-shell/src/view/project-development/index.tsx
index 70e5b32b8..4364bc419 100644
--- a/apps/ai-game-creator-shell/src/view/project-development/index.tsx
+++ b/apps/ai-game-creator-shell/src/view/project-development/index.tsx
@@ -125,6 +125,15 @@ type DeriveLocalProjectResourceResult = {
   manifest: GameCreationAppManifest;
 };
 
+type PendingLocalProjectResourceEdit = {
+  operationId: string;
+  editKind: string;
+  sourceResourceId: string;
+  assetName: string;
+  phase: string;
+  createdAt: number;
+};
+
 type NormalizeLocalProjectRasterResourceResult = {
   committedProjectRevision: number;
   asset: GameCreationAppAssetManifestEntry;
@@ -498,6 +507,12 @@ export default function ProjectDevelopmentView({
   const [resourceEditorRoute, setResourceEditorRoute] =
     useState<ResourceEditorRoute | null>(null);
   const [assetCanvasNotice, setAssetCanvasNotice] = useState('');
+  const [pendingResourceEdits, setPendingResourceEdits] = useState<
+    PendingLocalProjectResourceEdit[]
+  >([]);
+  const [resumingResourceEditId, setResumingResourceEditId] = useState<
+    string | null
+  >(null);
   const [hiddenCommittedResourceId, setHiddenCommittedResourceId] = useState<
     string | null
   >(null);
@@ -974,6 +989,8 @@ export default function ProjectDevelopmentView({
     setResourceEditorRoute(null);
     resourceEditorRevisionRef.current.clear();
     setHiddenCommittedResourceId(null);
+    setPendingResourceEdits([]);
+    setResumingResourceEditId(null);
     suppressResourceFocusRestoreRef.current = true;
     previousFocusedResourceIdRef.current = null;
     resourceFocusTriggerIdRef.current = null;
@@ -983,6 +1000,33 @@ export default function ProjectDevelopmentView({
     restoreResourceListScrollRef.current = false;
   }, [advanceFocusGeneration, projectPath]);
 
+  useEffect(() => {
+    const invoke = window.__TAURI__?.core?.invoke;
+    if (!invoke) {
+      setPendingResourceEdits([]);
+      return undefined;
+    }
+    let active = true;
+    void invoke<PendingLocalProjectResourceEdit[]>(
+      'list_pending_local_project_resource_edits',
+      {
+        input: {
+          projectPath,
+          expectedProjectId: manifest.projectId,
+        },
+      },
+    )
+      .then((edits) => {
+        if (active) setPendingResourceEdits(edits);
+      })
+      .catch(() => {
+        if (active) setPendingResourceEdits([]);
+      });
+    return () => {
+      active = false;
+    };
+  }, [manifest.projectId, projectPath]);
+
   useEffect(() => {
     if (!focusedResourceId || resourceEditorRoute) {
       return undefined;
@@ -1454,6 +1498,71 @@ export default function ProjectDevelopmentView({
     setAssetCanvasNotice('');
   }, [advanceFocusGeneration, resourceEditorRoute]);
 
+  const resumePendingResourceEdit = useCallback(
+    async (pending: PendingLocalProjectResourceEdit) => {
+      const invoke = window.__TAURI__?.core?.invoke;
+      if (!invoke || resumingResourceEditId) return;
+      const flowId = crypto.randomUUID();
+      activeFocusFlowIdRef.current = flowId;
+      setResumingResourceEditId(pending.operationId);
+      setAssetCanvasNotice(`正在继续“${pending.assetName}”的原生成 operation…`);
+      try {
+        const result = await invoke<DeriveLocalProjectResourceResult>(
+          'resume_local_project_resource_edit',
+          {
+            input: {
+              projectPath,
+              expectedProjectId: manifest.projectId,
+              operationId: pending.operationId,
+            },
+          },
+        );
+        if (result.manifest.projectId !== manifest.projectId) {
+          throw new Error('恢复的资源编辑结果与当前项目不一致');
+        }
+        const resourceId = result.asset
+          ? `asset:${result.asset.id}`
+          : result.version
+            ? `version:${result.version.versionId}`
+            : null;
+        if (!resourceId) {
+          throw new Error('资源编辑恢复完成但没有返回派生资源');
+        }
+        onManifestChange?.(projectPath, result.manifest, {
+          projectId: result.manifest.projectId,
+          revision: result.committedProjectRevision,
+          source: 'asset-command',
+          commitId: pending.operationId,
+        });
+        pendingResourceFocusRef.current = {
+          flowId,
+          saveAttemptId: pending.operationId,
+          sessionId: pending.operationId,
+          draftId: pending.operationId,
+          commitId: pending.operationId,
+          projectPath,
+          projectId: result.manifest.projectId,
+          focusGeneration: focusGenerationRef.current,
+          resourceId,
+          completed: false,
+        };
+        setPendingResourceEdits((current) =>
+          current.filter((edit) => edit.operationId !== pending.operationId),
+        );
+        setFocusedResourceId(null);
+        setMode('resources');
+        setAssetCanvasNotice('原资源编辑已恢复，正在同步派生资源与布局…');
+      } catch (error) {
+        setAssetCanvasNotice(
+          error instanceof Error ? error.message : String(error),
+        );
+      } finally {
+        setResumingResourceEditId(null);
+      }
+    },
