diff --git a/.codex/hooks/pre-submit-compile-check.mjs b/.codex/hooks/pre-submit-compile-check.mjs
index 97a5b305a..13f62b64b 100644
--- a/.codex/hooks/pre-submit-compile-check.mjs
+++ b/.codex/hooks/pre-submit-compile-check.mjs
@@ -14,20 +14,40 @@ if (hookInput && !isGitCommitCommand(extractShellCommand(hookInput))) {
 }
 
 const validationSteps = [
+  {
+    label: 'Rust format check',
+    command: npmCommand,
+    args:
+      process.platform === 'win32'
+        ? ['/d', '/s', '/c', 'npm run check:rustfmt']
+        : ['run', 'check:rustfmt'],
+  },
   {
     label: 'TypeScript typecheck',
     command: npmCommand,
-    args: process.platform === 'win32' ? ['/d', '/s', '/c', 'npm run typecheck'] : ['run', 'typecheck'],
+    args:
+      process.platform === 'win32'
+        ? ['/d', '/s', '/c', 'npm run typecheck']
+        : ['run', 'typecheck'],
   },
   {
     label: 'Admin web typecheck',
     command: npmCommand,
-    args: process.platform === 'win32' ? ['/d', '/s', '/c', 'npm run admin-web:typecheck'] : ['run', 'admin-web:typecheck'],
+    args:
+      process.platform === 'win32'
+        ? ['/d', '/s', '/c', 'npm run admin-web:typecheck']
+        : ['run', 'admin-web:typecheck'],
   },
   {
     label: 'Rust api-server compile check',
     command: 'cargo',
-    args: ['check', '-p', 'api-server', '--manifest-path', 'server-rs/Cargo.toml'],
+    args: [
+      'check',
+      '-p',
+      'api-server',
+      '--manifest-path',
+      'server-rs/Cargo.toml',
+    ],
   },
 ];
 
@@ -66,7 +86,9 @@ function runStep(step) {
   }
 
   if (result.error) {
-    console.error(`[codex-hook] ${step.label} 启动失败：${result.error.message}`);
+    console.error(
+      `[codex-hook] ${step.label} 启动失败：${result.error.message}`,
+    );
     return { ok: false, status: 1 };
   }
 
@@ -104,12 +126,15 @@ function extractShellCommand(input) {
     input?.command,
   ];
 
-  const command = candidates.find(value => typeof value === 'string' && value.trim().length > 0);
+  const command = candidates.find(
+    (value) => typeof value === 'string' && value.trim().length > 0,
+  );
   if (command) {
     return command;
   }
 
-  const shellCommand = input?.tool_input?.cmd ?? input?.toolInput?.cmd ?? input?.arguments?.cmd;
+  const shellCommand =
+    input?.tool_input?.cmd ?? input?.toolInput?.cmd ?? input?.arguments?.cmd;
   if (Array.isArray(shellCommand)) {
     return shellCommand.join(' ');
   }
diff --git a/apps/admin-web/src/api/adminApiClient.test.ts b/apps/admin-web/src/api/adminApiClient.test.ts
index b2127d332..85f029e37 100644
--- a/apps/admin-web/src/api/adminApiClient.test.ts
+++ b/apps/admin-web/src/api/adminApiClient.test.ts
@@ -1,21 +1,66 @@
-import {afterEach, expect, test, vi} from 'vitest';
+import { afterEach, expect, test, vi } from 'vitest';
 
 import {
+  createAdminAccount,
   executeAdminRechargeRefund,
   getAdminUserDetail,
   listAdminRechargeOrders,
   resolveAdminRechargeRefundManualReview,
+  updateAdminAccount,
 } from './adminApiClient';
 
 afterEach(() => {
   vi.unstubAllGlobals();
 });
 
+test('后台账号创建和更新携带 owner 会话与 Tab 权限', async () => {
+  const fetchMock = vi.fn().mockImplementation(() =>
+    Promise.resolve(
+      new Response(JSON.stringify({account: {accountId: 'member-1'}}), {
+        status: 200,
+      }),
+    ),
+  );
+  vi.stubGlobal('fetch', fetchMock);
+
+  await createAdminAccount('owner-token', {
+    username: 'operator',
+    displayName: '运营',
+    password: 'secret123',
+    tabPermissions: ['dashboard', 'tracking'],
+    enabled: true,
+  });
+  await updateAdminAccount('owner-token', 'member/1', {
+    displayName: '运营二组',
+    tabPermissions: ['tracking'],
+    enabled: false,
+  });
+
+  expect(fetchMock.mock.calls[0]?.[0]).toBe('/admin/api/accounts');
+  expect(fetchMock.mock.calls[0]?.[1]).toEqual(
+    expect.objectContaining({
+      method: 'POST',
+      headers: expect.objectContaining({Authorization: 'Bearer owner-token'}),
+    }),
+  );
+  expect(fetchMock.mock.calls[1]?.[0]).toBe('/admin/api/accounts/member%2F1');
+  expect(fetchMock.mock.calls[1]?.[1]).toEqual(
+    expect.objectContaining({
+      method: 'PUT',
+      body: JSON.stringify({
+        displayName: '运营二组',
+        tabPermissions: ['tracking'],
+        enabled: false,
+      }),
+    }),
+  );
+});
+
 test('充值订单查询按后台契约序列化筛选参数', async () => {
   const fetchMock = vi.fn().mockResolvedValue(
-    new Response(JSON.stringify({entries: []}), {
+    new Response(JSON.stringify({ entries: [] }), {
       status: 200,
-      headers: {'content-type': 'application/json'},
+      headers: { 'content-type': 'application/json' },
     }),
   );
   vi.stubGlobal('fetch', fetchMock);
@@ -47,12 +92,14 @@ test('充值订单查询按后台契约序列化筛选参数', async () => {
 });
 
 test('用户详情只发送实际提供的用户定位字段', async () => {
-  const fetchMock = vi.fn().mockResolvedValue(
-    new Response(JSON.stringify({userId: 'user-1'}), {status: 200}),
-  );
+  const fetchMock = vi
+    .fn()
+    .mockResolvedValue(
+      new Response(JSON.stringify({ userId: 'user-1' }), { status: 200 }),
+    );
   vi.stubGlobal('fetch', fetchMock);
 
-  await getAdminUserDetail('token-1', {publicUserCode: 'TN1001'});
+  await getAdminUserDetail('token-1', { publicUserCode: 'TN1001' });
 
   const requestUrl = String(fetchMock.mock.calls[0]?.[0]);
   const parsed = new URL(requestUrl, 'http://admin.local');
@@ -63,9 +110,13 @@ test('用户详情只发送实际提供的用户定位字段', async () => {
 });
 
 test('退款执行使用独立 execute 管理员路由', async () => {
-  const fetchMock = vi.fn().mockResolvedValue(
-    new Response(JSON.stringify({outRefundNo: 'refund-1'}), {status: 200}),
-  );
+  const fetchMock = vi
+    .fn()
+    .mockResolvedValue(
+      new Response(JSON.stringify({ outRefundNo: 'refund-1' }), {
+        status: 200,
+      }),
+    );
   vi.stubGlobal('fetch', fetchMock);
 
   await executeAdminRechargeRefund('token-1', {
@@ -92,14 +143,19 @@ test('退款执行使用独立 execute 管理员路由', async () => {
 });
 
 test('退款人工复核使用独立 resolve 管理员路由', async () => {
-  const fetchMock = vi.fn().mockResolvedValue(
-    new Response(JSON.stringify({outRefundNo: 'refund-1'}), {status: 200}),
-  );
+  const fetchMock = vi
+    .fn()
+    .mockResolvedValue(
+      new Response(JSON.stringify({ outRefundNo: 'refund-1' }), {
+        status: 200,
+      }),
+    );
   vi.stubGlobal('fetch', fetchMock);
 
   await resolveAdminRechargeRefundManualReview('token-1', {
     outRefundNo: 'refund-1',
     reason: '已核对微信商户平台原始账单',
+    expectedErrorCode: 'provider_transaction_id_mismatch',
   });
 
   expect(String(fetchMock.mock.calls[0]?.[0])).toBe(
@@ -111,6 +167,7 @@ test('退款人工复核使用独立 resolve 管理员路由', async () => {
       body: JSON.stringify({
         outRefundNo: 'refund-1',
         reason: '已核对微信商户平台原始账单',
+        expectedErrorCode: 'provider_transaction_id_mismatch',
       }),
     }),
   );
diff --git a/apps/admin-web/src/api/adminApiClient.ts b/apps/admin-web/src/api/adminApiClient.ts
index 89a9bf649..8b1f4eb25 100644
--- a/apps/admin-web/src/api/adminApiClient.ts
+++ b/apps/admin-web/src/api/adminApiClient.ts
@@ -1,4 +1,7 @@
 import type {
+  AdminAccountListResponse,
+  AdminCreateAccountRequest,
+  AdminCreateAccountResponse,
   AdminUpsertCreationEntryEventBannersRequest,
   AdminUpsertCreationEntryTypeConfigRequest,
   AdminCreationEntryConfigResponse,
@@ -39,6 +42,8 @@ import type {
   AdminTrackingEventListResponse,
   AdminUpdateWorkVisibilityRequest,
   AdminUpdateWorkVisibilityResponse,
+  AdminUpdateAccountRequest,
+  AdminUpdateAccountResponse,
   AdminUploadedEditorShowcaseCampaignImage,
   AdminUpsertEditorShowcaseCampaignRequest,
   AdminUpsertFeatureGateConfigRequest,
@@ -188,6 +193,32 @@ export function getAdminMe(token: string) {
   return request<AdminMeResponse>('/admin/api/me', { token });
 }
 
+export function listAdminAccounts(token: string) {
+  return request<AdminAccountListResponse>('/admin/api/accounts', {token});
+}
+
+export function createAdminAccount(
+  token: string,
+  payload: AdminCreateAccountRequest,
+) {
+  return request<AdminCreateAccountResponse>('/admin/api/accounts', {
+    method: 'POST',
+    token,
+    body: payload,
+  });
+}
+
+export function updateAdminAccount(
+  token: string,
+  accountId: string,
+  payload: AdminUpdateAccountRequest,
+) {
+  return request<AdminUpdateAccountResponse>(
+    `/admin/api/accounts/${encodeURIComponent(accountId)}`,
+    {method: 'PUT', token, body: payload},
+  );
+}
+
 export function getAdminOverview(token: string) {
   return request<AdminOverviewResponse>('/admin/api/overview', { token });
 }
@@ -367,10 +398,11 @@ export function getAdminAssetReadUrl(
 export function listAdminEditorAssets(
   token: string,
   query: AdminEditorAssetListQuery = {},
+  signal?: AbortSignal,
 ) {
   return request<AdminEditorAssetListResponse>(
     `/admin/api/editor-assets${buildEditorAssetListQuery(query)}`,
-    { token },
+    { token, signal },
   );
 }
 
diff --git a/apps/admin-web/src/api/adminApiTypes.ts b/apps/admin-web/src/api/adminApiTypes.ts
index 1afe7f04f..2aff05de0 100644
--- a/apps/admin-web/src/api/adminApiTypes.ts
+++ b/apps/admin-web/src/api/adminApiTypes.ts
@@ -36,10 +36,53 @@ export interface AdminSessionPayload {
   username: string;
   displayName: string;
   roles: string[];
+  accountRole: 'owner' | 'member';
+  tabPermissions: string[];
   issuedAt: string;
   expiresAt: string;
 }
 
+export interface AdminAccountPayload {
+  accountId: string;
+  username: string;
+  displayName: string;
+  accountRole: 'owner' | 'member';
+  tabPermissions: string[];
+  enabled: boolean;
+  tokenVersion: number;
+  createdBy: string;
+  updatedBy: string;
+  createdAt: string;
+  updatedAt: string;
+}
+
+export interface AdminAccountListResponse {
+  accounts: AdminAccountPayload[];
+}
+
+export interface AdminCreateAccountRequest {
+  username: string;
+  displayName: string;
+  password: string;
+  tabPermissions: string[];
+  enabled: boolean;
+}
+
+export interface AdminCreateAccountResponse {
+  account: AdminAccountPayload;
+}
+
+export interface AdminUpdateAccountRequest {
+  displayName: string;
+  password?: string;
+  tabPermissions: string[];
+  enabled: boolean;
+}
+
+export interface AdminUpdateAccountResponse {
+  account: AdminAccountPayload;
+}
+
 export interface AdminLoginResponse {
   token: string;
   admin: AdminSessionPayload;
@@ -85,6 +128,9 @@ export interface AdminDashboardMetricsPayload {
   consumedMudPoints: number;
   totalRegisteredUsers: number;
   newRegisteredUsers: number;
+  newUserPaymentConversion: AdminDashboardPaymentConversionPayload;
+  day1Retention: AdminDashboardRetentionMetricPayload;
+  day7Retention: AdminDashboardRetentionMetricPayload;
   visitUsers: number;
   totalVisitUsers: number;
   visitCount: number;
@@ -92,6 +138,18 @@ export interface AdminDashboardMetricsPayload {
   currentUsers: number;
 }
 
+export interface AdminDashboardPaymentConversionPayload {
+  paidUsers: number;
+  newRegisteredUsers: number;
+  rateBasisPoints: number;
+}
+
+export interface AdminDashboardRetentionMetricPayload {
+  eligibleUsers: number;
+  retainedUsers: number;
+  rateBasisPoints: number;
+}
+
 export interface AdminDashboardChartPayload {
   id: string;
   title: string;
@@ -409,6 +467,7 @@ export interface AdminEditorAssetPayload {
   model?: string | null;
   provider?: string | null;
   taskId?: string | null;
+  groupTaskId?: string | null;
   assetKind?: string | null;
   generationInputs?: Record<string, unknown> | null;
   sourceResourceId?: string | null;
@@ -416,6 +475,10 @@ export interface AdminEditorAssetPayload {
   generationCostMudPoints: number;
   createdAt: string;
   updatedAt: string;
+  generator: string;
+  taskGenerator: string;
+  taskCostMudPoints: number;
+  children: AdminEditorAssetPayload[];
 }
 
 export interface AdminEditorAssetListResponse {
@@ -629,6 +692,7 @@ export interface ProfileCodeOperationAdminResponse {
   code: string;
   action: 'create' | 'update' | 'disable' | string;
   operatorUserId: string;
+  operatorDisplayName: string;
   createdAt: string;
 }
 
@@ -665,8 +729,10 @@ export interface ProfileTaskConfigAdminResponse {
   enabled: boolean;
   sortOrder: number;
   createdBy: string;
+  createdByDisplayName: string;
   createdAt: string;
   updatedBy: string;
+  updatedByDisplayName: string;
   updatedAt: string;
 }
 
@@ -705,8 +771,10 @@ export interface ProfileWalletConfigAdminResponse {
   configId: string;
   initialMudPoints: number;
   createdBy: string;
+  createdByDisplayName: string;
   createdAt: string;
   updatedBy: string;
+  updatedByDisplayName: string;
   updatedAt: string;
 }
 
@@ -762,8 +830,10 @@ export interface AdminWalletManualRestrictionPayload {
   frozen: boolean;
   reason: string;
   createdByAdminUserId: string;
+  createdByAdminDisplayName: string;
   createdAtMicros: number;
   updatedByAdminUserId: string;
+  updatedByAdminDisplayName: string;
   updatedAtMicros: number;
 }
 
@@ -785,7 +855,9 @@ export interface AdminProfileWalletPayload {
 export interface AdminRechargeRefundPayload {
   outRefundNo: string;
   providerRefundId: string;
+  providerTransactionId: string;
   providerStatus: string;
+  totalCents: number;
   refundCents: number;
   payerRefundCents: number;
   successAtMicros?: number | null;
@@ -800,6 +872,7 @@ export interface AdminRechargeRefundPayload {
   manualReviewResolvedByAdminUserId?: string | null;
   manualReviewResolutionReason?: string | null;
   manualReviewResolvedAtMicros?: number | null;
+  manualReviewResolvedErrorCode?: string | null;
 }
 
 export interface AdminRechargeRefundHoldPayload {
@@ -882,6 +955,7 @@ export interface AdminRechargeRefundRegisterRequest {
 export interface AdminRechargeRefundManualReviewResolveRequest {
   outRefundNo: string;
   reason: string;
+  expectedErrorCode: string;
 }
 
 export interface AdminWalletRestrictionRequest {
diff --git a/apps/admin-web/src/app/AdminApp.tsx b/apps/admin-web/src/app/AdminApp.tsx
index 9a596528c..2e58ac6f8 100644
--- a/apps/admin-web/src/app/AdminApp.tsx
+++ b/apps/admin-web/src/app/AdminApp.tsx
@@ -1,4 +1,4 @@
-import {useCallback, useEffect, useState} from 'react';
+import {useCallback, useEffect, useMemo, useState} from 'react';
 
 import {
   formatAdminApiError,
@@ -18,6 +18,7 @@ import {
   setStoredAdminToken,
 } from '../auth/adminAuthStore';
 import {AdminCreationEntrySwitchPage} from '../pages/AdminCreationEntrySwitchPage';
+import {AdminAccountsPage} from '../pages/AdminAccountsPage';
 import {AdminDashboardPage} from '../pages/AdminDashboardPage';
 import {AdminDebugHttpPage} from '../pages/AdminDebugHttpPage';
 import {AdminDatabaseTablesPage} from '../pages/AdminDatabaseTablesPage';
@@ -37,7 +38,12 @@ import {AdminTrackingEventsPage} from '../pages/AdminTrackingEventsPage';
 import {AdminWorkVisibilityPage} from '../pages/AdminWorkVisibilityPage';
 import {AdminShell} from './AdminShell';
 import type {AdminRouteId} from './adminRoutes';
-import {resolveAdminRoute, routeHash} from './adminRoutes';
+import {
+  getAccessibleAdminRoutes,
+  resolveAccessibleAdminRoute,
+  resolveAdminRoute,
+  routeHash,
+} from './adminRoutes';
 
 type SessionStatus = 'checking' | 'guest' | 'authenticated';
 
@@ -55,6 +61,13 @@ export function AdminApp() {
     useState<ProfileWalletConfigAdminResponse | null>(null);
   const [rechargeProductResult, setRechargeProductResult] =
     useState<ProfileRechargeProductConfigAdminResponse | null>(null);
+  const accessibleRoutes = useMemo(
+    () => (admin ? getAccessibleAdminRoutes(admin) : []),
+    [admin],
+  );
+  const activeRouteId = accessibleRoutes.some((route) => route.id === routeId)
+    ? routeId
+    : null;
 
   const clearSession = useCallback((message = '') => {
     clearStoredAdminToken();
@@ -107,6 +120,26 @@ export function AdminApp() {
     };
   }, []);
 
+  useEffect(() => {
+    if (status !== 'authenticated' || !admin) {
+      return;
+    }
+
+    const nextRouteId = resolveAccessibleAdminRoute(
+      window.location.hash,
+      accessibleRoutes,
+    );
+    if (!nextRouteId) {
+      return;
+    }
+
+    setRouteId(nextRouteId);
+    const nextHash = routeHash(nextRouteId);
+    if (window.location.hash !== nextHash) {
+      window.history.replaceState(null, '', nextHash);
+    }
+  }, [accessibleRoutes, admin, routeId, status]);
+
   useEffect(() => {
     const handleHashChange = () => {
       setRouteId(resolveAdminRoute(window.location.hash));
@@ -163,69 +196,75 @@ export function AdminApp() {
   return (
     <AdminShell
       admin={admin}
-      routeId={routeId}
+      routeId={activeRouteId}
+      routes={accessibleRoutes}
       onLogout={handleLogout}
       onRouteChange={handleRouteChange}
     >
-      {routeId === 'dashboard' ? (
+      {activeRouteId === null ? (
+        <section className="admin-panel admin-zero-permission-state">
+          <h2>暂无访问权限</h2>
+        </section>
+      ) : null}
+      {activeRouteId === 'dashboard' ? (
         <AdminDashboardPage token={token} onUnauthorized={handleUnauthorized} />
       ) : null}
-      {routeId === 'overview' ? (
+      {activeRouteId === 'overview' ? (
         <AdminOverviewPage token={token} onUnauthorized={handleUnauthorized} />
       ) : null}
-      {routeId === 'tables' ? (
+      {activeRouteId === 'tables' ? (
         <AdminDatabaseTablesPage
           token={token}
           onUnauthorized={handleUnauthorized}
         />
       ) : null}
-      {routeId === 'debug' ? (
+      {activeRouteId === 'debug' ? (
         <AdminDebugHttpPage token={token} onUnauthorized={handleUnauthorized} />
       ) : null}
-      {routeId === 'tracking' ? (
+      {activeRouteId === 'tracking' ? (
         <AdminTrackingEventsPage
           token={token}
           onUnauthorized={handleUnauthorized}
         />
       ) : null}
-      {routeId === 'gray-release' ? (
+      {activeRouteId === 'gray-release' ? (
         <AdminGrayReleaseConfigPage
           token={token}
           onUnauthorized={handleUnauthorized}
         />
       ) : null}
-      {routeId === 'redeem' ? (
+      {activeRouteId === 'redeem' ? (
         <AdminRedeemCodePage
           token={token}
           onUnauthorized={handleUnauthorized}
         />
       ) : null}
-      {routeId === 'invite' ? (
+      {activeRouteId === 'invite' ? (
         <AdminInviteCodePage
           token={token}
           onUnauthorized={handleUnauthorized}
         />
       ) : null}
-      {routeId === 'creation-announcement' ? (
+      {activeRouteId === 'creation-announcement' ? (
         <AdminCreationEntrySwitchPage
           mode="announcements"
           token={token}
           onUnauthorized={handleUnauthorized}
         />
       ) : null}
-      {routeId === 'creation-entry' ? (
+      {activeRouteId === 'creation-entry' ? (
         <AdminCreationEntrySwitchPage
           token={token}
           onUnauthorized={handleUnauthorized}
         />
       ) : null}
-      {routeId === 'work-visibility' ? (
+      {activeRouteId === 'work-visibility' ? (
         <AdminWorkVisibilityPage
           token={token}
           onUnauthorized={handleUnauthorized}
         />
       ) : null}
-      {routeId === 'tasks' ? (
+      {activeRouteId === 'tasks' ? (
         <AdminTaskConfigPage
           result={taskConfigResult}
           token={token}
@@ -233,7 +272,7 @@ export function AdminApp() {
           onResultChange={setTaskConfigResult}
         />
       ) : null}
-      {routeId === 'profile-wallet' ? (
+      {activeRouteId === 'profile-wallet' ? (
         <AdminProfileWalletConfigPage
           result={profileWalletConfigResult}
           token={token}
@@ -241,7 +280,7 @@ export function AdminApp() {
           onResultChange={setProfileWalletConfigResult}
         />
       ) : null}
-      {routeId === 'recharge-products' ? (
+      {activeRouteId === 'recharge-products' ? (
         <AdminRechargeProductPage
           result={rechargeProductResult}
           token={token}
@@ -249,30 +288,36 @@ export function AdminApp() {
           onResultChange={setRechargeProductResult}
         />
       ) : null}
-      {routeId === 'recharge-orders' ? (
+      {activeRouteId === 'recharge-orders' ? (
         <AdminRechargeOrderPage
           token={token}
           onUnauthorized={handleUnauthorized}
         />
       ) : null}
-      {routeId === 'editor-generation-pricing' ? (
+      {activeRouteId === 'editor-generation-pricing' ? (
         <AdminEditorGenerationPricingPage
           token={token}
           onUnauthorized={handleUnauthorized}
         />
       ) : null}
-      {routeId === 'editor-showcase' ? (
+      {activeRouteId === 'editor-showcase' ? (
         <AdminEditorShowcaseReviewPage
           token={token}
           onUnauthorized={handleUnauthorized}
         />
       ) : null}
-      {routeId === 'editor-assets' ? (
+      {activeRouteId === 'editor-assets' ? (
         <AdminEditorAssetQueryPage
           token={token}
           onUnauthorized={handleUnauthorized}
         />
       ) : null}
+      {activeRouteId === 'accounts' ? (
+        <AdminAccountsPage
+          token={token}
+          onUnauthorized={handleUnauthorized}
+        />
+      ) : null}
     </AdminShell>
   );
 }
diff --git a/apps/admin-web/src/app/AdminShell.tsx b/apps/admin-web/src/app/AdminShell.tsx
index 557b1f42a..12c050fab 100644
--- a/apps/admin-web/src/app/AdminShell.tsx
+++ b/apps/admin-web/src/app/AdminShell.tsx
@@ -19,16 +19,17 @@ import {
   TicketCheck,
   TicketPercent,
   ReceiptText,
+  Users,
 } from 'lucide-react';
 import type {ReactNode} from 'react';
 
 import type {AdminSessionPayload} from '../api/adminApiTypes';
-import type {AdminRouteId} from './adminRoutes';
-import {adminRoutes} from './adminRoutes';
+import type {AdminRouteDefinition, AdminRouteId} from './adminRoutes';
 
 interface AdminShellProps {
   admin: AdminSessionPayload;
-  routeId: AdminRouteId;
+  routeId: AdminRouteId | null;
+  routes: AdminRouteDefinition[];
   children: ReactNode;
   onRouteChange: (routeId: AdminRouteId) => void;
   onLogout: () => void;
@@ -53,11 +54,13 @@ const routeIcons = {
   'creation-announcement': Megaphone,
   'creation-entry': SlidersHorizontal,
   'work-visibility': Eye,
+  accounts: Users,
 } satisfies Record<AdminRouteId, typeof LayoutDashboard>;
 
 export function AdminShell({
   admin,
   routeId,
+  routes,
   children,
   onRouteChange,
   onLogout,
@@ -76,7 +79,7 @@ export function AdminShell({
         </div>
 
         <nav className="admin-nav" aria-label="后台导航">
-          {adminRoutes.map((route) => {
+          {routes.map((route) => {
             const Icon = routeIcons[route.id];
             return (
               <button
@@ -99,7 +102,7 @@ export function AdminShell({
         <header className="admin-topbar">
           <div className="admin-user">
             <span>{admin.displayName || admin.username}</span>
-            <small>{admin.roles.join(' / ')}</small>
+            <small>{admin.accountRole === 'owner' ? 'owner' : 'member'}</small>
           </div>
           <button
             className="admin-icon-button"
@@ -116,7 +119,7 @@ export function AdminShell({
       </div>
 
       <nav className="admin-bottom-nav" aria-label="后台导航">
-        {adminRoutes.map((route) => {
+        {routes.map((route) => {
           const Icon = routeIcons[route.id];
           return (
             <button
diff --git a/apps/admin-web/src/app/adminRoutes.test.ts b/apps/admin-web/src/app/adminRoutes.test.ts
index f1f6fbd73..b82a15c53 100644
--- a/apps/admin-web/src/app/adminRoutes.test.ts
+++ b/apps/admin-web/src/app/adminRoutes.test.ts
@@ -1,6 +1,12 @@
 import {expect, test} from 'vitest';
 
-import {adminRoutes, resolveAdminRoute, routeHash} from './adminRoutes';
+import {
+  adminRoutes,
+  getAccessibleAdminRoutes,
+  resolveAccessibleAdminRoute,
+  resolveAdminRoute,
+  routeHash,
+} from './adminRoutes';
 
 test('后台默认进入 Dashboard', () => {
   expect(adminRoutes[0]).toEqual({
@@ -79,3 +85,36 @@ test('后台充值管理路由可通过导航和 hash 访问', () => {
   expect(resolveAdminRoute('#recharge-orders')).toBe('recharge-orders');
   expect(routeHash('recharge-orders')).toBe('#recharge-orders');
 });
+
+test('owner 可访问全部业务 Tab 和账号管理', () => {
+  const routes = getAccessibleAdminRoutes({
+    accountRole: 'owner',
+    tabPermissions: [],
+  });
+  expect(routes).toEqual(adminRoutes);
+  expect(routes.at(-1)).toMatchObject({id: 'accounts', ownerOnly: true});
+});
+
+test('member 只访问已分配 Tab 且无权 hash 回落到第一项', () => {
+  const routes = getAccessibleAdminRoutes({
+    accountRole: 'member',
+    tabPermissions: ['tracking', 'recharge-orders'],
+  });
+  expect(routes.map((route) => route.id)).toEqual([
+    'tracking',
+    'recharge-orders',
+  ]);
+  expect(resolveAccessibleAdminRoute('#accounts', routes)).toBe('tracking');
+  expect(resolveAccessibleAdminRoute('#recharge-orders', routes)).toBe(
+    'recharge-orders',
+  );
+});
+
+test('零权限 member 不回落到 Dashboard', () => {
+  const routes = getAccessibleAdminRoutes({
+    accountRole: 'member',
+    tabPermissions: [],
+  });
+  expect(routes).toEqual([]);
+  expect(resolveAccessibleAdminRoute('#dashboard', routes)).toBeNull();
+});
diff --git a/apps/admin-web/src/app/adminRoutes.ts b/apps/admin-web/src/app/adminRoutes.ts
index 550065503..e87b3dd8d 100644
--- a/apps/admin-web/src/app/adminRoutes.ts
+++ b/apps/admin-web/src/app/adminRoutes.ts
@@ -17,13 +17,17 @@ export type AdminRouteId =
   | 'editor-assets'
   | 'creation-announcement'
   | 'creation-entry'
-  | 'work-visibility';
+  | 'work-visibility'
+  | 'accounts';
+
+export type AdminTabPermission = Exclude<AdminRouteId, 'accounts'>;
 
 /** 后台导航项定义，hash 是浏览器地址栏和移动底栏共用入口。 */
 export interface AdminRouteDefinition {
   id: AdminRouteId;
   label: string;
   hash: string;
+  ownerOnly?: boolean;
 }
 
 export const adminRoutes: AdminRouteDefinition[] = [
@@ -45,8 +49,39 @@ export const adminRoutes: AdminRouteDefinition[] = [
   {id: 'creation-announcement', label: '入口公告', hash: '#creation-announcement'},
   {id: 'creation-entry', label: '入口开关', hash: '#creation-entry'},
   {id: 'work-visibility', label: '作品可见性', hash: '#work-visibility'},
+  {id: 'accounts', label: '账号管理', hash: '#accounts', ownerOnly: true},
 ];
 