+    [manifest.projectId, onManifestChange, projectPath, resumingResourceEditId],
+  );
+
   const submitResourceEdit = useCallback(
     async ({ prompt, assetName }: ResourceEditSubmitInput) => {
       const route = resourceEditorRoute;
@@ -1854,6 +1963,21 @@ export default function ProjectDevelopmentView({
               !assetCanvasRoute &&
               !resourceEditorRoute ? (
                 <>
+                  {pendingResourceEdits.length > 0 ? (
+                    <button
+                      type="button"
+                      disabled={resumingResourceEditId !== null}
+                      onClick={() => {
+                        const pending = pendingResourceEdits[0];
+                        if (pending) void resumePendingResourceEdit(pending);
+                      }}
+                    >
+                      <Sparkles size={15} aria-hidden="true" />
+                      {resumingResourceEditId
+                        ? '正在继续编辑…'
+                        : `继续未完成编辑 (${pendingResourceEdits.length})`}
+                    </button>
+                  ) : null}
                   <button
                     type="button"
                     disabled
diff --git a/apps/ai-game-creator-shell/tests/assetCanvasSurface.test.tsx b/apps/ai-game-creator-shell/tests/assetCanvasSurface.test.tsx
index 6899aca82..a7722bbc5 100644
--- a/apps/ai-game-creator-shell/tests/assetCanvasSurface.test.tsx
+++ b/apps/ai-game-creator-shell/tests/assetCanvasSurface.test.tsx
@@ -159,6 +159,7 @@ function memoryHost(input?: {
   commitGate?: Deferred<void>;
   generationGate?: Deferred<void>;
   generationFailure?: { code: string; message: string };
+  updateFailure?: { code: string; message: string };
   recoveryEvent?: LocalAssetCommittedEvent;
 }) {
   let draft = input?.initialDraft ?? null;
@@ -217,6 +218,13 @@ function memoryHost(input?: {
         return { status: 'ok', value: draft };
       },
       async updateDraft(update) {
+        if (input?.updateFailure) {
+          return {
+            status: 'failed' as const,
+            code: input.updateFailure.code,
+            message: input.updateFailure.message,
+          };
+        }
         if (!draft || update.expectedDraftRevision !== draft.revision) {
           return {
             status: 'conflict',
@@ -668,6 +676,29 @@ describe('Tauri 素材创作无限画布独立 Surface', () => {
     expect(memory.discardDraft).not.toHaveBeenCalled();
   });
 
+  it('草稿自动保存失败后返回仍要求明确保留或放弃', async () => {
+    const memory = memoryHost({
+      initialDraft: draftFixture(scope, keyboardCanvas()),
+      updateFailure: {
+        code: 'fixture-save-failed',
+        message: '测试草稿保存失败',
+      },
+    });
+    const { onCancel } = renderSurface(memory.host);
+    fireEvent.click(
+      await screen.findByRole('button', { name: '选择图层 第一层' }),
+    );
+    expect((await screen.findByRole('alert')).textContent).toContain(
+      '测试草稿保存失败',
+    );
+
+    fireEvent.click(screen.getByRole('button', { name: '返回资源总览' }));
+    expect(
+      screen.getByRole('dialog', { name: '返回资源总览' }),
+    ).toBeTruthy();
+    expect(onCancel).not.toHaveBeenCalled();
+  });
+
   it('只有明确放弃草稿时才写入 cancelled', async () => {
     const memory = memoryHost({
       initialDraft: draftFixture(scope, keyboardCanvas()),
@@ -718,6 +749,76 @@ describe('Tauri 素材创作无限画布独立 Surface', () => {
     });
   });
 
+  it('Shift 指针选择在 pointerdown 到 click 的完整序列中只切换一次', async () => {
+    const memory = memoryHost({
+      initialDraft: draftFixture(scope, keyboardCanvas()),
+    });
+    renderSurface(memory.host);
+    const first = await screen.findByRole('button', {
+      name: '选择图层 第一层',
+    });
+    const second = screen.getByRole('button', { name: '选择图层 第二层' });
+    fireEvent.pointerDown(first, { pointerId: 1, clientX: 10, clientY: 10 });
+    fireEvent.pointerUp(window, { pointerId: 1, clientX: 10, clientY: 10 });
+    fireEvent.click(first, { detail: 1 });
+    expect(first.getAttribute('aria-pressed')).toBe('true');
+
+    fireEvent.pointerDown(second, {
+      pointerId: 2,
+      clientX: 70,
+      clientY: 10,
+      shiftKey: true,
+    });
+    fireEvent.pointerUp(window, {
+      pointerId: 2,
+      clientX: 70,
+      clientY: 10,
+      shiftKey: true,
+    });
+    fireEvent.click(second, { detail: 1, shiftKey: true });
+
+    expect(first.getAttribute('aria-pressed')).toBe('true');
+    expect(second.getAttribute('aria-pressed')).toBe('true');
+  });
+
+  it('Tauri 画布滚轮支持二维平移、Shift 横移和 Ctrl 缩放', async () => {
+    const memory = memoryHost({
+      initialDraft: draftFixture(scope, keyboardCanvas()),
+    });
+    renderSurface(memory.host);
+    await screen.findByRole('button', { name: '选择图层 第一层' });
+    const viewport = document.querySelector(
+      '.asset-canvas-surface__viewport',
+    ) as HTMLElement;
+    const world = document.querySelector(
+      '.genarrative-image-canvas__world',
+    ) as HTMLElement;
+    expect(world.style.transform).toBe('translate(0px, 0px) scale(0.5)');
+
+    fireEvent.wheel(viewport, { deltaX: 4, deltaY: 10, clientX: 100, clientY: 80 });