+export interface AdminRouteAccess {
+  accountRole: 'owner' | 'member';
+  tabPermissions: string[];
+}
+
+export function getAccessibleAdminRoutes(
+  admin: AdminRouteAccess,
+): AdminRouteDefinition[] {
+  if (admin.accountRole === 'owner') {
+    return adminRoutes;
+  }
+
+  const permissions = new Set(admin.tabPermissions);
+  return adminRoutes.filter(
+    (route) => !route.ownerOnly && permissions.has(route.id),
+  );
+}
+
+export function resolveAccessibleAdminRoute(
+  hash: string,
+  routes: AdminRouteDefinition[],
+): AdminRouteId | null {
+  const normalizedHash = hash.trim().toLowerCase().split('?')[0] ?? '';
+  return (
+    routes.find((route) => route.hash === normalizedHash)?.id ??
+    routes[0]?.id ??
+    null
+  );
+}
+
 /** 根据地址栏 hash 解析后台路由，未知 hash 回落到 Dashboard。 */
 export function resolveAdminRoute(hash: string): AdminRouteId {
   const normalizedHash = hash.trim().toLowerCase().split('?')[0] ?? '';
diff --git a/apps/admin-web/src/components/AdminUserDetailDialog.test.tsx b/apps/admin-web/src/components/AdminUserDetailDialog.test.tsx
index 719cefca1..341c6f0e7 100644
--- a/apps/admin-web/src/components/AdminUserDetailDialog.test.tsx
+++ b/apps/admin-web/src/components/AdminUserDetailDialog.test.tsx
@@ -146,8 +146,10 @@ test('人工冻结和解除人工冻结分别提交原因且不解除退款欠
       frozen: true,
       reason: '风险核查',
       createdByAdminUserId: 'admin:root',
+      createdByAdminDisplayName: '后台负责人',
       createdAtMicros: 1_720_000_000_000_000,
       updatedByAdminUserId: 'admin:root',
+      updatedByAdminDisplayName: '后台负责人',
       updatedAtMicros: 1_720_000_000_000_000,
     },
   };
@@ -174,6 +176,8 @@ test('人工冻结和解除人工冻结分别提交原因且不解除退款欠
       reason: '异常登录',
     });
   });
+  expect(await screen.findByText(/后台负责人/)).toBeTruthy();
+  expect(screen.queryByText(/admin:root/)).toBeNull();
 
   expect(await screen.findByText('解除人工冻结后，退款欠账限制仍会保留。')).toBeTruthy();
   await user.type(screen.getByRole('textbox', {name: '人工冻结操作原因'}), '核查完成');
diff --git a/apps/admin-web/src/components/AdminUserDetailDialog.tsx b/apps/admin-web/src/components/AdminUserDetailDialog.tsx
index 80e513349..e966378d5 100644
--- a/apps/admin-web/src/components/AdminUserDetailDialog.tsx
+++ b/apps/admin-web/src/components/AdminUserDetailDialog.tsx
@@ -236,7 +236,7 @@ export function AdminUserDetailDialog({
                   <span>{detail.wallet.manualRestriction.reason || '未填写原因'}</span>
                   <small>
                     {formatMicros(detail.wallet.manualRestriction.updatedAtMicros)} /{' '}
-                    {detail.wallet.manualRestriction.updatedByAdminUserId}
+                    {detail.wallet.manualRestriction.updatedByAdminDisplayName}
                   </small>
                 </div>
               ) : null}
diff --git a/apps/admin-web/src/pages/AdminAccountsPage.tsx b/apps/admin-web/src/pages/AdminAccountsPage.tsx
new file mode 100644
index 000000000..0403d2d18
--- /dev/null
+++ b/apps/admin-web/src/pages/AdminAccountsPage.tsx
@@ -0,0 +1,305 @@
+import {Plus, RefreshCcw, Save} from 'lucide-react';
+import {type FormEvent, useEffect, useState} from 'react';
+
+import {
+  createAdminAccount,
+  listAdminAccounts,
+  updateAdminAccount,
+} from '../api/adminApiClient';
+import type {AdminAccountPayload} from '../api/adminApiTypes';
+import {adminRoutes} from '../app/adminRoutes';
+import {useAdminWriteConfirm} from '../components/useAdminWriteConfirm';
+import {handlePageError} from './pageUtils';
+
+interface AdminAccountsPageProps {
+  token: string;
+  onUnauthorized: (message?: string) => void;
+}
+
+const assignableRoutes = adminRoutes.filter((route) => !route.ownerOnly);
+
+export function AdminAccountsPage({
+  token,
+  onUnauthorized,
+}: AdminAccountsPageProps) {
+  const [accounts, setAccounts] = useState<AdminAccountPayload[]>([]);
+  const [selectedAccountId, setSelectedAccountId] = useState('');
+  const [username, setUsername] = useState('');
+  const [displayName, setDisplayName] = useState('');
+  const [password, setPassword] = useState('');
+  const [enabled, setEnabled] = useState(true);
+  const [tabPermissions, setTabPermissions] = useState<string[]>([]);
+  const [isLoading, setIsLoading] = useState(false);
+  const [isSaving, setIsSaving] = useState(false);
+  const [errorMessage, setErrorMessage] = useState('');
+  const {confirmWrite, confirmDialog} = useAdminWriteConfirm();
+
+  useEffect(() => {
+    void refreshAccounts();
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [token]);
+
+  async function refreshAccounts() {
+    setIsLoading(true);
+    setErrorMessage('');
+    try {
+      const response = await listAdminAccounts(token);
+      setAccounts(response.accounts);
+      const selected = response.accounts.find(
+        (account) => account.accountId === selectedAccountId,
+      );
+      if (selected) {
+        fillForm(selected);
+      }
+    } catch (error: unknown) {
+      handlePageError(error, onUnauthorized, setErrorMessage);
+    } finally {
+      setIsLoading(false);
+    }
+  }
+
+  function startCreate() {
+    setSelectedAccountId('');
+    setUsername('');
+    setDisplayName('');
+    setPassword('');
+    setEnabled(true);
+    setTabPermissions([]);
+    setErrorMessage('');
+  }
+
+  function fillForm(account: AdminAccountPayload) {
+    setSelectedAccountId(account.accountId);
+    setUsername(account.username);
+    setDisplayName(account.displayName);
+    setPassword('');
+    setEnabled(account.enabled);
+    setTabPermissions(account.tabPermissions);
+    setErrorMessage('');
+  }
+
+  function togglePermission(permission: string, checked: boolean) {
+    setTabPermissions((current) =>
+      checked
+        ? assignableRoutes
+            .map((route) => route.id)
+            .filter((routeId) =>
+              routeId === permission || current.includes(routeId),
+            )
+        : current.filter((item) => item !== permission),
+    );
+  }
+
+  async function handleSave(event: FormEvent<HTMLFormElement>) {
+    event.preventDefault();
+    if (isSaving) {
+      return;
+    }
+
+    const normalizedUsername = username.trim();
+    const normalizedDisplayName = displayName.trim();
+    if (!selectedAccountId && !normalizedUsername) {
+      setErrorMessage('请输入用户名');
+      return;
+    }
+    if (!normalizedDisplayName) {
+      setErrorMessage('请输入显示名称');
+      return;
+    }
+    if (!selectedAccountId && !password) {
+      setErrorMessage('请输入密码');
+      return;
+    }
+
+    const confirmed = await confirmWrite({
+      action: selectedAccountId ? '更新后台账号' : '创建后台账号',
+      target: normalizedUsername,
+    });
+    if (!confirmed) {
+      return;
+    }
+
+    setIsSaving(true);
+    setErrorMessage('');
+    try {
+      const response = selectedAccountId
+        ? await updateAdminAccount(token, selectedAccountId, {
+            displayName: normalizedDisplayName,
+            ...(password ? {password} : {}),
+            tabPermissions,
+            enabled,
+          })
+        : await createAdminAccount(token, {
+            username: normalizedUsername,
+            displayName: normalizedDisplayName,
+            password,
+            tabPermissions,
+            enabled,
+          });
+      setAccounts((current) => {
+        const rest = current.filter(
+          (account) => account.accountId !== response.account.accountId,
+        );
+        return [...rest, response.account].sort((left, right) =>
+          left.username.localeCompare(right.username),
+        );
+      });
+      fillForm(response.account);
+    } catch (error: unknown) {
+      handlePageError(error, onUnauthorized, setErrorMessage);
+    } finally {
+      setIsSaving(false);
+    }
+  }
+
+  return (
+    <section className="admin-page admin-page-wide">
+      <div className="admin-page-heading">
+        <div>
+          <h2>账号管理</h2>
+          <p>后台成员</p>
+        </div>
+        <div className="admin-action-row">
+          <button
+            className="admin-secondary-button"
+            type="button"
+            onClick={startCreate}
+          >
+            <Plus size={17} aria-hidden="true" />
+            <span>添加账号</span>
+          </button>
+          <button
+            className="admin-secondary-button"
+            disabled={isLoading}
+            type="button"
+            onClick={refreshAccounts}
+          >
+            <RefreshCcw size={17} aria-hidden="true" />
+            <span>{isLoading ? '刷新中' : '刷新'}</span>
+          </button>
+        </div>
+      </div>
+
+      {errorMessage ? (
+        <div className="admin-alert" role="status">
+          {errorMessage}
+        </div>
+      ) : null}
+
+      <div className="admin-accounts-layout">
+        <section className="admin-panel admin-account-list">
+          <div className="admin-panel-heading">
+            <h3>后台账号</h3>
+            <span>{accounts.length}</span>
+          </div>
+          {accounts.length ? (
+            <div className="admin-account-list-items">
+              {accounts.map((account) => (
+                <button
+                  data-active={account.accountId === selectedAccountId}
+                  disabled={account.accountRole === 'owner'}
+                  key={account.accountId}
+                  title={account.accountRole === 'owner' ? 'owner' : account.username}
+                  type="button"
+                  onClick={() => {
+                    if (account.accountRole === 'member') {
+                      fillForm(account);
+                    }
+                  }}
+                >
+                  <span>
+                    <strong>{account.displayName || account.username}</strong>
+                    <small>{account.username}</small>
+                  </span>
+                  <small>
+                    {account.accountRole === 'owner'
+                      ? 'owner'
+                      : account.enabled
+                        ? '启用'
+                        : '停用'}
+                  </small>
+                </button>
+              ))}
+            </div>
+          ) : (
+            <div className="admin-empty-state">
+              {isLoading ? '加载中' : '暂无成员账号'}
+            </div>
+          )}
+        </section>
+
+        <form className="admin-panel admin-form" onSubmit={handleSave}>
+          <div className="admin-panel-heading">
+            <h3>{selectedAccountId ? '编辑账号' : '添加账号'}</h3>
+            <label className="admin-switch-field">
+              <input
+                checked={enabled}
+                type="checkbox"
+                onChange={(event) => setEnabled(event.target.checked)}
+              />
+              <span>启用</span>
+            </label>
+          </div>
+
+          <div className="admin-form-row">
+            <label className="admin-field">
+              <span>用户名</span>
+              <input
+                disabled={Boolean(selectedAccountId)}
+                autoComplete="off"
+                value={username}
+                onChange={(event) => setUsername(event.target.value)}
+              />
+            </label>
+            <label className="admin-field">
+              <span>显示名称</span>
+              <input
+                value={displayName}
+                onChange={(event) => setDisplayName(event.target.value)}
+              />
+            </label>
+          </div>
+
+          <label className="admin-field">
+            <span>{selectedAccountId ? '新密码' : '密码'}</span>
+            <input
+              autoComplete="new-password"
+              placeholder={selectedAccountId ? '不修改' : ''}
+              type="password"
+              value={password}
+              onChange={(event) => setPassword(event.target.value)}
+            />
+          </label>
+
+          <fieldset className="admin-permission-fieldset">
+            <legend>Tab 访问权限</legend>
+            <div className="admin-permission-grid">
+              {assignableRoutes.map((route) => (
+                <label key={route.id}>
+                  <input
+                    checked={tabPermissions.includes(route.id)}
+                    type="checkbox"
+                    onChange={(event) =>
+                      togglePermission(route.id, event.target.checked)
+                    }
+                  />
+                  <span>{route.label}</span>
+                </label>
+              ))}
+            </div>
+          </fieldset>
+
+          <button
+            className="admin-primary-button"
+            disabled={isSaving}
+            type="submit"
+          >
+            <Save size={17} aria-hidden="true" />
+            <span>{isSaving ? '保存中' : '保存'}</span>
+          </button>
+        </form>
+      </div>
+      {confirmDialog}
+    </section>
+  );
+}
diff --git a/apps/admin-web/src/pages/AdminDashboardPage.test.tsx b/apps/admin-web/src/pages/AdminDashboardPage.test.tsx
index 2c5164ecf..e8aa77b61 100644
--- a/apps/admin-web/src/pages/AdminDashboardPage.test.tsx
+++ b/apps/admin-web/src/pages/AdminDashboardPage.test.tsx
@@ -1,6 +1,12 @@
 /* @vitest-environment jsdom */
 
-import { fireEvent, render, screen, waitFor } from '@testing-library/react';
+import {
+  fireEvent,
+  render,
+  screen,
+  waitFor,
+  within,
+} from '@testing-library/react';
 import userEvent from '@testing-library/user-event';
 import { afterEach, beforeEach, expect, test, vi } from 'vitest';
 
@@ -29,6 +35,21 @@ const dashboardResponse: AdminDashboardResponse = {
     consumedMudPoints: 88,
     totalRegisteredUsers: 1200,
     newRegisteredUsers: 16,
+    newUserPaymentConversion: {
+      paidUsers: 5,
+      newRegisteredUsers: 16,
+      rateBasisPoints: 3125,
+    },
+    day1Retention: {
+      eligibleUsers: 12,
+      retainedUsers: 3,
+      rateBasisPoints: 2500,
+    },
+    day7Retention: {
+      eligibleUsers: 0,
+      retainedUsers: 0,
+      rateBasisPoints: 0,
+    },
     visitUsers: 34,
     totalVisitUsers: 456,
     visitCount: 98,
@@ -41,7 +62,10 @@ const dashboardResponse: AdminDashboardResponse = {
       title: '生产素材',
       unit: '个',
       total: 12,
-      buckets: [{ key: '2026-06-23', label: '2026-06-23', value: 12 }],
+      buckets: [
+        { key: '2026-06-23', label: '2026-06-23', value: 12 },
+        { key: '2026-06-24', label: '2026-06-24', value: 0 },
+      ],
     },
   ],
   operations: {
@@ -82,8 +106,34 @@ test('Dashboard 默认加载今日指标并支持运营汇总页签', async () =
   expect(screen.getByText('本日生产素材数')).toBeTruthy();
   expect(screen.getByText('总注册用户')).toBeTruthy();
   expect(screen.getByText('本日新增用户数')).toBeTruthy();
-  expect(screen.getByText('当前使用人数（五分钟统计一次）')).toBeTruthy();
+  expect(screen.getByText('新增用户转化与留存')).toBeTruthy();
+  const paymentRateCard = screen
+    .getByText('本日新增用户付费率')
+    .closest('article');
+  expect(paymentRateCard).toBeTruthy();
+  expect(
+    within(paymentRateCard as HTMLElement).getByText('31.25%'),
+  ).toBeTruthy();
+  expect(
+    within(paymentRateCard as HTMLElement).getByText('付费人数 / 新增人数'),
+  ).toBeTruthy();
+  expect(
+    within(paymentRateCard as HTMLElement).getByText('5 / 16 人'),
+  ).toBeTruthy();
+  expect(screen.getByText('次日留存')).toBeTruthy();
+  expect(screen.getByText('25%')).toBeTruthy();
+  expect(screen.getByText('3 / 12 人')).toBeTruthy();
+  const day7Card = screen.getByText('七日留存').closest('article');
+  expect(day7Card).toBeTruthy();
+  expect(within(day7Card as HTMLElement).getByText('-')).toBeTruthy();
+  expect(within(day7Card as HTMLElement).getByText('0 / 0 人')).toBeTruthy();
+  expect(screen.getByText('近 5 分钟活跃用户')).toBeTruthy();
   expect(screen.getByText('生产素材')).toBeTruthy();
+  expect(
+    screen
+      .getByTitle('2026-06-24: 0 个')
+      .firstElementChild?.getAttribute('style'),
+  ).toContain('height: 0%');
   expect(screen.queryByRole('button', { name: '本时段' })).toBeNull();
 
   await user.click(screen.getByRole('button', { name: '运营汇总' }));
@@ -108,7 +158,7 @@ test('Dashboard 默认日期使用北京时间', async () => {
   });
 });
 
-test('Dashboard 选择本周时按今天填充整周范围', async () => {
+test('Dashboard 选择本周时按北京时间今天截断未来日期', async () => {
   const user = setupUser();
   render(<AdminDashboardPage token="admin-token" onUnauthorized={vi.fn()} />);
 
@@ -123,12 +173,12 @@ test('Dashboard 选择本周时按今天填充整周范围', async () => {
       granularity: 'period',
       anchor: undefined,
       startDate: '2026-06-22',
-      endDate: '2026-06-28',
+      endDate: '2026-06-27',
     });
   });
 });
 
-test('Dashboard 选择本月时按今天填充整月范围', async () => {
+test('Dashboard 选择本月时按北京时间今天截断未来日期', async () => {
   const user = setupUser();
   render(<AdminDashboardPage token="admin-token" onUnauthorized={vi.fn()} />);
 