+    await waitFor(() =>
+      expect(world.style.transform).toBe('translate(-4px, -10px) scale(0.5)'),
+    );
+    fireEvent.wheel(viewport, {
+      deltaX: 0,
+      deltaY: 10,
+      clientX: 100,
+      clientY: 80,
+      shiftKey: true,
+    });
+    await waitFor(() =>
+      expect(world.style.transform).toBe('translate(-14px, -10px) scale(0.5)'),
+    );
+    fireEvent.wheel(viewport, {
+      deltaX: 0,
+      deltaY: -10,
+      clientX: 100,
+      clientY: 80,
+      ctrlKey: true,
+    });
+    await waitFor(() => expect(world.style.transform).not.toContain('scale(0.5)'));
+  });
+
   it('新建、导入、编辑、撤销重做并完成 durable commit', async () => {
     const memory = memoryHost();
     const { onCommitted, onSaveAttempt } = renderSurface(memory.host);
@@ -998,6 +1099,63 @@ describe('Tauri 素材创作无限画布独立 Surface', () => {
     expect(onCommitted).toHaveBeenCalledTimes(1);
   });
 
+  it('生成期间聚焦停止等待按钮并阻止所有画布输入修改', async () => {
+    const gate = deferred<void>();
+    const memory = memoryHost({
+      initialDraft: draftFixture(scope, keyboardCanvas()),
+      generationGate: gate,
+    });
+    renderSurface(memory.host);
+    const first = await screen.findByRole('button', {
+      name: '选择图层 第一层',
+    });
+    fireEvent.click(first);
+    await waitFor(() => expect(first.getAttribute('aria-pressed')).toBe('true'));
+    fireEvent.click(screen.getByRole('button', { name: 'AI 生成图片' }));
+    fireEvent.change(screen.getByLabelText('图片提示词'), {
+      target: { value: '生成期间完全锁定画布交互' },
+    });
+    fireEvent.click(screen.getByRole('button', { name: '继续确认' }));
+    fireEvent.click(screen.getByRole('button', { name: '确认并生成' }));
+    await waitFor(() => expect(memory.generationCalls).toHaveLength(1));
+
+    const stopWaiting = screen
+      .getAllByRole('button', { name: '停止等待并返回' })
+      .at(-1)!;
+    await waitFor(() => expect(document.activeElement).toBe(stopWaiting));
+    const viewport = document.querySelector(
+      '.asset-canvas-surface__viewport',
+    ) as HTMLElement;
+    const world = document.querySelector(
+      '.genarrative-image-canvas__world',
+    ) as HTMLElement;
+    const transformBefore = world.style.transform;
+    const resize = screen.getByRole('button', { name: '缩放图层 第一层' });
+    const second = screen.getByRole('button', { name: '选择图层 第二层' });
+
+    fireEvent.wheel(viewport, {
+      deltaY: -120,
+      ctrlKey: true,
+      clientX: 100,
+      clientY: 80,
+    });
+    fireEvent.pointerDown(viewport, { pointerId: 3, clientX: 10, clientY: 10 });
+    fireEvent.pointerMove(window, { pointerId: 3, clientX: 100, clientY: 100 });
+    fireEvent.pointerUp(window, { pointerId: 3, clientX: 100, clientY: 100 });
+    fireEvent.pointerDown(second, { pointerId: 4, shiftKey: true });
+    fireEvent.pointerUp(window, { pointerId: 4, shiftKey: true });
+    fireEvent.click(second, { detail: 1, shiftKey: true });
+    fireEvent.keyDown(resize, { key: 'ArrowRight' });
+    fireEvent.click(
+      screen.getByRole('button', { name: '放大画布', hidden: true }),
+    );
+
+    expect(world.style.transform).toBe(transformBefore);
+    expect(first.getAttribute('aria-pressed')).toBe('true');
+    expect(second.getAttribute('aria-pressed')).toBe('false');
+    await act(async () => gate.resolve());
+  });
+
   it('泥点不足时在中央保留失败状态和生成参数，并可返回修改', async () => {
     const prompt = '保留参数的原创游戏场景';
     const memory = memoryHost({
diff --git a/apps/ai-game-creator-shell/tests/projectResourceLiveIntegration.test.tsx b/apps/ai-game-creator-shell/tests/projectResourceLiveIntegration.test.tsx
index 3d206a324..d7a272b2d 100644
--- a/apps/ai-game-creator-shell/tests/projectResourceLiveIntegration.test.tsx
+++ b/apps/ai-game-creator-shell/tests/projectResourceLiveIntegration.test.tsx
@@ -282,11 +282,14 @@ describe('project resource live canvas integration', () => {
     canvasFixture.sequence = 0;
   });
 
-  function installTauri(options: { failFirstDerive?: boolean } = {}) {
+  function installTauri(
+    options: { failFirstDerive?: boolean; pendingResourceEdit?: boolean } = {},
+  ) {
     const layoutWrites: Array<Record<string, unknown>> = [];
     const graphReads: Array<Record<string, unknown>> = [];
     const deriveCalls: Array<Record<string, unknown>> = [];
     const normalizeCalls: Array<Record<string, unknown>> = [];
+    const resumeCalls: Array<Record<string, unknown>> = [];
     const invoke = vi.fn(
       async (command: string, args?: Record<string, unknown>) => {
         if (command === 'get_local_game_project_revision') {
@@ -339,6 +342,52 @@ describe('project resource live canvas integration', () => {
             content: '# 玩法规则',
           };
         }
+        if (command === 'list_pending_local_project_resource_edits') {
+          return options.pendingResourceEdit
+            ? [
+                {
+                  operationId: '99999999-9999-4999-8999-999999999999',
+                  editKind: 'text',
+                  sourceResourceId: 'rules-resource',
+                  assetName: '恢复的规则编辑版',
+                  phase: 'media-downloaded',