@@ -143,7 +193,7 @@ test('Dashboard 选择本月时按今天填充整月范围', async () => {
       granularity: 'period',
       anchor: undefined,
       startDate: '2026-06-01',
-      endDate: '2026-06-30',
+      endDate: '2026-06-27',
     });
   });
 });
@@ -186,8 +236,136 @@ test('Dashboard 手动选择起止日期时使用本时段查询', async () => {
     });
   });
   expect(screen.getByText('本时段新增用户数')).toBeTruthy();
+  expect(screen.getByText('本时段新增用户付费率')).toBeTruthy();
+});
+
+test('Dashboard 新增用户付费率分母为零时显示横线', async () => {
+  vi.mocked(getAdminDashboard).mockResolvedValue({
+    ...dashboardResponse,
+    metrics: {
+      ...dashboardResponse.metrics,
+      newRegisteredUsers: 0,
+      newUserPaymentConversion: {
+        paidUsers: 0,
+        newRegisteredUsers: 0,
+        rateBasisPoints: 0,
+      },
+    },
+  });
+
+  render(<AdminDashboardPage token="admin-token" onUnauthorized={vi.fn()} />);
+
+  const paymentRateCard = (
+    await screen.findByText('本日新增用户付费率')
+  ).closest('article');
+  expect(paymentRateCard).toBeTruthy();
+  expect(within(paymentRateCard as HTMLElement).getByText('-')).toBeTruthy();
+  expect(
+    within(paymentRateCard as HTMLElement).getByText('0 / 0 人'),
+  ).toBeTruthy();
+});
+
+test('Dashboard 手动选择日期时不允许查询北京时间今天之后', async () => {
+  render(<AdminDashboardPage token="admin-token" onUnauthorized={vi.fn()} />);
+
+  await screen.findByText('本日生产素材数');
+  const endDateInput = screen.getByLabelText('终止日期') as HTMLInputElement;
+  expect(endDateInput.max).toBe('2026-06-27');
+
+  fireEvent.change(endDateInput, { target: { value: '2026-07-12' } });
+
+  await waitFor(() => {
+    expect(endDateInput.value).toBe('2026-06-27');
+    expect(getAdminDashboard).toHaveBeenLastCalledWith('admin-token', {
+      granularity: 'period',
+      anchor: undefined,
+      startDate: '2026-06-27',
+      endDate: '2026-06-27',
+    });
+  });
+});
+
+test('Dashboard 四张趋势图共享横向日期窗口', async () => {
+  const baseChart = dashboardResponse.charts[0]!;
+  vi.mocked(getAdminDashboard).mockResolvedValue({
+    ...dashboardResponse,
+    charts: [
+      baseChart,
+      {
+        ...baseChart,
+        id: 'consumed-mud-points',
+        title: '消耗泥点',
+        unit: '泥点',
+      },
+    ],
+  });
+  render(<AdminDashboardPage token="admin-token" onUnauthorized={vi.fn()} />);
+
+  const chartRegions = await screen.findAllByRole('region', {
+    name: /趋势图$/,
+  });
+  const [sourceChart, targetChart] = chartRegions;
+  if (!sourceChart || !targetChart) {
+    throw new Error('趋势图未完整渲染');
+  }
+  setScrollableDimensions(sourceChart, {
+    clientWidth: 100,
+    scrollWidth: 500,
+    scrollLeft: 200,
+  });
+  setScrollableDimensions(targetChart, {
+    clientWidth: 100,
+    scrollWidth: 500,
+    scrollLeft: 0,
+  });
+
+  fireEvent.scroll(sourceChart);
+
+  await waitFor(() => {
+    expect(targetChart.scrollLeft).toBe(200);
+  });
+});
+
+test('Dashboard 访问人数趋势明确区分每日桶与时段去重总数', async () => {
+  const baseChart = dashboardResponse.charts[0]!;
+  vi.mocked(getAdminDashboard).mockResolvedValue({
+    ...dashboardResponse,
+    charts: [
+      {
+        ...baseChart,
+        id: 'visit-users',
+        title: '每日访问人数',
+        unit: '人',
+        total: 34,
+      },
+    ],
+  });
+
+  render(<AdminDashboardPage token="admin-token" onUnauthorized={vi.fn()} />);
+
+  expect(await screen.findByText('每日访问人数')).toBeTruthy();
+  expect(screen.getByText('时段去重 34 人')).toBeTruthy();
 });
 
 function setupUser() {
   return userEvent.setup({ advanceTimers: vi.advanceTimersByTime });
 }
+
+function setScrollableDimensions(
+  element: HTMLElement,
+  dimensions: {
+    clientWidth: number;
+    scrollWidth: number;
+    scrollLeft: number;
+  },
+) {
+  Object.defineProperties(element, {
+    clientWidth: { configurable: true, value: dimensions.clientWidth },
+    scrollWidth: { configurable: true, value: dimensions.scrollWidth },
+    scrollLeft: {
+      configurable: true,
+      value: dimensions.scrollLeft,
+      writable: true,
+    },
+  });
+}
diff --git a/apps/admin-web/src/pages/AdminDashboardPage.tsx b/apps/admin-web/src/pages/AdminDashboardPage.tsx
index d4f393504..933abf45a 100644
--- a/apps/admin-web/src/pages/AdminDashboardPage.tsx
+++ b/apps/admin-web/src/pages/AdminDashboardPage.tsx
@@ -1,5 +1,5 @@
 import { RefreshCw } from 'lucide-react';
-import { useCallback, useEffect, useMemo, useState } from 'react';
+import { useCallback, useEffect, useMemo, useRef, useState } from 'react';
 
 import { getAdminDashboard } from '../api/adminApiClient';
 import type {
@@ -42,24 +42,29 @@ export function AdminDashboardPage({
   const [activeTab, setActiveTab] = useState<AdminDashboardTab>('metrics');
   const [errorMessage, setErrorMessage] = useState('');
   const [isLoading, setIsLoading] = useState(false);
+  const [chartScrollLeft, setChartScrollLeft] = useState(0);
+  const today = formatBeijingDateInput(new Date());
 
-  const loadDashboard = useCallback(async (range = dateRange) => {
-    setIsLoading(true);
-    setErrorMessage('');
-    try {
-      const response = await getAdminDashboard(token, {
-        granularity: 'period',
-        anchor: undefined,
-        startDate: range.startDate,
-        endDate: range.endDate,
-      });
-      setDashboard(response);
-    } catch (error: unknown) {
-      handlePageError(error, onUnauthorized, setErrorMessage);
-    } finally {
-      setIsLoading(false);
-    }
-  }, [dateRange, onUnauthorized, token]);
+  const loadDashboard = useCallback(
+    async (range = dateRange) => {
+      setIsLoading(true);
+      setErrorMessage('');
+      try {
+        const response = await getAdminDashboard(token, {
+          granularity: 'period',
+          anchor: undefined,
+          startDate: range.startDate,
+          endDate: range.endDate,
+        });
+        setDashboard(response);
+      } catch (error: unknown) {
+        handlePageError(error, onUnauthorized, setErrorMessage);
+      } finally {
+        setIsLoading(false);
+      }
+    },
+    [dateRange, onUnauthorized, token],
+  );
 
   useEffect(() => {
     void loadDashboard();
@@ -75,6 +80,10 @@ export function AdminDashboardPage({
     return () => window.clearInterval(timer);
   }, [loadDashboard]);
 
+  useEffect(() => {
+    setChartScrollLeft(0);
+  }, [dashboard?.range.periodEndDate, dashboard?.range.periodStartDate]);
+
   const metrics = dashboard?.metrics;
   const totalMetricCards = useMemo(
     () => [
@@ -98,7 +107,7 @@ export function AdminDashboardPage({
       },
       {
         id: 'current-users',
-        label: '当前使用人数（五分钟统计一次）',
+        label: '近 5 分钟活跃用户',
         value: metrics?.currentUsers ?? 0,
         unit: '人',
       },
@@ -154,6 +163,7 @@ export function AdminDashboardPage({
               <span>起始日期</span>
               <input
                 type="date"
+                max={today}
                 value={dateRange.startDate}
                 onChange={(event) =>
                   handleDateRangeChange('startDate', event.target.value)
@@ -164,6 +174,7 @@ export function AdminDashboardPage({
               <span>终止日期</span>
               <input
                 type="date"
+                max={today}
                 value={dateRange.endDate}
                 onChange={(event) =>
                   handleDateRangeChange('endDate', event.target.value)
@@ -278,9 +289,51 @@ export function AdminDashboardPage({
             </div>
           </section>
 
+          <section className="admin-panel">
+            <div className="admin-panel-heading">
+              <h3>新增用户转化与留存</h3>
+              <span>{dashboard?.range.periodLabel ?? '-'}</span>
+            </div>
+            <div className="admin-dashboard-retention-grid">
+              <RateCard
+                label={`${rangePrefix(granularity)}新增用户付费率`}
+                numeratorLabel="付费人数"
+                denominatorLabel="新增人数"
+                numerator={metrics?.newUserPaymentConversion?.paidUsers}
+                denominator={
+                  metrics?.newUserPaymentConversion?.newRegisteredUsers
+                }
+                rateBasisPoints={
+                  metrics?.newUserPaymentConversion?.rateBasisPoints
+                }
+              />
+              <RateCard
+                label="次日留存"
+                numeratorLabel="留存人数"
+                denominatorLabel="可观察新增人数"
+                numerator={metrics?.day1Retention.retainedUsers}
+                denominator={metrics?.day1Retention.eligibleUsers}
+                rateBasisPoints={metrics?.day1Retention.rateBasisPoints}
+              />
+              <RateCard
+                label="七日留存"
+                numeratorLabel="留存人数"
+                denominatorLabel="可观察新增人数"
+                numerator={metrics?.day7Retention.retainedUsers}
+                denominator={metrics?.day7Retention.eligibleUsers}
+                rateBasisPoints={metrics?.day7Retention.rateBasisPoints}
+              />
+            </div>
+          </section>
+
           <div className="admin-dashboard-chart-grid">
             {(dashboard?.charts ?? []).map((chart) => (
-              <ChartPanel key={chart.id} chart={chart} />
+              <ChartPanel
+                key={chart.id}
+                chart={chart}
+                scrollLeft={chartScrollLeft}
+                onScrollLeftChange={setChartScrollLeft}
+              />
             ))}
             {dashboard && dashboard.charts.length === 0 ? (
               <div className="admin-empty-state">暂无图表</div>
@@ -347,9 +400,10 @@ export function AdminDashboardPage({
     if (!parseDateValueAsUtc(value)) {
       return;
     }
+    const clampedValue = value > today ? today : value;
     setGranularity('period');
     setDateRange((current) =>
-      normalizeDateRange({ ...current, [field]: value }),
+      normalizeDateRange({ ...current, [field]: clampedValue }),
     );
   }
 }
@@ -377,17 +431,85 @@ function MetricCard({
   );
 }
 
-function ChartPanel({ chart }: { chart: AdminDashboardChartPayload }) {
+function RateCard({
+  label,
+  numeratorLabel,
+  denominatorLabel,
+  numerator,
+  denominator,
+  rateBasisPoints,
+}: {
+  label: string;
+  numeratorLabel: string;
+  denominatorLabel: string;
+  numerator?: number;
+  denominator?: number;
+  rateBasisPoints?: number;
+}) {
+  const hasDenominator = Boolean(denominator);
+  return (
+    <article className="admin-dashboard-retention-card">
+      <span>{label}</span>
+      <strong>
+        {hasDenominator && rateBasisPoints !== undefined
+          ? formatRateBasisPoints(rateBasisPoints)
+          : '-'}
+      </strong>
+      <div>
+        <small>
+          {numeratorLabel} / {denominatorLabel}
+        </small>
+        <b>
+          {numerator !== undefined && denominator !== undefined
+            ? `${formatNumber(numerator)} / ${formatNumber(denominator)} 人`
+            : '-'}
+        </b>
+      </div>
+    </article>
+  );
+}
+
+function ChartPanel({
+  chart,
+  scrollLeft,
+  onScrollLeftChange,
+}: {
+  chart: AdminDashboardChartPayload;
+  scrollLeft: number;
+  onScrollLeftChange: (scrollLeft: number) => void;
+}) {
+  const barsRef = useRef<HTMLDivElement>(null);
   const maxValue = Math.max(1, ...chart.buckets.map((bucket) => bucket.value));
+
+  useEffect(() => {
+    const element = barsRef.current;
+    if (!element) {
+      return;
+    }
+    if (Math.abs(element.scrollLeft - scrollLeft) > 1) {
+      element.scrollLeft = scrollLeft;
+    }
+  }, [chart.buckets.length, scrollLeft]);
+
   return (
     <section className="admin-panel admin-dashboard-chart-card">
       <div className="admin-panel-heading">
         <h3>{chart.title}</h3>
         <span>
+          {chart.id === 'visit-users' ? '时段去重 ' : ''}
           {formatNumber(chart.total)} {chart.unit}
         </span>
       </div>
-      <div className="admin-dashboard-bars">
+      <div
+        ref={barsRef}
+        className="admin-dashboard-bars"
+        role="region"
+        aria-label={`${chart.title}趋势图`}
+        tabIndex={0}
+        onScroll={(event) => {
+          onScrollLeftChange(event.currentTarget.scrollLeft);
+        }}
+      >
         {chart.buckets.map((bucket) => (
           <div className="admin-dashboard-bar-item" key={bucket.key}>
             <div
@@ -396,7 +518,10 @@ function ChartPanel({ chart }: { chart: AdminDashboardChartPayload }) {
             >
               <span
                 style={{
-                  height: `${Math.max(4, (bucket.value / maxValue) * 100)}%`,
+                  height:
+                    bucket.value === 0
+                      ? '0%'
+                      : `${Math.max(4, (bucket.value / maxValue) * 100)}%`,
                 }}
               />
             </div>
@@ -450,6 +575,13 @@ function formatNumber(value: number) {
   return new Intl.NumberFormat('zh-CN').format(value);
 }
 
+function formatRateBasisPoints(value: number) {
+  return new Intl.NumberFormat('zh-CN', {
+    style: 'percent',
+    maximumFractionDigits: 2,
+  }).format(value / 10_000);
+}
+
 function formatBeijingDateInput(date: Date) {
   return new Intl.DateTimeFormat('en-CA', {
     timeZone: 'Asia/Shanghai',
@@ -498,9 +630,7 @@ function buildWeekDateRange(dateValue: string) {
   const weekday = date.getUTCDay() || 7;
   const monday = new Date(date);
   monday.setUTCDate(date.getUTCDate() - weekday + 1);
-  const sunday = new Date(monday);
-  sunday.setUTCDate(monday.getUTCDate() + 6);
-  return { startDate: formatUtcDate(monday), endDate: formatUtcDate(sunday) };
+  return { startDate: formatUtcDate(monday), endDate: dateValue };
 }
 
 function buildMonthDateRange(dateValue: string) {
@@ -512,12 +642,9 @@ function buildMonthDateRange(dateValue: string) {
   const firstDate = new Date(
     Date.UTC(date.getUTCFullYear(), date.getUTCMonth(), 1),
   );
-  const lastDate = new Date(
-    Date.UTC(date.getUTCFullYear(), date.getUTCMonth() + 1, 0),
-  );
   return {
     startDate: formatUtcDate(firstDate),
-    endDate: formatUtcDate(lastDate),
+    endDate: dateValue,
   };
 }
 
diff --git a/apps/admin-web/src/pages/AdminEditorAssetQueryPage.test.tsx b/apps/admin-web/src/pages/AdminEditorAssetQueryPage.test.tsx
index c0cca000c..5bd550cd3 100644
--- a/apps/admin-web/src/pages/AdminEditorAssetQueryPage.test.tsx
+++ b/apps/admin-web/src/pages/AdminEditorAssetQueryPage.test.tsx
@@ -15,10 +15,16 @@ import {
   getAdminAssetReadUrl,
   listAdminEditorAssets,
 } from '../api/adminApiClient';
-import type { AdminEditorAssetPayload } from '../api/adminApiTypes';
+import type {
+  AdminEditorAssetListResponse,
+  AdminEditorAssetPayload,
+} from '../api/adminApiTypes';
 import { AdminEditorAssetQueryPage } from './AdminEditorAssetQueryPage';
 
 vi.mock('../api/adminApiClient', () => ({
+  formatAdminApiError: vi.fn((error: unknown) =>
+    error instanceof Error ? error.message : '请求失败',
+  ),
   getAdminAssetReadUrl: vi.fn(),
   isAdminApiError: vi.fn(
     (error: unknown) =>
@@ -148,6 +154,10 @@ const generatedAsset: AdminEditorAssetPayload = {
   generationCostMudPoints: 12,
   createdAt: '2026-07-04T10:00:00Z',
   updatedAt: '2026-07-04T10:00:00Z',
+  generator: '角色抠图',
+  taskGenerator: '角色生成',
+  taskCostMudPoints: 12,
+  children: [],
 };
 
 beforeEach(() => {
@@ -182,6 +192,16 @@ function generatedAssetAt(index: number): AdminEditorAssetPayload {
   };
 }
 
+function createDeferred<T>() {
+  let resolve!: (value: T | PromiseLike<T>) => void;
+  let reject!: (reason?: unknown) => void;
+  const promise = new Promise<T>((resolvePromise, rejectPromise) => {
+    resolve = resolvePromise;
+    reject = rejectPromise;
+  });
+  return { promise, resolve, reject };
+}
+
 function thumbnailElementForLabel(label: string) {
   const row = screen.getByText(label).closest('tr');
   const thumbnail = row?.querySelector('.admin-asset-query-thumb');
@@ -211,8 +231,8 @@ test('后台素材查询按用户、搜索和时间调用查询接口', async ()
 
   await screen.findByRole('img', { name: '素材：角色形象 1' });
 
-  fireEvent.change(screen.getByLabelText('用户 ID'), {
-    target: { value: 'user-1' },
+  fireEvent.change(screen.getByLabelText('用户 ID / 陶泥号'), {
+    target: { value: 'SY-00000055' },
   });
   fireEvent.change(screen.getByLabelText('搜索'), {
     target: { value: '陶泥角色' },
@@ -225,16 +245,329 @@ test('后台素材查询按用户、搜索和时间调用查询接口', async ()
   });
 
   await waitFor(() => {
-    expect(listAdminEditorAssets).toHaveBeenLastCalledWith('admin-token', {
-      ownerUserId: 'user-1',
-      keyword: '陶泥角色',
-      createdAfter: '2026-07-01T00:00:00+08:00',
-      createdBefore: '2026-07-04T23:59:59.999+08:00',
-      limit: 80,
-    });
+    expect(listAdminEditorAssets).toHaveBeenLastCalledWith(
+      'admin-token',
+      {
+        ownerUserId: 'SY-00000055',
+        keyword: '陶泥角色',
+        createdAfter: '2026-07-01T00:00:00+08:00',
+        createdBefore: '2026-07-04T23:59:59.999+08:00',
+        limit: 80,
+      },
+      expect.anything(),
+    );
   });
 });
 
+test('后台素材查询逐字输入时只请求最终筛选值', async () => {
+  installIntersectionObserverMock();
+  render(
+    <AdminEditorAssetQueryPage token="admin-token" onUnauthorized={vi.fn()} />,
+  );
+
+  await screen.findByText('角色形象 1');
+  vi.mocked(listAdminEditorAssets).mockClear();
+  vi.useFakeTimers();
+  const ownerInput = screen.getByLabelText('用户 ID / 陶泥号');
+  const values = [
+    'S',
+    'SY',
+    'SY-',
+    'SY-0',
+    'SY-00',
+    'SY-000',
+    'SY-0000',
+    'SY-00000',
+    'SY-000000',
+    'SY-0000005',
+    'SY-00000055',
+  ];
+  for (const [index, value] of values.entries()) {
+    fireEvent.change(ownerInput, { target: { value } });
+    if (index < values.length - 1) {
+      await act(async () => {
+        await vi.advanceTimersByTimeAsync(250);
+      });
+      expect(listAdminEditorAssets).not.toHaveBeenCalled();
+    }
+  }
+
+  expect(listAdminEditorAssets).not.toHaveBeenCalled();
+  await act(async () => {
+    await vi.advanceTimersByTimeAsync(299);
+  });
+  expect(listAdminEditorAssets).not.toHaveBeenCalled();
+  await act(async () => {
+    await vi.advanceTimersByTimeAsync(1);
+  });
+  expect(listAdminEditorAssets).toHaveBeenCalledTimes(1);
+  expect(listAdminEditorAssets).toHaveBeenLastCalledWith(
+    'admin-token',
+    {
+      ownerUserId: 'SY-00000055',
+      keyword: null,
+      createdAfter: null,
+      createdBefore: null,
+      limit: 80,
+    },
+    expect.anything(),
+  );
+});
+
+test('后台素材查询只应用最新筛选请求的结果和加载状态', async () => {
+  const staleResponse = createDeferred<AdminEditorAssetListResponse>();
+  const currentResponse = createDeferred<AdminEditorAssetListResponse>();
+  vi.mocked(listAdminEditorAssets)
+    .mockResolvedValueOnce({
+      entries: [generatedAsset],
+      nextCursor: null,
+    })
+    .mockImplementationOnce(() => staleResponse.promise)
+    .mockImplementationOnce(() => currentResponse.promise);
+
+  render(
+    <AdminEditorAssetQueryPage token="admin-token" onUnauthorized={vi.fn()} />,
+  );
+
+  await screen.findByText('角色形象 1');
+  fireEvent.change(screen.getByLabelText('用户 ID / 陶泥号'), {
+    target: { value: 'user-stale' },
+  });
+  await waitFor(() => expect(listAdminEditorAssets).toHaveBeenCalledTimes(2));
+  fireEvent.change(screen.getByLabelText('用户 ID / 陶泥号'), {
+    target: { value: 'SY-00000055' },
+  });
+  await waitFor(() => expect(listAdminEditorAssets).toHaveBeenCalledTimes(3));
+
+  await act(async () => {
+    staleResponse.resolve({
+      entries: [
+        { ...generatedAsset, assetId: 'asset-stale', label: '旧筛选素材' },
+      ],
+      nextCursor: 'cursor-stale',
+    });
+    await staleResponse.promise;
+  });
+
+  expect(screen.queryByText('旧筛选素材')).toBeNull();
+  expect(screen.getByRole('button', { name: '刷新中' })).toBeTruthy();
+
+  await act(async () => {
+    currentResponse.resolve({
+      entries: [
+        { ...generatedAsset, assetId: 'asset-current', label: '当前筛选素材' },
+      ],
+      nextCursor: null,
+    });
+    await currentResponse.promise;
+  });
+
+  expect(await screen.findByText('当前筛选素材')).toBeTruthy();
+  expect(screen.queryByText('旧筛选素材')).toBeNull();
+  expect(screen.getByRole('button', { name: '刷新' })).toBeTruthy();
+});
+
+test('后台素材查询筛选失败时隐藏旧结果且不展示空态', async () => {
+  vi.mocked(listAdminEditorAssets)
+    .mockResolvedValueOnce({
+      entries: [generatedAssetAt(1)],
+      nextCursor: 'cursor-old',
+    })
+    .mockRejectedValueOnce(new Error('筛选失败'));
+
+  render(
+    <AdminEditorAssetQueryPage token="admin-token" onUnauthorized={vi.fn()} />,
+  );
+
+  expect(await screen.findByText('角色形象 1')).toBeTruthy();
+  expect(screen.getByRole('button', { name: '读取更多' })).toBeTruthy();
+
+  fireEvent.change(screen.getByLabelText('用户 ID / 陶泥号'), {
+    target: { value: 'SY-00000055' },
+  });
+
+  expect(screen.queryByText('角色形象 1')).toBeNull();
+  expect(screen.queryByRole('button', { name: '读取更多' })).toBeNull();
+  expect(await screen.findByText('筛选失败')).toBeTruthy();
+  expect(screen.queryByText('角色形象 1')).toBeNull();
+  expect(screen.queryByRole('button', { name: '读取更多' })).toBeNull();
+  expect(screen.queryByText('暂无生成素材')).toBeNull();
+});
+
+test('后台素材查询取消旧筛选请求时不展示错误', async () => {
+  installIntersectionObserverMock();
+  let staleSignal: AbortSignal | undefined;
+  vi.mocked(listAdminEditorAssets)
+    .mockResolvedValueOnce({
+      entries: [generatedAsset],
+      nextCursor: null,
+    })
+    .mockImplementationOnce((_token, _query, signal) => {
+      staleSignal = signal;
+      return new Promise<AdminEditorAssetListResponse>((_resolve, reject) => {
+        signal?.addEventListener(
+          'abort',
+          () => reject(new DOMException('请求已取消', 'AbortError')),
+          { once: true },
+        );
+      });
+    })
+    .mockResolvedValueOnce({
+      entries: [
+        { ...generatedAsset, assetId: 'asset-current', label: '最新筛选素材' },
+      ],
+      nextCursor: null,
+    });
+
+  render(
+    <AdminEditorAssetQueryPage token="admin-token" onUnauthorized={vi.fn()} />,
+  );
+
+  await screen.findByText('角色形象 1');
+  fireEvent.change(screen.getByLabelText('搜索'), {
+    target: { value: '旧筛选' },
+  });
+  await waitFor(() => expect(listAdminEditorAssets).toHaveBeenCalledTimes(2));
+  expect(staleSignal?.aborted).toBe(false);
+  vi.useFakeTimers();
+
+  fireEvent.change(screen.getByLabelText('搜索'), {
+    target: { value: '最新筛选' },
+  });
+  expect(staleSignal?.aborted).toBe(true);
+  await act(async () => {
+    await Promise.resolve();
+  });
+  expect(screen.queryByRole('status')).toBeNull();
+  expect(listAdminEditorAssets).toHaveBeenCalledTimes(2);
+
+  await act(async () => {
+    await vi.advanceTimersByTimeAsync(299);
+  });
+  expect(listAdminEditorAssets).toHaveBeenCalledTimes(2);
+  expect(screen.queryByRole('status')).toBeNull();
+  await act(async () => {
+    await vi.advanceTimersByTimeAsync(1);
+  });
+  expect(listAdminEditorAssets).toHaveBeenCalledTimes(3);
+  expect(screen.getByText('最新筛选素材')).toBeTruthy();
+  expect(screen.queryByRole('status')).toBeNull();
+});
+
+test('后台素材查询手动刷新失败时保留当前结果和游标', async () => {
+  const refreshResponse = createDeferred<AdminEditorAssetListResponse>();
+  vi.mocked(listAdminEditorAssets)
+    .mockResolvedValueOnce({
+      entries: [generatedAssetAt(1)],
+      nextCursor: 'cursor-1',
+    })
+    .mockImplementationOnce(() => refreshResponse.promise);
+
+  render(
+    <AdminEditorAssetQueryPage token="admin-token" onUnauthorized={vi.fn()} />,
+  );
+
+  expect(await screen.findByText('角色形象 1')).toBeTruthy();
+  fireEvent.click(screen.getByRole('button', { name: '刷新' }));
+  expect(screen.getByText('角色形象 1')).toBeTruthy();
+  expect(
+    screen.getByRole('button', { name: '读取更多' }).hasAttribute('disabled'),
+  ).toBe(true);
+
+  await act(async () => {
+    refreshResponse.reject(new Error('刷新失败'));
+    try {
+      await refreshResponse.promise;
+    } catch {
+      // The page owns the rejected request.
+    }
+  });
+
+  expect(await screen.findByText('刷新失败')).toBeTruthy();
+  expect(screen.getByText('角色形象 1')).toBeTruthy();
+  expect(
+    screen.getByRole('button', { name: '读取更多' }).hasAttribute('disabled'),
+  ).toBe(false);
+  expect(screen.queryByText('暂无生成素材')).toBeNull();
+});
+
+test('后台素材查询读取更多进行中手动刷新失败时保留原页', async () => {
+  const staleLoadMoreResponse = createDeferred<AdminEditorAssetListResponse>();
+  const refreshResponse = createDeferred<AdminEditorAssetListResponse>();
+  let staleLoadMoreSignal: AbortSignal | undefined;
+  vi.mocked(listAdminEditorAssets)
+    .mockResolvedValueOnce({
+      entries: [generatedAssetAt(1)],
+      nextCursor: 'cursor-1',
+    })
+    .mockImplementationOnce((_token, _query, signal) => {
+      staleLoadMoreSignal = signal;
+      return staleLoadMoreResponse.promise;
+    })
+    .mockImplementationOnce(() => refreshResponse.promise)
+    .mockResolvedValueOnce({
+      entries: [generatedAssetAt(81)],
+      nextCursor: null,
+    });
+
+  render(
+    <AdminEditorAssetQueryPage token="admin-token" onUnauthorized={vi.fn()} />,
+  );
+
+  fireEvent.click(await screen.findByRole('button', { name: '读取更多' }));
+  await waitFor(() => expect(listAdminEditorAssets).toHaveBeenCalledTimes(2));
+  expect(staleLoadMoreSignal?.aborted).toBe(false);
+
+  fireEvent.click(screen.getByRole('button', { name: '刷新' }));
+  expect(staleLoadMoreSignal?.aborted).toBe(true);
+  expect(listAdminEditorAssets).toHaveBeenCalledTimes(3);
+  expect(screen.getByText('角色形象 1')).toBeTruthy();
+  expect(
+    screen.getByRole('button', { name: '读取更多' }).hasAttribute('disabled'),
+  ).toBe(true);
+
+  await act(async () => {
+    refreshResponse.reject(new Error('刷新失败'));
+    try {
+      await refreshResponse.promise;
+    } catch {
+      // The page owns the rejected request.
+    }
+  });
+
+  expect(await screen.findByText('刷新失败')).toBeTruthy();
+  expect(screen.getByText('角色形象 1')).toBeTruthy();
+  expect(
+    screen.getByRole('button', { name: '读取更多' }).hasAttribute('disabled'),
+  ).toBe(false);
+
+  await act(async () => {
+    staleLoadMoreResponse.resolve({
+      entries: [
+        { ...generatedAsset, assetId: 'asset-stale', label: '旧分页素材' },
+      ],
+      nextCursor: 'cursor-stale',
+    });
+    await staleLoadMoreResponse.promise;
+  });
+  expect(screen.queryByText('旧分页素材')).toBeNull();
+
+  fireEvent.click(screen.getByRole('button', { name: '读取更多' }));
+  expect(await screen.findByText('角色形象 81')).toBeTruthy();
+  expect(listAdminEditorAssets).toHaveBeenLastCalledWith(
+    'admin-token',
+    {
+      ownerUserId: null,
+      keyword: null,
+      createdAfter: null,
+      createdBefore: null,
+      limit: 80,
+      cursor: 'cursor-1',
+    },
+    expect.anything(),
+  );
+});
+
 test('后台素材查询不展示分类筛选和分类列', async () => {
   render(
     <AdminEditorAssetQueryPage token="admin-token" onUnauthorized={vi.fn()} />,
@@ -245,6 +578,80 @@ test('后台素材查询不展示分类筛选和分类列', async () => {
   expect(screen.queryByRole('columnheader', { name: '分类' })).toBeNull();
 });
 