+                  createdAt: 1,
+                },
+              ]
+            : [];
+        }
+        if (command === 'resume_local_project_resource_edit') {
+          const input = structuredClone(
+            (args?.input ?? {}) as Record<string, unknown>,
+          );
+          resumeCalls.push(input);
+          const base = canvasFixture.manifest;
+          if (!base) throw new Error('missing manifest fixture');
+          const operationId = String(input.operationId);
+          const asset = {
+            id: `edit-${operationId}`,
+            kind: 'game-rules',
+            mediaType: 'text/markdown',
+            localPath: `assets/edits/${operationId}-recovered-rules.md`,
+            source: {
+              kind: 'generated' as const,
+              resourceId: `local-asset:edit-${operationId}`,
+              referenceResourceIds: ['rules-resource'],
+            },
+          };
+          canvasFixture.revision += 1;
+          const nextManifest = { ...base, assets: [...base.assets, asset] };
+          canvasFixture.manifest = nextManifest;
+          return {
+            operationId,
+            editKind: 'text',
+            sourceResourceId: 'rules-resource',
+            committedProjectRevision: canvasFixture.revision,
+            asset,
+            version: null,
+            manifest: nextManifest,
+          };
+        }
         if (command === 'derive_local_project_resource') {
           const input = structuredClone(
             (args?.input ?? {}) as Record<string, unknown>,
@@ -412,7 +461,13 @@ describe('project resource live canvas integration', () => {
       core: { invoke },
       event: { listen: async () => () => undefined },
     };
-    return { deriveCalls, graphReads, layoutWrites, normalizeCalls };
+    return {
+      deriveCalls,
+      graphReads,
+      layoutWrites,
+      normalizeCalls,
+      resumeCalls,
+    };
   }
 
   it('enters refine in the central view, keeps the draft on return, and preserves the source after a durable edit', async () => {
@@ -563,4 +618,28 @@ describe('project resource live canvas integration', () => {
     expect(normalizeCalls[0]?.sourcePath).toBe('assets/task-hero.png');
     expect(normalizeCalls[0]?.producerTaskId).toBe('art-asset-plan');
   });
+
+  it('lists an unfinished edit and resumes it using only the private-ledger operation id', async () => {
+    const { resumeCalls } = installTauri({ pendingResourceEdit: true });
+    render(<DerivedWorkbench />);
+
+    const resume = await screen.findByRole('button', {
+      name: '继续未完成编辑 (1)',
+    });
+    fireEvent.click(resume);
+    await waitFor(() => expect(resumeCalls).toHaveLength(1));
+    expect(resumeCalls[0]).toEqual({
+      projectPath,
+      expectedProjectId: 'live-canvas-project',
+      operationId: '99999999-9999-4999-8999-999999999999',
+    });
+    expect(resumeCalls[0]).not.toHaveProperty('prompt');
+    expect(resumeCalls[0]).not.toHaveProperty('endpoint');
+    expect(resumeCalls[0]).not.toHaveProperty('idempotencyKey');
+    expect(
+      await screen.findByRole('region', {
+        name: /recovered-rules\.md/,
+      }),
+    ).not.toBeNull();
+  });
 });
diff --git a/docs/project-memory/shared-memory/decision-log.md b/docs/project-memory/shared-memory/decision-log.md
index 7db89a69d..9e1df8c69 100644
--- a/docs/project-memory/shared-memory/decision-log.md
+++ b/docs/project-memory/shared-memory/decision-log.md
@@ -6354,7 +6354,7 @@
 - 异步契约：External v1 的图片生成、图片编辑、图标图集、UI 素材提取、角色动画、视频、音效和背景音乐八类 POST 固定持久化入 `external_generation_job` 并返回 HTTP `202 + operationId/statusUrl/pollAfterMs`；不受站内 `GENARRATIVE_EXTERNAL_GENERATION_MODE=inline` 影响。每次逻辑生成必须携带稳定 `Idempotency-Key`；提交结果未知时复用原 endpoint、原始正文和原键恢复 POST，轮询超时时保留已有 `operationId` 并只继续 GET，不得换键重提。
 - 发布窗口兼容与幂等恢复：AI 游戏创作桌面客户端严格按 HTTP 状态分流生成首响应；旧服务 `200` 只作为已经完成且含可下载媒体的同步结果消费，旧图集允许从顶层 `spritesheetImageSrc` 换签下载且无效值不得遮蔽可用 `objectKey`；新服务 `202` 必须取得 `operationId` 后轮询，轮询间隔按 OpenAPI 限制在 `250..=5000ms`，其他 2xx 失败关闭。Runtime 在 POST 前原子持久化 endpoint、精确请求体字节、请求 SHA-256 与稳定幂等键，`202` 后先原子追加 `operationId` 并回读一致再查询；`accepted` 账本只恢复 GET，`prepared` 只允许在身份、配置指纹与请求 SHA 校验通过后使用账本中的原 endpoint、原始正文和同一键恢复 POST。该 POST 是 External v1 服务端幂等合同下的同一逻辑提交恢复，不放宽通用 ToolHost 未知副作用禁重放规则。恢复得到 `202` 后升级同一账本并继续 GET，旧 `200` 走兼容完成路径；再次 transport 失败仍保留同一账本。显式“继续/恢复”复用原 action、pending、provider batch 和生成账本身份，不创建 successor 请求或新键。生成 POST 使用独立三十五分钟等待预算；game-chat 的两次串行生成纳入父 run `4200` 秒软预算与从 root `bound_at` 起算的 `4500` 秒绝对硬截止，但截止时若 `canvas.asset_generate` 已进入 executing，客户端与预览照常退出，Runtime 保留 pending action、provider batch、生成账本与 `needs-reconciliation`。轮询超时保留 `accepted + operationId` 并在恢复时继续 GET；旧 `200` 结果损坏、`202` 缺 operationId、状态损坏、透明派生失败或外部完成后的本地提交失败仍进入对账边界。非阻断 general warning 继续消费结果并与 `sliceWarning` 分别展示。权威 External v1 OpenAPI 仍只声明新异步 `202`，不把部署过渡兼容公开成正式双协议。
 - 查询与结果：新增 owner-safe `GET /api/external/v1/generations/{operationId}`。`queued/running` 返回 phase/progress，`completed` 返回 compact 稳定 artifact 引用，`failed` 返回脱敏错误，跨 owner 按不存在处理。compact result 允许 objectKey、resource/asset ID、assetObjectId、尺寸、媒体类型、taskId 和告警；禁止完整 project/canvas、Data URL、Blob URL、临时 signed URL、内部 provider 原文和 lease/fencing 控制字段。
-- 客户端 durable 查询约束：私有生成账本同时绑定 base URL/API Key 配置指纹，指纹不一致不恢复 POST 或查询旧 operation。旧 `200` 兼容结果只持久恢复允许字段和安全媒体引用。operation 明确 failed 的账本保留到 pending observation 和 Provider batch 终态落盘后再清理。只有首次提交直接取得契约明确的 `400 / 401 / 403` 才可判定为入队前拒绝并清理 prepared 账本；首次结果已经未知后，恢复 POST 的临时 `401 / 403` 等响应不能证明原请求未入队，不得删除账本。其它非成功状态一律保留账本进入对账。账本路径解析、扫描和删除逐级拒绝符号链接，非法控制路径失败关闭。
+- 客户端 durable 查询约束：私有生成账本绑定归一化 base URL 的服务身份指纹，服务地址不一致时不恢复 POST 或查询旧 operation；Developer API Key 只负责授权，轮换不改变已有 operation 身份。旧 `200` 兼容结果只持久恢复允许字段和安全媒体引用。operation 明确 failed 的账本保留到 pending observation 和 Provider batch 终态落盘后再清理。只有首次提交直接取得契约明确的 `400 / 401 / 403` 才可判定为入队前拒绝并清理 prepared 账本；首次结果已经未知后，恢复 POST 的临时 `401 / 403` 等响应不能证明原请求未入队，不得删除账本。其它非成功状态一律保留账本进入对账。账本路径解析、扫描和删除逐级拒绝符号链接，非法控制路径失败关闭。
 - MCP：新增托管 `/api/external/v1/mcp`，使用现有 External API Key Bearer 鉴权和无协议 session 的 Streamable HTTP JSON direct 模式。MCP tools 从同一 OpenAPI operation 形成并复用 External REST router；生成 tool 显式要求 `idempotencyKey`，另有统一任务查询 tool。MCP resources 提供使用说明、OpenAPI、Skill 入口 `SKILL.md` 和 `references/capability-routing.md`、`references/api-operations.md`、`references/authentication-and-safety.md`、`references/requests-and-outputs.md` 四篇稳定 reference；日后新增 reference 时必须同步新增独立 resource。MCP Agent 直接调用托管 tools，不安装 CLI，也不将脚本、测试或 workflow 暴露为 MCP resources。禁止开放内部 SpacetimeDB MCP、worker procedure、controller 或队列控制面。
 - Agent 发现：新增公开 `agent-integration.json`、`skill/SKILL.md` 和 `skill.zip`。manifest 同时声明 MCP、OpenAPI、完整 Skill archive、SHA-256 和包内清单；archive 必须包含 `SKILL.md`、上述四篇 references、stdlib Python helper 和 `agents/openai.yaml` 七个声明文件，不能只提供 OpenAPI JSON，也不能包含 API Key、本机路径或个人配置。完整 `skill.zip` 只供不支持 MCP 或需要本地文件上传编排的 Agent 使用，不作为 MCP resource。
 - 兼容边界：这是基于「截至 2026-07-31 尚无外部第三方存量调用方」接受的 v1 原地 breaking change；一旦出现外部活跃 Key、公开契约或联调方，后续破坏性变更必须保留兼容、经过弃用期或升级 `/api/external/v2`。
@@ -6948,6 +6948,14 @@
 - 分类：内部稳定 reason code 固定为 `translation_invalid / translation_upstream_failed / translation_budget_exhausted / elevenlabs_http_failed / invalid_audio / duration_probe_failed / oss_failed / writeback_failed`。MIME、空 body 和大小归 `invalid_audio`；MP3 识别、帧读取和时长门禁归 `duration_probe_failed`。普通用户继续只读稳定短文案，不暴露 endpoint、上游正文或凭据。
 - 跨入口：画布 Agent `generate-sound-effect` 与站内 / External v1 共用 canonical Prompt、固定模型、nullable `0.5-30` 小数时长和 Loop；省略 duration 为手动 `5s`，显式 null 为自动。SFX 参数解析必须保留该 null，不能被通用 null-default 兼容层改写。最终仍进入相同 `editor_sound_effect_generation` queue payload，不新增 Agent 专属链路。
 - 发布边界：T6 工程实施和 mock / loopback 门禁不等于真实 provider 或生产验收。发布前关闭 SFX 入队，使用显式 `--server` / `--server-url` 只读查询 `external_generation_job` 中 pending / running 的 `editor_sound_effect_generation`，清零后按 api-server / Worker → Web 顺序部署并灰度；禁止 `--root-dir`、删除任务伪造 drain 或自动回退 Vidu。本次没有 SpacetimeDB schema、migration 或 bindings 变更。
+
+## 2026-08-10 客户端全类型资源编辑恢复身份与交互门禁
+
+- 资源编辑 operation 以私有账本中的原 endpoint、请求字节、幂等键和 `operationId` 为唯一恢复身份；账本同时冻结源 asset、媒体类型、资源 kind、生产任务和源版本快照。旧账本只从当前 manifest、已完成任务产物、版本数组及受控扩展名兼容恢复，不能信任 UI 路径或前端重新构造的来源。
+- Developer API Key 允许轮换，配置身份只绑定 External 服务地址。升级前包含 Key 的 Agent 生成指纹只在当前 Key 可验证原服务时迁移为仅服务地址指纹，迁移后 Key 轮换继续沿用原 operation；无法区分旧 Key 轮换与服务漂移时失败关闭。operation 已建立后遇到 401/403/404、超时或临时网关错误都保留原 operation；恢复命令仅接收项目与 operation 身份，不接收 Key 或新请求正文。
+- pending 扫描上限覆盖目录全部实际条目。媒体提交前重新校验源摘要；视频后续派生使用 committed ledger 的稳定 `objectKey`，不把 `assetObjectId` 当远端输入；版本 journal 重放返回原子版本，禁止重复追加。
+- 画布生成中冻结 wheel、指针、缩放和方向键状态改变并聚焦“停止等待”；普通 wheel 二维平移，Shift 纵向滚轮横移，Ctrl/Command wheel 缩放。Shift 指针序列只执行一次选择切换，草稿保存失败后退出仍必须提供保留/放弃确认。
+- 关联：`apps/ai-game-creator-shell/src-tauri/src/project/resource_editor.rs`、`apps/ai-game-creator-shell/src/features/asset-canvas/AssetCanvasSurface.tsx`、`packages/image-canvas-core/src/interaction.ts`。
 ## 2026-08-06 编辑器生成结果使用 durable receipt 与统一原子提交
 
 - 背景：图片、改图、去背景、图集 / UI 多产物、角色动作、视频、音效和背景音乐在 OSS 结果可用后，仍分段 confirm object、创建 project resource / account asset、保存 canvas 和 complete job。任一中间失败都会留下部分业务事实；只把 `external_generation_job` 当 operation journal 又无法覆盖无 job 的 inline，也无法独立证明某批 resource/asset/canvas 已作为一笔提交完成。
diff --git a/docs/project-memory/shared-memory/pitfalls.md b/docs/project-memory/shared-memory/pitfalls.md
index 7fd2fe3f4..146c97360 100644
--- a/docs/project-memory/shared-memory/pitfalls.md
+++ b/docs/project-memory/shared-memory/pitfalls.md
@@ -4326,7 +4326,7 @@
 - 原因：把“客户端没有收到结果”误判为“服务端没有受理”，又没有持久保留逻辑请求的幂等键和服务端返回的 `operationId`。托管 MCP 若绕过 External REST router 直接调用 worker 或 SpacetimeDB，也会形成第二套去重与状态语义。
 - 处理：一次逻辑生成只分配一个稳定幂等键。桌面 Runtime 在 POST 前先把 endpoint、精确请求体字节、SHA-256 和幂等键原子写入私有生成账本并回读一致；收到 `202 + operationId` 后先把账本升级为 `accepted` 再轮询。`accepted` 只恢复 GET；`prepared` 或提交响应丢失时，只允许校验账本身份、配置指纹和请求 SHA 后，以账本保存的原 endpoint、原始正文与同一键恢复同一逻辑 POST，不得重建画布上下文、重组正文或换键。恢复 `202` 后继续 GET，恢复再次 transport 失败仍保留原账本；轮询超时只保留既有 operation 并恢复 GET。game-chat 的 4500 秒硬截止可以结束本轮、关闭预览和客户端，但 executing 的 `canvas.asset_generate` 必须保留 pending action、provider batch 与生成账本；旧 `200` 图集的 `spritesheetResource` 允许为空，此时只在顶层 `spritesheetImageSrc` 是有效下载引用时优先使用，否则回退可用 `objectKey`。`202` 缺 operationId、状态损坏与 `postprocess-failed-source-preserved` 仍进入对账边界；其它 non-blocking warning 继续消费成功结果并单独展示。旧 `200` 兼容不改变权威 External v1 的异步契约。MCP 生成工具必须把 `idempotencyKey` 映射到同一 REST header，并复用同一 External router、owner 和任务账本。这是 External v1 的专用幂等恢复，不是通用副作用自动重放。