+test('后台素材查询将中间产物按真实类型逐行收纳在最终产物下', async () => {
+  const providerSource: AdminEditorAssetPayload = {
+    ...generatedAsset,
+    assetId: 'asset-source',
+    label: '角色形象生成原图',
+    objectKey:
+      'generated-character-drafts/editor/character-images/provider-source-task-1.png',
+    imageSrc:
+      '/generated-character-drafts/editor/character-images/provider-source-task-1.png',
+    assetKind: 'character',
+    generator: '角色生图',
+    taskGenerator: '角色生成',
+    generationCostMudPoints: 12,
+    taskCostMudPoints: 12,
+    children: [],
+  };
+  const postprocessOutput: AdminEditorAssetPayload = {
+    ...generatedAsset,
+    assetId: 'asset-postprocess',
+    label: '角色抠图阶段产物',
+    objectKey:
+      'generated-character-drafts/editor/character-images/background-removal-task-1.png',
+    imageSrc:
+      '/generated-character-drafts/editor/character-images/background-removal-task-1.png',
+    assetKind: 'character',
+    generator: '角色抠图',
+    taskGenerator: '角色生成',
+    generationCostMudPoints: 0,
+    taskCostMudPoints: 0,
+    children: [],
+  };
+  vi.mocked(listAdminEditorAssets).mockResolvedValueOnce({
+    entries: [
+      {
+        ...generatedAsset,
+        generationCostMudPoints: 0,
+        taskCostMudPoints: 12,
+        children: [providerSource, postprocessOutput],
+      },
+    ],
+    nextCursor: null,
+  });
+
+  render(
+    <AdminEditorAssetQueryPage token="admin-token" onUnauthorized={vi.fn()} />,
+  );
+
+  const finalRow = (await screen.findByText('角色形象 1')).closest('tr');
+  expect(finalRow).not.toBeNull();
+  expect(within(finalRow!).getByText('12 泥点')).toBeTruthy();
+  expect(screen.queryByText('角色形象生成原图')).toBeNull();
+  expect(screen.queryByText('角色抠图阶段产物')).toBeNull();
+
+  fireEvent.click(
+    within(finalRow!).getByRole('button', { name: '展开中间产物' }),
+  );
+
+  const sourceRow = (await screen.findByText('角色形象生成原图')).closest('tr');
+  const postprocessRow = screen.getByText('角色抠图阶段产物').closest('tr');
+  expect(sourceRow).not.toBeNull();
+  expect(postprocessRow).not.toBeNull();
+  expect(within(sourceRow!).getByText('角色生图')).toBeTruthy();
+  expect(within(sourceRow!).getByText('12 泥点')).toBeTruthy();
+  expect(within(postprocessRow!).getByText('角色抠图')).toBeTruthy();
+  expect(
+    within(postprocessRow!).getByText('本阶段不额外扣费'),
+  ).toBeTruthy();
+
+  fireEvent.click(within(sourceRow!).getByRole('button', { name: '详情' }));
+  const detail = await screen.findByRole('dialog', { name: '素材详情' });
+  expect(within(detail).getByText('角色生图')).toBeTruthy();
+  expect(within(detail).getByText('12 泥点')).toBeTruthy();
+});
+
 test('后台素材查询缩略图使用 objectKey 换签后展示', async () => {
   render(
     <AdminEditorAssetQueryPage token="admin-token" onUnauthorized={vi.fn()} />,
@@ -415,13 +822,87 @@ test('后台素材查询读取更多后为新进入可视区域的素材换签',
     objectKey: 'generated-character-drafts/editor/spec-81.png',
     expireSeconds: 300,
   });
-  expect(listAdminEditorAssets).toHaveBeenLastCalledWith('admin-token', {
-    ownerUserId: null,
-    keyword: null,
-    createdAfter: null,
-    createdBefore: null,
-    limit: 80,
-    cursor: 'cursor-1',
+  expect(listAdminEditorAssets).toHaveBeenLastCalledWith(
+    'admin-token',
+    {
+      ownerUserId: null,
+      keyword: null,
+      createdAfter: null,
+      createdBefore: null,
+      limit: 80,
+      cursor: 'cursor-1',
+    },
+    expect.anything(),
+  );
+});
+
+test('后台素材查询筛选刷新后忽略旧读取更多响应和游标', async () => {
+  const staleLoadMoreResponse = createDeferred<AdminEditorAssetListResponse>();
+  const refreshedResponse = createDeferred<AdminEditorAssetListResponse>();
+  let staleLoadMoreSignal: AbortSignal | undefined;
+  vi.mocked(listAdminEditorAssets)
+    .mockResolvedValueOnce({
+      entries: [generatedAssetAt(1)],
+      nextCursor: 'cursor-old',
+    })
+    .mockImplementationOnce((_token, _query, signal) => {
+      staleLoadMoreSignal = signal;
+      return staleLoadMoreResponse.promise;
+    })
+    .mockImplementationOnce(() => refreshedResponse.promise)
+    .mockResolvedValueOnce({ entries: [], nextCursor: null });
+
+  render(
+    <AdminEditorAssetQueryPage token="admin-token" onUnauthorized={vi.fn()} />,
+  );
+
+  fireEvent.click(await screen.findByRole('button', { name: '读取更多' }));
+  await waitFor(() => expect(listAdminEditorAssets).toHaveBeenCalledTimes(2));
+  fireEvent.change(screen.getByLabelText('用户 ID / 陶泥号'), {
+    target: { value: 'SY-00000055' },
+  });
+  expect(staleLoadMoreSignal?.aborted).toBe(true);
+  await waitFor(() => expect(listAdminEditorAssets).toHaveBeenCalledTimes(3));
+  await waitFor(() =>
+    expect(screen.queryByRole('button', { name: '读取更多' })).toBeNull(),
+  );
+
+  await act(async () => {
+    refreshedResponse.resolve({
+      entries: [
+        { ...generatedAsset, assetId: 'asset-current', label: '当前用户素材' },
+      ],
+      nextCursor: 'cursor-current',
+    });
+    await refreshedResponse.promise;
+  });
+  expect(await screen.findByText('当前用户素材')).toBeTruthy();
+
+  await act(async () => {
+    staleLoadMoreResponse.resolve({
+      entries: [
+        { ...generatedAsset, assetId: 'asset-stale', label: '旧分页素材' },
+      ],
+      nextCursor: 'cursor-stale',
+    });
+    await staleLoadMoreResponse.promise;
+  });
+
+  expect(screen.queryByText('旧分页素材')).toBeNull();
+  fireEvent.click(screen.getByRole('button', { name: '读取更多' }));
+  await waitFor(() => {
+    expect(listAdminEditorAssets).toHaveBeenLastCalledWith(
+      'admin-token',
+      {
+        ownerUserId: 'SY-00000055',
+        keyword: null,
+        createdAfter: null,
+        createdBefore: null,
+        limit: 80,
+        cursor: 'cursor-current',
+      },
+      expect.anything(),
+    );
   });
 });
 
@@ -884,6 +1365,28 @@ test('后台素材查询可查看素材详情', async () => {
   expect(within(dialog).getByText(/"style": "clay"/u)).toBeTruthy();
 });
 
+test('后台素材详情分别展示真实操作和归组 Task ID', async () => {
+  vi.mocked(listAdminEditorAssets).mockResolvedValueOnce({
+    entries: [
+      {
+        ...generatedAsset,
+        taskId: 'editor-atlas-split-operation-1',
+        groupTaskId: 'vector-engine-source-task-1',
+      },
+    ],
+    nextCursor: null,
+  });
+  render(
+    <AdminEditorAssetQueryPage token="admin-token" onUnauthorized={vi.fn()} />,
+  );
+
+  fireEvent.click(await screen.findByRole('button', { name: '详情' }));
+
+  const dialog = screen.getByRole('dialog', { name: '素材详情' });
+  expect(within(dialog).getByText('editor-atlas-split-operation-1')).toBeTruthy();
+  expect(within(dialog).getByText('vector-engine-source-task-1')).toBeTruthy();
+});
+
 test('后台素材查询可打开弹窗查看完整提示词', async () => {
   render(
     <AdminEditorAssetQueryPage token="admin-token" onUnauthorized={vi.fn()} />,
diff --git a/apps/admin-web/src/pages/AdminEditorAssetQueryPage.tsx b/apps/admin-web/src/pages/AdminEditorAssetQueryPage.tsx
index 5bb5d25fa..ee2337e62 100644
--- a/apps/admin-web/src/pages/AdminEditorAssetQueryPage.tsx
+++ b/apps/admin-web/src/pages/AdminEditorAssetQueryPage.tsx
@@ -1,6 +1,6 @@
-import { Eye, FileText, RefreshCcw, X } from 'lucide-react';
-import type { ReactNode } from 'react';
-import { useCallback, useEffect, useState } from 'react';
+import { ChevronDown, ChevronRight, Eye, FileText, RefreshCcw, X } from 'lucide-react';
+import { Fragment, type ReactNode } from 'react';
+import { useCallback, useEffect, useRef, useState } from 'react';
 
 import {
   getAdminAssetReadUrl,
@@ -24,6 +24,7 @@ const ADMIN_ASSET_READ_EXPIRE_SECONDS = 300;
 const ADMIN_ASSET_READ_DISPATCH_SPACING_MS = 40;
 const ADMIN_ASSET_READ_RETRY_DELAYS_MS = [400, 1_200, 3_000] as const;
 const ADMIN_ASSET_THUMBNAIL_ROOT_MARGIN = '240px 0px';
+const ADMIN_EDITOR_ASSET_FILTER_DEBOUNCE_MS = 300;
 const AUDIO_ASSET_COVER_SRC = `${import.meta.env.DEV ? import.meta.env.BASE_URL : '/'}creation-home/audio-asset-cover.png`;
 let adminAssetReadDispatchTail = Promise.resolve();
 
@@ -37,6 +38,9 @@ export function AdminEditorAssetQueryPage({
   const [createdAfter, setCreatedAfter] = useState('');
   const [createdBefore, setCreatedBefore] = useState('');
   const [nextCursor, setNextCursor] = useState<string | null>(null);
+  const [committedQueryKey, setCommittedQueryKey] = useState<string | null>(
+    null,
+  );
   const [isLoading, setIsLoading] = useState(false);
   const [isLoadingMore, setIsLoadingMore] = useState(false);
   const [errorMessage, setErrorMessage] = useState('');
@@ -44,53 +48,154 @@ export function AdminEditorAssetQueryPage({
     useState<AdminEditorAssetPayload | null>(null);
   const [previewEntry, setPreviewEntry] =
     useState<AdminEditorAssetPayload | null>(null);
+  const [expandedTaskIds, setExpandedTaskIds] = useState<Set<string>>(
+    () => new Set(),
+  );
   const [promptPreview, setPromptPreview] = useState<{
     title: string;
     prompt: string;
   } | null>(null);
+  const listRequestGenerationRef = useRef(0);
+  const listRequestAbortControllerRef = useRef<AbortController | null>(null);
+  const automaticQueryInitializedRef = useRef(false);
+  const automaticQueryTokenRef = useRef(token);
+  const activeQuery = buildListQuery();
+  const activeQueryKey = editorAssetListQueryKey(token, activeQuery);
+  const hasCurrentQuerySnapshot = committedQueryKey === activeQueryKey;
+  const visibleEntries = hasCurrentQuerySnapshot ? entries : [];
+  const visibleNextCursor = hasCurrentQuerySnapshot ? nextCursor : null;
 
   useEffect(() => {
-    void refreshPage();
+    const runImmediately =
+      !automaticQueryInitializedRef.current ||
+      automaticQueryTokenRef.current !== token;
+    automaticQueryInitializedRef.current = true;
+    automaticQueryTokenRef.current = token;
+
+    if (runImmediately) {
+      void refreshPage();
+      return;
+    }
+
+    invalidateListRequest();
+    setIsLoading(true);
+    setIsLoadingMore(false);
+    setErrorMessage('');
+    const timer = setTimeout(
+      () => void refreshPage(),
+      ADMIN_EDITOR_ASSET_FILTER_DEBOUNCE_MS,
+    );
+    return () => clearTimeout(timer);
     // eslint-disable-next-line react-hooks/exhaustive-deps
   }, [token, ownerUserId, keyword, createdAfter, createdBefore]);
 
+  useEffect(
+    () => () => {
+      automaticQueryInitializedRef.current = false;
+      invalidateListRequest();
+    },
+    [],
+  );
+
   async function refreshPage() {
+    const query = buildListQuery();
+    const queryKey = editorAssetListQueryKey(token, query);
+    const { requestGeneration, abortController } = beginListRequest();
     setIsLoading(true);
+    setIsLoadingMore(false);
     setErrorMessage('');
     try {
-      const response = await listAdminEditorAssets(token, buildListQuery());
+      const response = await listAdminEditorAssets(
+        token,
+        query,
+        abortController.signal,
+      );
+      if (listRequestGenerationRef.current !== requestGeneration) {
+        return;
+      }
       setEntries(response.entries);
       setNextCursor(response.nextCursor ?? null);
+      setCommittedQueryKey(queryKey);
     } catch (error: unknown) {
+      if (
+        listRequestGenerationRef.current !== requestGeneration ||
+        isAbortError(error)
+      ) {
+        return;
+      }
       handlePageError(error, onUnauthorized, setErrorMessage);
     } finally {
-      setIsLoading(false);
+      if (listRequestGenerationRef.current === requestGeneration) {
+        if (listRequestAbortControllerRef.current === abortController) {
+          listRequestAbortControllerRef.current = null;
+        }
+        setIsLoading(false);
+      }
     }
   }
 
   async function loadMore() {
-    if (!nextCursor || isLoadingMore) {
+    if (!visibleNextCursor || isLoading || isLoadingMore) {
       return;
     }
+    const query = buildListQuery();
+    const queryKey = editorAssetListQueryKey(token, query);
+    if (committedQueryKey !== queryKey) {
+      return;
+    }
+    const cursor = visibleNextCursor;
+    const { requestGeneration, abortController } = beginListRequest();
     setIsLoadingMore(true);
     setErrorMessage('');
     try {
-      const response = await listAdminEditorAssets(token, {
-        ...buildListQuery(),
-        cursor: nextCursor,
-      });
+      const response = await listAdminEditorAssets(
+        token,
+        {
+          ...query,
+          cursor,
+        },
+        abortController.signal,
+      );
+      if (listRequestGenerationRef.current !== requestGeneration) {
+        return;
+      }
       setEntries((current) => mergeAssetEntries(current, response.entries));
       setNextCursor(response.nextCursor ?? null);
     } catch (error: unknown) {
+      if (
+        listRequestGenerationRef.current !== requestGeneration ||
+        isAbortError(error)
+      ) {
+        return;
+      }
       handlePageError(error, onUnauthorized, setErrorMessage);
     } finally {
-      setIsLoadingMore(false);
+      if (listRequestGenerationRef.current === requestGeneration) {
+        if (listRequestAbortControllerRef.current === abortController) {
+          listRequestAbortControllerRef.current = null;
+        }
+        setIsLoadingMore(false);
+      }
     }
   }
 