 - 补充：不能把“accepted 分支里没有生成 POST”误当成 GET-only 恢复。若读取账本前仍重做项目/素材目录准备、输出路径预检或请求正文构造，恢复仍可能创建远端资源或在查询 operation 前失败。恢复必须直接使用 durable snapshot；清理必须最后删除 pending 身份锚点，活动 orphan 不得自动删除。完整恢复 future 还要在默认 Tokio worker 栈下验证，不能靠测试环境调大 `RUST_MIN_STACK` 掩盖栈溢出。
-- 加固：durable snapshot 必须绑定不含明文凭据的 base URL/API Key 配置指纹，配置漂移时恢复 POST 和 GET 都必须阻断。accepted operation 明确 failed 也不能在 observation 持久化前删账本。旧 `200` durable result 只保留允许字段与安全 objectKey/相对路径，签名 URL、query/fragment 和未知字段不落盘。只有首次提交直接返回契约明确的 `400 / 401 / 403` 才可证明未入队并清理 prepared 账本；首次结果已经未知后，恢复请求的临时鉴权错误、超时、冲突、限流、网关错误及其它意外状态均保留同一账本。账本根目录、扫描和删除必须通过受控路径解析逐级拒绝符号链接，不能让项目内链接把清理目标指向项目外。
+- 加固：durable snapshot 必须绑定不含明文凭据的规范 base URL 服务身份指纹；服务地址漂移时恢复 POST 和 GET 都必须阻断，Developer API Key 轮换则必须继续原 operation。accepted operation 明确 failed 也不能在 observation 持久化前删账本。旧 `200` durable result 只保留允许字段与安全 objectKey/相对路径，签名 URL、query/fragment 和未知字段不落盘。只有首次提交直接返回契约明确的 `400 / 401 / 403` 才可证明未入队并清理 prepared 账本；首次结果已经未知后，恢复请求的临时鉴权错误、超时、冲突、限流、网关错误及其它意外状态均保留同一账本。账本根目录、扫描和删除必须通过受控路径解析逐级拒绝符号链接，不能让项目内链接把清理目标指向项目外。
 - 代理 DNS：Clash 等透明代理可能把公网对象存储域名解析到 RFC 2544 的 `198.18.0.0/15` fake-IP。下载器只对已通过鉴权 `objectKey` 或受控 legacy path 换签得到的 URL 接受“全部地址均位于该 benchmark 段”的窄例外；直接 URL、其它本机/私网地址、公私混合解析和重定向仍必须失败关闭，不能为了兼容代理整体移除 SSRF 校验。
 - 验证：覆盖“服务端已入队但提交响应丢失”后两次 POST 的 endpoint、正文 bytes 与 `Idempotency-Key` 完全相同，原键重试仍返回同一 operation，最终只出现一份 completed result 和一次计费 / 写回；恢复再次 transport 失败或临时鉴权失败仍保留同一账本；换 owner 不可见；MCP 与 REST 对同一 owner、同一请求和同一键必须命中同一 operation。
 - 关联：`server-rs/crates/api-server/src/external_generation.rs`、`server-rs/crates/api-server/src/external_mcp.rs`、`docs/【后端架构】外部OpenAPI与APIKey接入方案-2026-06-19.md`。
@@ -4624,3 +4624,10 @@
 - 原因：pool 只按 LLM 凭据和路由复用进程，节点身份只用于进程内 thread map。任一 stdout framing、子进程退出或连接故障都会 drain 整个进程的 pending/turn router，使所有共享节点同时失去可信终态。
 - 处理：pool key 必须包含 `projectId + agentId + sessionId + runId`，每个权威节点直接持有独立 app-server 子进程；同节点 turn 还要串行，不能向同一 thread 并发 `turn/start`。只发送当前 CLI schema 定义的字段；stderr 使用有界内存尾部并先脱敏再进入 Runner 诊断。
 - 验证：至少两个节点并发各跑多轮，确认存在两个 app-server PID；终止其中一个后只有对应节点进入 reconciliation，另一个仍能收到 `turn/completed`。旧 AppData 缺 `agentMode` 且含非 Responses 路由时必须保留 `provider`，不能在项目自动恢复时批量失败。
+
+## 资源编辑恢复不能依赖当前 UI 快照或旧 API Key 指纹（2026-08-10）
+
+- 现象：应用重启后，任务视频或项目版本的编辑 operation 无法恢复；轮换 Developer API Key 后已有 operation 被误判为配置变化；目录中放入大量无关文件还能绕过 pending 扫描上限。派生视频再次编辑时若把 `assetObjectId` 当远端引用，生成会失败或指向错误身份。
+- 原因：早期账本只保存显示层资源 ID，恢复时又依赖当前页面资源对象；配置指纹混入 Key；扫描计数只在识别出 pending JSON 后递增；本地登记 ID 与 External generation 接受的稳定 `objectKey` 没有分层。
+- 处理：新账本冻结完整源快照，旧账本从权威 manifest、完成任务和版本记录有界恢复；服务身份只哈希规范 endpoint。扫描在读取每个目录条目时先计数，任何文件都消耗预算。提交前复验源摘要，远端请求只使用账本已确认的稳定 `objectKey`，恢复始终复用原 operation 和请求字节。
+- 验证：覆盖任务视频/版本旧账本恢复、所有目录条目上限、Key 轮换、401/403/404 保留 operation、源摘要漂移拒绝、committed 视频二次派生以及版本 journal exactly-once。
diff --git a/docs/technical/【技术方案】AI游戏创作智能体App实施计划-2026-06-24.md b/docs/technical/【技术方案】AI游戏创作智能体App实施计划-2026-06-24.md
index cfc268dd4..5b19ce8a3 100644
--- a/docs/technical/【技术方案】AI游戏创作智能体App实施计划-2026-06-24.md
+++ b/docs/technical/【技术方案】AI游戏创作智能体App实施计划-2026-06-24.md
@@ -300,7 +300,7 @@ Agent Runtime 负责：
 - 2026-07-10 补充：后台任务工具箱已加入 `preview.start`。Agent 可在 loop 中自行请求启动当前项目的本地 HTTP 预览；Runtime 会复用 `preview.start` 策略、项目写锁、共享 `PreviewRegistry`、manifest 预览状态、`.agent/logs/preview.log` 和 run trace 追加逻辑，并把 `agent.runtime.preview.start` 写入 `.agent/agent.db`。该 observation 只向 LLM 返回 localhost URL 与端口，不返回用户项目绝对路径。
 - 2026-07-10 补充，2026-07-31 收紧，2026-08-03 增加发布窗口兼容与 durable 生成账本，2026-08-04 对齐 External v1 幂等恢复：后台任务工具箱提供 `canvas.asset_generate`。Agent 在 loop 中给出素材 prompt、`outputPath`、比例、尺寸、kind 与展示名；Runtime 通过 AppData / Tauri 配置里的 `editorApi` 调用 External Editor API。生成前按本地项目名称创建或复用同名画布项目和同名素材库目录，请求必须携带 `projectId + assetFolderId + canvasCompletion`，生成结果同时进入平台画布、素材库和本地项目。canonical 视觉 DAG 固定为：`art-director` 通过 `POST /api/external/v1/editor/images/generations` + `kind=spec` 生成 `assets/art-spec.png`；`design-foundation` 精确引用该 resourceId，通过同一路由 + `kind=ui-design` 生成 `assets/ui-prototype.png`；`art-asset-plan` 使用同一 resourceId 和具体 `iconDescriptions`，通过 `POST /api/external/v1/editor/icon-spritesheets/generations` 生成真实透明的 `assets/art-spritesheet.png`。Runtime 在 POST 前把 endpoint、精确请求体、SHA-256 与稳定 `Idempotency-Key` 原子写入 `.agent/runtime/canvas-generation-requests/` 私有账本并回读一致；正式新契约收到 HTTP `202` 后先原子追加 `operationId`，再按限制到 `250..=5000ms` 的 `pollAfterMs` 查询统一状态端点。重启时 `accepted` 账本只恢复 GET；`prepared` 表示首次提交结果未知，只允许在账本身份、配置指纹和请求 SHA 校验通过后，使用账本保存的原 endpoint、原始 JSON 字节与同一 `Idempotency-Key` 恢复 POST，不得重建远端项目/目录、重组正文或分配新键。恢复收到 `202` 后升级同一账本为 `accepted` 并继续 GET，旧 `200` 仍走既有兼容完成路径；恢复再次 transport 失败或返回不能证明首次请求未入队的响应时保留原 `prepared` 账本。桌面客户端在滚动发布窗口内仍按 HTTP 状态兼容旧同步 `200` 完整结果；旧图集只在 `spritesheetImageSrc` 是有效下载引用时优先使用，否则回退 `objectKey`。生成 POST 使用独立三十五分钟等待预算；game-chat 的两次串行生成纳入父 run `4200` 秒软预算与 `4500` 秒总截止。截止时普通本地动作按失败清理；若 `canvas.asset_generate` 已进入 executing，则结束本轮并关闭预览和客户端，但保留 pending action、provider batch、生成账本与 `needs-reconciliation`。轮询超时只保留 `accepted + operationId` 并在恢复时继续 GET；旧 `200` 结果损坏、`202` 缺 operationId、状态损坏、透明派生失败或外部完成后的本地提交失败仍进入对账边界。`postprocess-failed-source-preserved` 不得登记为透明图集或自动重试；其它 general warning 保持 completed 并与 `sliceWarning` 分别展示。本地 manifest 只在生成完成后持久化 generation route、kind、服务端 taskId 与精确参考 resourceId。UI extraction 只处理已有带标注 UI 图，不属于这条 DAG；图集不得回退到普通生图。UI 原型 prompt、`generationInputs.artSpec` 和 `ui-prototype.v2` 验收必须从当前项目玩法合同提取 HUD、可玩区域、关键实体、操作、失败/重开与移动布局，禁止预设塔防或补入合同中不存在的卡牌、波次、敌人入口。canonical UI 原型固定请求 `2K + 16:9`。旧正式图不合格时，普通原合同只能返回 `needs-repair`；Supervisor 认领后仅可签发一次完整继承原合同的 repair，由原 owner 使用 `replaceExisting=true` 原位替换，禁止先删除正式图。API Key 不进入项目文件；幂等键只进入受权限约束的私有生成账本，不进入 observation、manifest、agent.db 或日志。