+  function beginListRequest() {
+    invalidateListRequest();
+    const abortController = new AbortController();
+    listRequestAbortControllerRef.current = abortController;
+    const requestGeneration = listRequestGenerationRef.current;
+    return { requestGeneration, abortController };
+  }
+
+  function invalidateListRequest() {
+    listRequestGenerationRef.current += 1;
+    listRequestAbortControllerRef.current?.abort();
+    listRequestAbortControllerRef.current = null;
+  }
+
   function buildListQuery(): AdminEditorAssetListQuery {
     return {
-      ownerUserId: ownerUserId || null,
+      ownerUserId: ownerUserId.trim() || null,
       keyword: keyword.trim() || null,
       createdAfter: dateInputToStartRfc3339(createdAfter),
       createdBefore: dateInputToEndRfc3339(createdBefore),
@@ -140,7 +245,7 @@ export function AdminEditorAssetQueryPage({
             />
           </label>
           <label className="admin-field">
-            <span>用户 ID</span>
+            <span>用户 ID / 陶泥号</span>
             <input
               value={ownerUserId}
               onChange={(event) => setOwnerUserId(event.target.value)}
@@ -149,7 +254,7 @@ export function AdminEditorAssetQueryPage({
           <label className="admin-field">
             <span>搜索</span>
             <input
-              placeholder="素材名 / 用户 / 模型 / 提示词"
+              placeholder="素材名 / 用户 / 生成器 / 模型 / 提示词"
               value={keyword}
               onChange={(event) => setKeyword(event.target.value)}
             />
@@ -164,84 +269,164 @@ export function AdminEditorAssetQueryPage({
                 <th>创建时间</th>
                 <th>用户</th>
                 <th>提示词</th>
+                <th>生成器</th>
                 <th>生成成本</th>
                 <th>详情</th>
               </tr>
             </thead>
             <tbody>
-              {entries.map((entry) => {
+              {visibleEntries.map((entry) => {
                 const promptText = entry.prompt || entry.actualPrompt || '-';
+                const expanded = expandedTaskIds.has(entry.assetId);
+                const children = entry.children ?? [];
                 return (
-                  <tr key={entry.assetId}>
-                    <td>
-                      <button
-                        className="admin-asset-query-thumb-button"
-                        title="预览素材"
-                        type="button"
-                        onClick={() => setPreviewEntry(entry)}
-                      >
-                        <AdminAssetThumbnail entry={entry} token={token} />
-                      </button>
-                      <small>{entry.label || '-'}</small>
-                    </td>
-                    <td>{formatDateTime(entry.createdAt)}</td>
-                    <td>
-                      <div className="admin-inline-identity">
-                        <div>
-                          {authorDisplayName(entry)}
-                          <small>
-                            {entry.authorPublicUserCode?.trim() || '-'}
-                          </small>
+                  <Fragment key={entry.assetId}>
+                    <tr>
+                      <td>
+                        <div className="admin-asset-query-resource-cell">
+                          {children.length ? (
+                            <button
+                              aria-label={expanded ? '收起中间产物' : '展开中间产物'}
+                              className="admin-asset-query-expand-button"
+                              type="button"
+                              onClick={() =>
+                                setExpandedTaskIds((current) => {
+                                  const next = new Set(current);
+                                  if (next.has(entry.assetId)) {
+                                    next.delete(entry.assetId);
+                                  } else {
+                                    next.add(entry.assetId);
+                                  }
+                                  return next;
+                                })
+                              }
+                            >
+                              {expanded ? (
+                                <ChevronDown size={17} aria-hidden="true" />
+                              ) : (
+                                <ChevronRight size={17} aria-hidden="true" />
+                              )}
+                            </button>
+                          ) : (
+                            <span className="admin-asset-query-expand-spacer" />
+                          )}
+                          <div>
+                            <button
+                              className="admin-asset-query-thumb-button"
+                              title="预览素材"
+                              type="button"
+                              onClick={() => setPreviewEntry(entry)}
+                            >
+                              <AdminAssetThumbnail entry={entry} token={token} />
+                            </button>
+                            <small>{entry.label || '-'}</small>
+                          </div>
                         </div>
-                        <AdminUserReferenceButton
-                          token={token}
-                          userId={entry.ownerUserId}
-                          publicUserCode={entry.authorPublicUserCode}
-                          onUnauthorized={onUnauthorized}
+                      </td>
+                      <td>{formatDateTime(entry.createdAt)}</td>
+                      <td>
+                        <div className="admin-inline-identity">
+                          <div>
+                            {authorDisplayName(entry)}
+                            <small>
+                              {entry.authorPublicUserCode?.trim() || '-'}
+                            </small>
+                          </div>
+                          <AdminUserReferenceButton
+                            token={token}
+                            userId={entry.ownerUserId}
+                            publicUserCode={entry.authorPublicUserCode}
+                            onUnauthorized={onUnauthorized}
+                          />
+                        </div>
+                      </td>
+                      <td>
+                        <AdminAssetPromptButton
+                          entry={entry}
+                          promptText={promptText}
+                          onOpen={setPromptPreview}
                         />
-                      </div>
-                    </td>
-                    <td>
-                      <button
-                        className="admin-text-button admin-asset-query-prompt-text"
-                        disabled={promptText === '-'}
-                        title={promptText}
-                        type="button"
-                        onClick={() =>
-                          setPromptPreview({
-                            title: entry.label || entry.assetId,
-                            prompt: promptText,
-                          })
-                        }
-                      >
-                        {promptText}
-                      </button>
-                    </td>
-                    <td>{entry.generationCostMudPoints} 泥点</td>
-                    <td>
-                      <button
-                        className="admin-secondary-button"
-                        type="button"
-                        onClick={() => setDetailEntry(entry)}
-                      >
-                        <Eye size={16} aria-hidden="true" />
-                        <span>详情</span>
-                      </button>
-                    </td>
-                  </tr>
+                      </td>
+                      <td>{entry.taskGenerator || entry.generator || '-'}</td>
+                      <td>{taskGenerationCostLabel(entry)}</td>
+                      <td>
+                        <button
+                          className="admin-secondary-button"
+                          type="button"
+                          onClick={() => setDetailEntry(entry)}
+                        >
+                          <Eye size={16} aria-hidden="true" />
+                          <span>详情</span>
+                        </button>
+                      </td>
+                    </tr>
+                    {expanded
+                      ? children.map((child) => {
+                          const childPrompt =
+                            child.prompt || child.actualPrompt || '-';
+                          return (
+                            <tr
+                              className="admin-asset-query-child-row"
+                              key={child.assetId}
+                            >
+                              <td>
+                                <div className="admin-asset-query-resource-cell admin-asset-query-resource-cell-child">
+                                  <span className="admin-asset-query-child-branch" />
+                                  <div>
+                                    <button
+                                      className="admin-asset-query-thumb-button"
+                                      title="预览中间产物"
+                                      type="button"
+                                      onClick={() => setPreviewEntry(child)}
+                                    >
+                                      <AdminAssetThumbnail
+                                        entry={child}
+                                        token={token}
+                                      />
+                                    </button>
+                                    <small>{child.label || '-'}</small>
+                                  </div>
+                                </div>
+                              </td>
+                              <td>{formatDateTime(child.createdAt)}</td>
+                              <td>{authorDisplayName(child)}</td>
+                              <td>
+                                <AdminAssetPromptButton
+                                  entry={child}
+                                  promptText={childPrompt}
+                                  onOpen={setPromptPreview}
+                                />
+                              </td>
+                              <td>{child.generator || '-'}</td>
+                              <td>{stageGenerationCostLabel(child)}</td>
+                              <td>
+                                <button
+                                  className="admin-secondary-button"
+                                  type="button"
+                                  onClick={() => setDetailEntry(child)}
+                                >
+                                  <Eye size={16} aria-hidden="true" />
+                                  <span>详情</span>
+                                </button>
+                              </td>
+                            </tr>
+                          );
+                        })
+                      : null}
+                  </Fragment>
                 );
               })}
             </tbody>
           </table>
         </div>
 
-        {!isLoading && entries.length === 0 ? (
+        {!isLoading && !errorMessage && visibleEntries.length === 0 ? (
           <div className="admin-empty-state">暂无生成素材</div>
         ) : null}
-        {nextCursor ? (
+        {visibleNextCursor ? (
           <button
             className="admin-secondary-button"
-            disabled={isLoadingMore}
+            disabled={isLoading || isLoadingMore}
             type="button"
             onClick={loadMore}
           >
@@ -306,6 +491,33 @@ export function AdminEditorAssetQueryPage({
   );
 }
 
+function AdminAssetPromptButton({
+  entry,
+  promptText,
+  onOpen,
+}: {
+  entry: AdminEditorAssetPayload;
+  promptText: string;
+  onOpen: (value: { title: string; prompt: string }) => void;
+}) {
+  return (
+    <button
+      className="admin-text-button admin-asset-query-prompt-text"
+      disabled={promptText === '-'}
+      title={promptText}
+      type="button"
+      onClick={() =>
+        onOpen({
+          title: entry.label || entry.assetId,
+          prompt: promptText,
+        })
+      }
+    >
+      {promptText}
+    </button>
+  );
+}
+
 function AdminAssetThumbnail({
   entry,
   token,
@@ -516,13 +728,31 @@ function AdminAssetDetailDialog({
               {entry.width} x {entry.height}
             </AdminInfoItem>
             <AdminInfoItem label="成本">
-              {entry.generationCostMudPoints} 泥点
+              {entry.children?.length
+                ? taskGenerationCostLabel(entry)
+                : stageGenerationCostLabel(entry)}
             </AdminInfoItem>
+            <AdminInfoItem label="生成器">
+              {entry.children?.length
+                ? entry.taskGenerator || entry.generator || '-'
+                : entry.generator || '-'}
+            </AdminInfoItem>
+            {entry.children?.length ? (
+              <AdminInfoItem label="当前产物阶段">
+                {entry.generator || '-'}
+              </AdminInfoItem>
+            ) : null}
             <AdminInfoItem label="模型">{entry.model || '-'}</AdminInfoItem>
             <AdminInfoItem label="Provider">
               {entry.provider || '-'}
             </AdminInfoItem>
             <AdminInfoItem label="Task ID">{entry.taskId || '-'}</AdminInfoItem>
+            {entry.groupTaskId?.trim() &&
+            entry.groupTaskId.trim() !== entry.taskId?.trim() ? (
+              <AdminInfoItem label="归组 Task ID">
+                {entry.groupTaskId.trim()}
+              </AdminInfoItem>
+            ) : null}
             <AdminInfoItem label="Object Key">
               {entry.objectKey || '-'}
             </AdminInfoItem>
@@ -558,6 +788,16 @@ function AdminAssetDetailDialog({
   );
 }
 
+function taskGenerationCostLabel(entry: AdminEditorAssetPayload) {
+  return `${entry.taskCostMudPoints ?? entry.generationCostMudPoints} 泥点`;
+}
+
+function stageGenerationCostLabel(entry: AdminEditorAssetPayload) {
+  return entry.generationCostMudPoints > 0
+    ? `${entry.generationCostMudPoints} 泥点`
+    : '本阶段不额外扣费';
+}
+
 function AdminAssetPreviewDialog({
   entry,
   token,
@@ -856,6 +1096,29 @@ function mergeAssetEntries(
   );
 }
 
+function editorAssetListQueryKey(
+  token: string,
+  query: AdminEditorAssetListQuery,
+) {
+  return JSON.stringify([
+    token.trim(),
+    query.ownerUserId?.trim() || null,
+    query.keyword?.trim() || null,
+    query.createdAfter?.trim() || null,
+    query.createdBefore?.trim() || null,
+    query.limit ?? null,
+  ]);
+}
+
+function isAbortError(error: unknown) {
+  return (
+    typeof error === 'object' &&
+    error !== null &&
+    'name' in error &&
+    error.name === 'AbortError'
+  );
+}
+
 function dateInputToStartRfc3339(value: string) {
   return value ? `${value}T00:00:00+08:00` : null;
 }
diff --git a/apps/admin-web/src/pages/AdminInviteCodePage.test.tsx b/apps/admin-web/src/pages/AdminInviteCodePage.test.tsx
new file mode 100644
index 000000000..edc1793bc
--- /dev/null
+++ b/apps/admin-web/src/pages/AdminInviteCodePage.test.tsx
@@ -0,0 +1,41 @@
+/* @vitest-environment jsdom */
+
+import {render, screen} from '@testing-library/react';
+import {beforeEach, expect, test, vi} from 'vitest';
+
+import {listProfileInviteCodes} from '../api/adminApiClient';
+import {AdminInviteCodePage} from './AdminInviteCodePage';
+
+vi.mock('../api/adminApiClient', () => ({
+  formatAdminApiError: vi.fn((error: unknown) =>
+    error instanceof Error ? error.message : '请求失败',
+  ),
+  isAdminApiError: vi.fn(() => false),
+  listProfileInviteCodes: vi.fn(),
+  upsertProfileInviteCode: vi.fn(),
+}));
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  vi.mocked(listProfileInviteCodes).mockResolvedValue({
+    entries: [],
+    operations: [
+      {
+        operationId: 'operation-1',
+        codeKind: 'invite',
+        code: 'TEAM',
+        action: 'create',
+        operatorUserId: 'admin-account-internal-1',
+        operatorDisplayName: '邀请运营',
+        createdAt: '2026-07-14T10:00:00Z',
+      },
+    ],
+  });
+});
+
+test('操作记录只展示管理员显示名称', async () => {
+  render(<AdminInviteCodePage token="admin-token" onUnauthorized={vi.fn()} />);
+
+  expect(await screen.findByText('邀请运营')).toBeTruthy();
+  expect(screen.queryByText('admin-account-internal-1')).toBeNull();
+});
diff --git a/apps/admin-web/src/pages/AdminInviteCodePage.tsx b/apps/admin-web/src/pages/AdminInviteCodePage.tsx
index ebb687715..9435bf94c 100644
--- a/apps/admin-web/src/pages/AdminInviteCodePage.tsx
+++ b/apps/admin-web/src/pages/AdminInviteCodePage.tsx
@@ -278,7 +278,7 @@ export function AdminInviteCodePage({
                       <tr key={operation.operationId}>
                         <td>{operationActionLabel(operation.action)}</td>
                         <td>{operation.code}</td>
-                        <td>{operation.operatorUserId}</td>
+                        <td>{operation.operatorDisplayName}</td>
                         <td>{formatDateTime(operation.createdAt)}</td>
                       </tr>
                     ))}
diff --git a/apps/admin-web/src/pages/AdminProfileWalletConfigPage.tsx b/apps/admin-web/src/pages/AdminProfileWalletConfigPage.tsx
index 1f19ed0f2..83652b640 100644
--- a/apps/admin-web/src/pages/AdminProfileWalletConfigPage.tsx
+++ b/apps/admin-web/src/pages/AdminProfileWalletConfigPage.tsx
@@ -149,7 +149,7 @@ export function AdminProfileWalletConfigPage({
               </div>
               <div>
                 <dt>更新人</dt>
-                <dd>{result.updatedBy || '-'}</dd>
+                <dd>{result.updatedByDisplayName || '-'}</dd>
               </div>
               <div>
                 <dt>更新</dt>
diff --git a/apps/admin-web/src/pages/AdminRechargeOrderPage.test.tsx b/apps/admin-web/src/pages/AdminRechargeOrderPage.test.tsx
index 92224d082..81e4fcbde 100644
--- a/apps/admin-web/src/pages/AdminRechargeOrderPage.test.tsx
+++ b/apps/admin-web/src/pages/AdminRechargeOrderPage.test.tsx
@@ -274,7 +274,7 @@ test('已登记的部分退款允许在 REFUND 支付状态下继续退剩余额
   ).toBe(false);
 });
 
-test('网络结果不明后重新预检会复用稳定 requestId 且双击只提交一次', async () => {
+test('网络结果不明后当前弹窗直接复用稳定 requestId', async () => {
   const user = userEvent.setup();
   vi.mocked(executeAdminRechargeRefund)
     .mockRejectedValueOnce(new Error('network disconnected'))
@@ -284,21 +284,26 @@ test('网络结果不明后重新预检会复用稳定 requestId 且双击只提
   await user.type(screen.getByLabelText('退款金额（元）'), '3.00');
   await user.type(screen.getByLabelText('退款原因'), '用户申请');
   await user.click(screen.getByRole('button', { name: '核验支付账单' }));
-  await user.dblClick(screen.getByRole('button', { name: '确认退款' }));
+  await user.click(screen.getByRole('button', { name: '确认退款' }));
 
   expect(await screen.findByText(/微信侧退款状态未知/)).toBeTruthy();
   expect(executeAdminRechargeRefund).toHaveBeenCalledTimes(1);
   const firstRequestId = vi.mocked(executeAdminRechargeRefund).mock
     .calls[0]?.[1].requestId;
 
-  await user.click(screen.getByRole('button', { name: '核验支付账单' }));
-  await user.dblClick(screen.getByRole('button', { name: '确认退款' }));
+  expect(
+    screen
+      .getByRole('button', { name: '核验支付账单' })
+      .hasAttribute('disabled'),
+  ).toBe(true);
+  await user.click(screen.getByRole('button', { name: '继续核对退款' }));
   await waitFor(() =>
     expect(executeAdminRechargeRefund).toHaveBeenCalledTimes(2),
   );
   expect(
     vi.mocked(executeAdminRechargeRefund).mock.calls[1]?.[1].requestId,
   ).toBe(firstRequestId);
+  expect(previewAdminRechargeRefund).toHaveBeenCalledTimes(1);
 });
 
 test('刷新后根据 active hold 恢复原退款请求并复用 requestId', async () => {
@@ -350,6 +355,56 @@ test('刷新后根据 active hold 恢复原退款请求并复用 requestId', asy
   expect(previewAdminRechargeRefund).toHaveBeenCalledTimes(1);
 });
 