 - 2026-08-03 durable 恢复补充，2026-08-04 扩展 `prepared`：`prepared / accepted / legacy-completed` 恢复必须先从私有账本读取持久化的画布 ID、素材目录 ID、画布名、生成提示词、route、kind 与引用资源；`prepared` 只原样恢复同一逻辑 POST，`accepted` 只查询既有 operation。不得在读取账本前重建请求、重新列举或创建远端项目/目录，也不得让本地输出路径漂移挡住恢复。显式“继续/恢复”复用原 action、pending、provider batch 与生成账本身份，不创建 successor 请求或新幂等键。恢复执行和后续 continuation 使用独立 Tokio task 栈边界，同时继续持有原 Agent lock。终态清理固定先删 generation / parallel 附属 sidecar，最后删 pending 身份锚点；历史孤儿只有所属任务已明确 completed/cancelled 时可自动清理，活动、未知或 `needs-reconciliation` orphan 必须保留并失败关闭。
-- 2026-08-03 durable 恢复加固，2026-08-04 收紧清理边界：生成账本还必须绑定归一化 base URL 与 API Key 哈希组成的配置指纹，当前 External Editor 服务或租户身份变更时禁止恢复 POST 或查询旧 operation。旧同步 `200` 结果只持久恢复必需的允许字段；绝对 signed URL、query/fragment 和未知扩展字段不得进入项目账本，只有安全相对路径或 objectKey 可作为 durable 下载引用。accepted operation 明确 failed 时也保留账本，直到 pending observation 和 Provider batch 成员终态持久化后再按统一清理链删除。只有首次提交直接取得契约明确的 `400 / 401 / 403` 才可视为入队前拒绝并清理 prepared 账本；首次结果已经未知后，恢复 POST 的临时鉴权或其它非成功响应不能证明原请求未入队，必须保留原账本。生成账本根目录、扫描与删除使用受控路径解析逐级拒绝符号链接，非法控制路径失败关闭。独立恢复任务异常必须落盘 task queue、state、event 和 agent.db 对账阻断，公共记录不得复制未脱敏 panic payload。
+- 2026-08-03 durable 恢复加固，2026-08-04 收紧清理边界，2026-08-10 允许 Key 轮换：生成账本必须绑定归一化 base URL 的服务身份指纹，External Editor 服务地址变化时禁止恢复 POST 或查询旧 operation；Developer API Key 只负责当前请求授权，轮换不得改变已有 operation 的归属。旧同步 `200` 结果只持久恢复必需的允许字段；绝对 signed URL、query/fragment 和未知扩展字段不得进入项目账本，只有安全相对路径或 objectKey 可作为 durable 下载引用。accepted operation 明确 failed 时也保留账本，直到 pending observation 和 Provider batch 成员终态持久化后再按统一清理链删除。只有首次提交直接取得契约明确的 `400 / 401 / 403` 才可视为入队前拒绝并清理 prepared 账本；首次结果已经未知后，恢复 POST 的临时鉴权或其它非成功响应不能证明原请求未入队，必须保留原账本。生成账本根目录、扫描与删除使用受控路径解析逐级拒绝符号链接，非法控制路径失败关闭。独立恢复任务异常必须落盘 task queue、state、event 和 agent.db 对账阻断，公共记录不得复制未脱敏 panic payload。
 - 2026-07-10 补充：后台任务工具箱已加入 `task.list`。Agent 可在 loop 中读取 manifest 任务图、每个 seed task 的状态 / 依赖 / 产物交接，以及按依赖计算的 `readyTaskIds`；Runtime 复用 `task.list` 项目权限策略，策略要求确认或拒绝时只返回策略 observation，不向 LLM 暴露任务图细节。
 - 2026-07-10 补充：后台任务工具箱已加入 `task.update`。Agent 可在 loop 中把 manifest 种子任务状态更新为 `pending / running / waiting-for-confirmation / completed / failed`，用于表达长期后台任务的当前进度；Runtime 复用 `task.update` 策略和项目写锁，实际只修改 `.agent/manifest.json` 中已有 taskId 的 `status`，并写入 `agent.runtime.task.update` 审计记录。策略要求确认或拒绝时不会修改 manifest，也不会创建新任务。
 - 2026-07-10 补充：后台任务工具箱已加入 `file.list`。Agent 可在 loop 中自行列出项目文件摘要或某个相对目录下的文件摘要，再决定是否继续读取具体文件；Runtime 复用 `file.list` 项目权限策略，observation 只包含项目相对路径、类型和大小，不读取文件内容、不返回项目绝对路径。
diff --git a/docs/technical/【技术方案】客户端素材创作无限画布阶段一合同-2026-08-05.md b/docs/technical/【技术方案】客户端素材创作无限画布阶段一合同-2026-08-05.md
index 3de2839bc..1ee20a0ae 100644
--- a/docs/technical/【技术方案】客户端素材创作无限画布阶段一合同-2026-08-05.md
+++ b/docs/technical/【技术方案】客户端素材创作无限画布阶段一合同-2026-08-05.md
@@ -988,7 +988,12 @@ confirmation-required
 - External 图片 refine、视频、音效和背景音乐请求统一在 `generationInputs.source` 写入专用消费身份 `game-creator-resource-editor`；所有 External 路由必须实际读取并传递同一稳定 `Idempotency-Key`。队列完成态只向该消费身份返回经过裁剪的稳定 `objectKey / resource / asset` 引用和必要媒体元数据，不暴露 provider、worker、队列内部字段或临时签名 URL。
 - 生成公开状态每次写入草稿都必须推进草稿 revision，并把最新 revision 同步到私有生成账本、进度事件、staging 与正式 commit；旧 UI 快照不得覆盖 accepted/running/reconciliation 状态。
 - operation 已受理或首次提交结果未知后遇到 401/403，不得写成 terminal failed。私有账本保留原 operation、原请求字节和原幂等身份，公开状态进入可恢复对账态；修正 External Editor API Key 配置后只继续同一 operation。
+- 全类型资源编辑私有账本必须冻结 `sourceAssetId / sourceMediaType / sourceAssetKind / producerTaskId / sourceVersionId` 源快照；新账本不得依赖 UI 仍停留在原资源，旧账本则只允许从当前 manifest、已完成任务产物、版本数组和受控扩展名兼容恢复。恢复结果仍要重新校验唯一来源、项目归属与媒体类型，不能把账本快照当成越权凭据。
+- 私有账本的 External 配置身份只绑定规范服务地址，不绑定可轮换的 Developer API Key。升级前仍使用“服务地址 + Key”指纹的 Agent 生成账本，在原 Key 尚可用时首次恢复必须原子迁移为仅服务地址指纹；迁移后 Key 轮换不影响原 operation，无法证明服务地址未漂移的旧账本仍失败关闭。Key 轮换后，401/403/404、轮询超时或网关暂时失败都必须保留原 endpoint、请求字节、幂等键和 operation；恢复命令仅凭持久 `operationId` 查找账本，不允许前端重新拼请求或携带 Key。
+- pending 恢复扫描的目录上限统计所有实际目录条目，包括未知文件、非 pending 账本和损坏条目；达到上限后停止扫描并返回安全错误，不能通过堆放无关文件绕过边界。已 committed 的账本不得出现在 pending 列表中。
+- 派生媒体提交必须以账本冻结的源摘要再次校验源文件；摘要、媒体身份或版本父子关系变化时失败关闭。远端派生视频二次编辑必须复用已提交账本中的稳定 `objectKey`，不能把仅用于本地登记的 `assetObjectId` 当成 generation reference。版本 journal 重放只能返回既有子版本，不得重复追加。
 - 返回资源总览时，clean 草稿直接保留并退出；dirty 草稿必须使用独立确认面板提供“保留草稿并退出”和“放弃草稿”，默认保留。保留前必须等待当前保存或主动 flush，放弃才允许调用 discard。
 - 图层选择与图层缩放必须同时提供指针和键盘路径；不得嵌套 button/role=button。Enter/Space 可选择图层，缩放手柄使用原生 button 并提供方向键离散缩放。
+- Tauri 画布普通滚轮按二维 delta 平移，Shift 加纵向滚轮作为横向平移回退，Ctrl/Command 加滚轮才围绕指针缩放；一次 Shift 指针事件序列只能切换一次选择。生成中必须把焦点移到“停止等待”，并阻止 wheel、指针拖拽、缩放快捷键和方向键继续改变画布，避免生成恢复期间写入新的 UI 快照。
 
 当前阶段不主动扩展 create 专属空画布导入、生成或保存体验；图片继续复用现有画布，其他类型使用同一资源编辑壳按能力分流，不能把视频、音频或版本强塞进图片图层模型。共享持久化、安全、幂等和可访问性缺陷仍必须修复，因为它们直接影响编辑链路。
diff --git a/packages/image-canvas-core/src/interaction.ts b/packages/image-canvas-core/src/interaction.ts
index 330e7921b..51c0a647b 100644
--- a/packages/image-canvas-core/src/interaction.ts
+++ b/packages/image-canvas-core/src/interaction.ts
@@ -243,6 +243,40 @@ export function zoomViewportFromWheel({
   });
 }
 
+export function resolveViewportFromWheel({
+  viewport,
+  deltaX,
+  deltaY,
+  shiftKey,
+  ctrlKey,
+  metaKey,
+  screenPoint,
+}: {
+  viewport: CanvasViewport;
+  deltaX: number;
+  deltaY: number;
+  shiftKey: boolean;
+  ctrlKey: boolean;
+  metaKey: boolean;
+  screenPoint: CanvasPoint;
+}): { mode: 'pan' | 'zoom'; viewport: CanvasViewport } {
+  if (ctrlKey || metaKey) {
+    return {
+      mode: 'zoom',
+      viewport: zoomViewportFromWheel({ viewport, deltaY, screenPoint }),
+    };
+  }
+  const useShiftWheelHorizontalFallback = shiftKey && deltaX === 0;
+  return {
+    mode: 'pan',
+    viewport: panViewportFromWheel({
+      viewport,
+      deltaX: useShiftWheelHorizontalFallback ? deltaY : deltaX,
+      deltaY: useShiftWheelHorizontalFallback ? 0 : deltaY,
+    }),
+  };
+}
+
 export function moveViewportFromPan(
   dragState: Extract<DragState, { kind: 'pan' }>,
   pointer: CanvasPoint,
diff --git a/packages/image-canvas-core/src/sharedCanvasCore.test.ts b/packages/image-canvas-core/src/sharedCanvasCore.test.ts
index 8eac1527c..de97dd978 100644
--- a/packages/image-canvas-core/src/sharedCanvasCore.test.ts
+++ b/packages/image-canvas-core/src/sharedCanvasCore.test.ts
@@ -10,6 +10,7 @@ import {
   panViewportFromWheel,
   resizeCanvasLayerBounds,
   resolvePointerSelection,
+  resolveViewportFromWheel,
   scaleViewportFromScreenPoint,
   selectLayersInsideMarquee,
   transformCanvasLayers,
@@ -62,6 +63,43 @@ describe('shared image canvas core', () => {
     });
   });
 
+  it('shares pan, shift-pan and modifier-zoom wheel semantics', () => {
+    const viewport = { x: 20, y: 30, scale: 1 };
+    expect(
+      resolveViewportFromWheel({
+        viewport,
+        deltaX: 4,
+        deltaY: 10,
+        shiftKey: false,
+        ctrlKey: false,
+        metaKey: false,
+        screenPoint: { x: 100, y: 100 },
+      }),
+    ).toEqual({ mode: 'pan', viewport: { x: 16, y: 20, scale: 1 } });
+    expect(
+      resolveViewportFromWheel({
+        viewport,
+        deltaX: 0,
+        deltaY: 10,
+        shiftKey: true,
+        ctrlKey: false,
+        metaKey: false,
+        screenPoint: { x: 100, y: 100 },
+      }),
+    ).toEqual({ mode: 'pan', viewport: { x: 10, y: 30, scale: 1 } });
+    expect(
+      resolveViewportFromWheel({
+        viewport,
+        deltaX: 0,
+        deltaY: -10,
+        shiftKey: false,
+        ctrlKey: true,
+        metaKey: false,
+        screenPoint: { x: 100, y: 100 },
+      }).mode,
+    ).toBe('zoom');
+  });
+
   it('supports additive selection, marquee and multi-layer movement', () => {
     expect(
       resolvePointerSelection({
diff --git a/packages/image-canvas-react/src/useImageCanvasViewportControls.ts b/packages/image-canvas-react/src/useImageCanvasViewportControls.ts
index 39f0a2614..74717d6e4 100644
--- a/packages/image-canvas-react/src/useImageCanvasViewportControls.ts
+++ b/packages/image-canvas-react/src/useImageCanvasViewportControls.ts
@@ -12,9 +12,8 @@ import {
   getWorldPointFromClient,
   moveViewportFromMinimapDrag as resolveViewportFromMinimapDrag,
   moveViewportFromMinimapPointer as resolveViewportFromMinimapPointer,
-  panViewportFromWheel,
+  resolveViewportFromWheel,
   scaleViewportFromScreenPoint,
-  zoomViewportFromWheel,
 } from '@genarrative/image-canvas-core';
 import {
   type Dispatch,
@@ -369,32 +368,22 @@ export function useImageCanvasViewportControls({
 
       event.preventDefault();
 
-      if (!event.ctrlKey && !event.metaKey) {
-        const useShiftWheelHorizontalFallback =
-          event.shiftKey && event.deltaX === 0;
-        setViewport((currentViewport) =>
-          panViewportFromWheel({
-            viewport: currentViewport,
-            deltaX: useShiftWheelHorizontalFallback
-              ? event.deltaY
-              : event.deltaX,
-            deltaY: useShiftWheelHorizontalFallback ? 0 : event.deltaY,
-          }),
-        );
-        return;
-      }
-
       const rect = viewportElement.getBoundingClientRect();
       const screenPoint = {
         x: event.clientX - rect.left,
         y: event.clientY - rect.top,
       };
-      setViewport((currentViewport) =>
-        zoomViewportFromWheel({
-          viewport: currentViewport,
-          deltaY: event.deltaY,
-          screenPoint,
-        }),
+      setViewport(
+        (currentViewport) =>
+          resolveViewportFromWheel({
+            viewport: currentViewport,
+            deltaX: event.deltaX,
+            deltaY: event.deltaY,
+            shiftKey: event.shiftKey,
+            ctrlKey: event.ctrlKey,
+            metaKey: event.metaKey,
+            screenPoint,
+          }).viewport,
       );
     },
     [canvasViewportRef, setViewport],