+test('超长退款原因按服务端上限持久化并可在刷新后恢复', async () => {
+  const user = userEvent.setup();
+  const normalizedReason = '退'.repeat(80);
+  vi.mocked(executeAdminRechargeRefund)
+    .mockRejectedValueOnce(new Error('network disconnected'))
+    .mockResolvedValueOnce(actionFor(baseOrder));
+  const firstRender = renderPage();
+  await openPartialRefund(user);
+  await user.type(screen.getByLabelText('退款金额（元）'), '3.00');
+  await user.type(screen.getByLabelText('退款原因'), `${normalizedReason}多`);
+  await user.click(screen.getByRole('button', { name: '核验支付账单' }));
+  await user.click(screen.getByRole('button', { name: '确认退款' }));
+
+  expect(await screen.findByText(/微信侧退款状态未知/)).toBeTruthy();
+  const firstRequestId = vi.mocked(executeAdminRechargeRefund).mock
+    .calls[0]?.[1].requestId;
+  expect(vi.mocked(executeAdminRechargeRefund).mock.calls[0]?.[1].reason).toBe(
+    normalizedReason,
+  );
+  firstRender.unmount();
+
+  const activeHoldOrder = orderWithActiveHold();
+  activeHoldOrder.activeHold = {
+    ...activeHoldOrder.activeHold!,
+    reason: normalizedReason,
+  };
+  vi.mocked(listAdminRechargeOrders).mockResolvedValue({
+    entries: [activeHoldOrder],
+  });
+  renderPage();
+  await user.click(await screen.findByRole('button', { name: '核对退款' }));
+
+  expect(screen.getByRole('dialog', { name: '退款处理' })).toBeTruthy();
+  expect(screen.getByLabelText('退款原因')).toHaveProperty(
+    'value',
+    normalizedReason,
+  );
+  await user.click(screen.getByRole('button', { name: '继续核对退款' }));
+
+  await waitFor(() =>
+    expect(executeAdminRechargeRefund).toHaveBeenCalledTimes(2),
+  );
+  expect(vi.mocked(executeAdminRechargeRefund).mock.calls[1]?.[1]).toEqual(
+    expect.objectContaining({
+      reason: normalizedReason,
+      requestId: firstRequestId,
+    }),
+  );
+});
+
 test('过期退款请求上下文不会恢复 active hold，只开放安全查单', async () => {
   const user = userEvent.setup();
   vi.mocked(executeAdminRechargeRefund).mockRejectedValueOnce(
@@ -469,7 +524,16 @@ test.each(['provider_transaction_id_mismatch', 'order_total_mismatch'])(
       entries: [
         {
           ...baseOrder,
-          refunds: [manualReviewRefund({ lastErrorCode })],
+          refunds: [
+            manualReviewRefund({
+              lastErrorCode,
+              providerTransactionId:
+                lastErrorCode === 'provider_transaction_id_mismatch'
+                  ? 'wx-transaction-other'
+                  : 'wx-transaction-1',
+              totalCents: lastErrorCode === 'order_total_mismatch' ? 700 : 600,
+            }),
+          ],
         },
       ],
     });
@@ -480,6 +544,29 @@ test.each(['provider_transaction_id_mismatch', 'order_total_mismatch'])(
     const submitButton = within(dialog).getByRole('button', {
       name: '确认并追回',
     });
+    expect(
+      within(dialog).getByText(
+        lastErrorCode === 'provider_transaction_id_mismatch'
+          ? '微信交易单号不一致'
+          : '订单总额不一致',
+      ),
+    ).toBeTruthy();
+    expect(
+      within(dialog).getByText('本地微信交易单号').parentElement?.textContent,
+    ).toContain('wx-transaction-1');
+    expect(
+      within(dialog).getByText('退款微信交易单号').parentElement?.textContent,
+    ).toContain(
+      lastErrorCode === 'provider_transaction_id_mismatch'
+        ? 'wx-transaction-other'
+        : 'wx-transaction-1',
+    );
+    expect(
+      within(dialog).getByText('本地订单总额').parentElement?.textContent,
+    ).toContain('¥6.00');
+    expect(
+      within(dialog).getByText('退款订单总额').parentElement?.textContent,
+    ).toContain(lastErrorCode === 'order_total_mismatch' ? '¥7.00' : '¥6.00');
     expect(submitButton.hasAttribute('disabled')).toBe(true);
     await user.type(
       within(dialog).getByRole('textbox', { name: '人工复核原因' }),
@@ -493,6 +580,7 @@ test.each(['provider_transaction_id_mismatch', 'order_total_mismatch'])(
         {
           outRefundNo: 'refund-manual-1',
           reason: '已核对微信商户平台原始账单',
+          expectedErrorCode: lastErrorCode,
         },
       );
     });
@@ -511,7 +599,12 @@ test('非白名单、已处理和会员退款不显示人工复核按钮', async
         ...baseOrder,
         orderId: 'order-resolved',
         refunds: [
-          manualReviewRefund({ manualReviewResolvedAtMicros: 1_720_000 }),
+          manualReviewRefund({
+            manualReviewResolvedAtMicros: 1_720_000,
+            manualReviewResolvedByAdminUserId: 'admin-1',
+            manualReviewResolutionReason: '已核对商户平台',
+            manualReviewResolvedErrorCode: 'provider_transaction_id_mismatch',
+          }),
         ],
       },
       {
@@ -526,6 +619,10 @@ test('非白名单、已处理和会员退款不显示人工复核按钮', async
 
   await screen.findByText('order-membership');
   expect(screen.queryByRole('button', { name: '人工复核' })).toBeNull();
+  expect(screen.getByText(/复核 微信交易单号不一致/).textContent).toContain(
+    'admin-1',
+  );
+  expect(screen.getByText(/已核对商户平台/)).toBeTruthy();
 });
 
 test('支付侧已退款但泥点不足时持续展示异常欠账与消费限制', async () => {
@@ -645,7 +742,9 @@ function manualReviewRefund(
   return {
     outRefundNo: 'refund-manual-1',
     providerRefundId: 'provider-refund-1',
+    providerTransactionId: 'wx-transaction-other',
     providerStatus: 'SUCCESS',
+    totalCents: 600,
     refundCents: 300,
     payerRefundCents: 300,
     successAtMicros: 1_720_000_000_000_000,
@@ -660,6 +759,7 @@ function manualReviewRefund(
     manualReviewResolvedByAdminUserId: null,
     manualReviewResolutionReason: null,
     manualReviewResolvedAtMicros: null,
+    manualReviewResolvedErrorCode: null,
     ...overrides,
   };
 }
diff --git a/apps/admin-web/src/pages/AdminRechargeOrderPage.tsx b/apps/admin-web/src/pages/AdminRechargeOrderPage.tsx
index 5ad5a1a25..d1f4848b0 100644
--- a/apps/admin-web/src/pages/AdminRechargeOrderPage.tsx
+++ b/apps/admin-web/src/pages/AdminRechargeOrderPage.tsx
@@ -59,7 +59,7 @@ interface PersistedRefundRequestContext {
 }
 
 interface ManualReviewTarget {
-  orderId: string;
+  order: AdminRechargeOrderEntryPayload;
   refund: AdminRechargeRefundPayload;
 }
 
@@ -277,7 +277,7 @@ export function AdminRechargeOrderPage({
     ) {
       return;
     }
-    const reason = refundReason.trim();
+    const reason = normalizeRefundReason(refundReason);
     if (!reason) {
       setRefundError('请填写退款原因');
       return;
@@ -345,6 +345,7 @@ export function AdminRechargeOrderPage({
       if (!isAdminApiError(error)) {
         setProviderStatusUnknown(true);
         setPreview(null);
+        setResumableRefundRequest(requestContext);
         setRefundError(unknownProviderStatusMessage);
       } else {
         removePersistedRefundRequestContext(token, refundOrder.orderId);
@@ -402,7 +403,7 @@ export function AdminRechargeOrderPage({
     order: AdminRechargeOrderEntryPayload,
     refund: AdminRechargeRefundPayload,
   ) {
-    setManualReviewTarget({ orderId: order.orderId, refund });
+    setManualReviewTarget({ order, refund });
     setManualReviewReason('');
     setManualReviewError('');
   }
@@ -410,15 +411,23 @@ export function AdminRechargeOrderPage({
   async function handleResolveManualReview(event: FormEvent<HTMLFormElement>) {
     event.preventDefault();
     const reason = manualReviewReason.trim();
-    if (!manualReviewTarget || manualReviewLockRef.current || !reason) {
+    const expectedErrorCode = manualReviewTarget?.refund.lastErrorCode?.trim();
+    if (
+      !manualReviewTarget ||
+      manualReviewLockRef.current ||
+      !reason ||
+      !expectedErrorCode
+    ) {
       if (!reason) {
         setManualReviewError('请填写人工复核原因');
+      } else if (!expectedErrorCode) {
+        setManualReviewError('退款人工复核状态已变化，请刷新后重试');
       }
       return;
     }
     const confirmed = await confirmWrite({
       action: '确认微信退款并追回泥点',
-      target: `${manualReviewTarget.orderId} / ${manualReviewTarget.refund.outRefundNo}`,
+      target: `${manualReviewTarget.order.orderId} / ${manualReviewTarget.refund.outRefundNo}`,
     });
     if (!confirmed || manualReviewLockRef.current) {
       return;
@@ -431,6 +440,7 @@ export function AdminRechargeOrderPage({
       const response = await resolveAdminRechargeRefundManualReview(token, {
         outRefundNo: manualReviewTarget.refund.outRefundNo,
         reason,
+        expectedErrorCode,
       });
       setLastAction(response);
       upsertOrder(response.order);
@@ -772,6 +782,7 @@ export function AdminRechargeOrderPage({
                 <input
                   aria-label="退款原因"
                   disabled={isSubmitting || Boolean(resumableRefundRequest)}
+                  maxLength={80}
                   value={refundReason}
                   onChange={(event) => setRefundReason(event.target.value)}
                 />
@@ -966,6 +977,36 @@ export function AdminRechargeOrderPage({
                 <X size={18} aria-hidden="true" />
               </button>
             </div>
+            <dl className="admin-info-list" aria-label="退款冲突核对信息">
+              <div>
+                <dt>冲突类型</dt>
+                <dd>
+                  {formatManualReviewErrorCode(
+                    manualReviewTarget.refund.lastErrorCode,
+                  )}
+                </dd>
+              </div>
+              <div>
+                <dt>本地微信交易单号</dt>
+                <dd>{manualReviewTarget.order.providerTransactionId || '-'}</dd>
+              </div>
+              <div>
+                <dt>退款微信交易单号</dt>
+                <dd>{manualReviewTarget.refund.providerTransactionId}</dd>
+              </div>
+              <div>
+                <dt>本地订单总额</dt>
+                <dd>{formatMoney(manualReviewTarget.order.amountCents)}</dd>
+              </div>
+              <div>
+                <dt>退款订单总额</dt>
+                <dd>{formatMoney(manualReviewTarget.refund.totalCents)}</dd>
+              </div>
+              <div>
+                <dt>本次退款金额</dt>
+                <dd>{formatMoney(manualReviewTarget.refund.refundCents)}</dd>
+              </div>
+            </dl>
             <label className="admin-field">
               <span>人工复核原因</span>
               <textarea
@@ -1047,6 +1088,7 @@ function RechargeOrderRow({
 }) {
   const userName = order.user?.displayName || '未读取用户资料';
   const manualReviewRefund = findResolvableManualReviewRefund(order);
+  const resolvedManualReviewRefund = findResolvedManualReviewRefund(order);
   return (
     <tr>
       <td>
@@ -1088,6 +1130,25 @@ function RechargeOrderRow({
         {order.activeHold ? (
           <small>占用 {order.activeHold.heldPoints} 泥点</small>
         ) : null}
+        {resolvedManualReviewRefund ? (
+          <>
+            <small>
+              复核{' '}
+              {formatManualReviewErrorCode(
+                resolvedManualReviewRefund.manualReviewResolvedErrorCode,
+              )}{' '}
+              /{' '}
+              {resolvedManualReviewRefund.manualReviewResolvedByAdminUserId ||
+                '-'}
+            </small>
+            <small>
+              {resolvedManualReviewRefund.manualReviewResolutionReason || '-'} /{' '}
+              {formatMicros(
+                resolvedManualReviewRefund.manualReviewResolvedAtMicros ?? 0,
+              )}
+            </small>
+          </>
+        ) : null}
       </td>
       <td>
         <span>可消费 {order.wallet.spendableBalance}</span>
@@ -1321,6 +1382,19 @@ function formatRefundBlockReason(code?: string | null) {
   return labels[code.toLowerCase()] ?? `当前不可退款：${code}`;
 }
 
+function formatManualReviewErrorCode(code?: string | null) {
+  const normalized = code?.trim().toLowerCase();
+  const labels: Record<string, string> = {
+    provider_transaction_id_mismatch: '微信交易单号不一致',
+    order_total_mismatch: '订单总额不一致',
+  };
+  return normalized ? (labels[normalized] ?? normalized) : '-';
+}
+
+function normalizeRefundReason(value: string) {
+  return Array.from(value.trim()).slice(0, 80).join('');
+}
+
 function datetimeLocalToRfc3339(value: string) {
   const normalized = value.trim();
   if (!normalized) {
@@ -1369,6 +1443,16 @@ function findResolvableManualReviewRefund(
   );
 }
 
+function findResolvedManualReviewRefund(order: AdminRechargeOrderEntryPayload) {
+  return order.refunds.find(
+    (refund) =>
+      Boolean(refund.manualReviewResolvedErrorCode) &&
+      Boolean(refund.manualReviewResolvedByAdminUserId) &&
+      Boolean(refund.manualReviewResolutionReason) &&
+      Boolean(refund.manualReviewResolvedAtMicros),
+  );
+}
+
 function createRequestId() {
   if (
     typeof crypto !== 'undefined' &&
diff --git a/apps/admin-web/src/pages/AdminRedeemCodePage.test.tsx b/apps/admin-web/src/pages/AdminRedeemCodePage.test.tsx
index 2e3884bdd..dac047af4 100644
--- a/apps/admin-web/src/pages/AdminRedeemCodePage.test.tsx
+++ b/apps/admin-web/src/pages/AdminRedeemCodePage.test.tsx
@@ -68,7 +68,17 @@ beforeEach(() => {
   vi.clearAllMocks();
   vi.mocked(listProfileRedeemCodes).mockResolvedValue({
     entries,
-    operations: [],
+    operations: [
+      {
+        operationId: 'operation-1',
+        codeKind: 'redeem',
+        code: 'LONG-LIVED',
+        action: 'create',
+        operatorUserId: 'admin-account-internal-1',
+        operatorDisplayName: '兑换码运营',
+        createdAt: '2026-07-13T01:00:00Z',
+      },
+    ],
   });
   vi.mocked(upsertProfileRedeemCode).mockResolvedValue(baseEntry);
   vi.mocked(disableProfileRedeemCode).mockResolvedValue({
@@ -77,6 +87,13 @@ beforeEach(() => {
   });
 });
 
+test('操作记录只展示管理员显示名称', async () => {
+  render(<AdminRedeemCodePage token="admin-token" onUnauthorized={vi.fn()} />);
+
+  expect(await screen.findByText('兑换码运营')).toBeTruthy();
+  expect(screen.queryByText('admin-account-internal-1')).toBeNull();
+});
+
 test('兑换码列表展示生效状态与日期范围', async () => {
   render(<AdminRedeemCodePage token="admin-token" onUnauthorized={vi.fn()} />);
 
diff --git a/apps/admin-web/src/pages/AdminRedeemCodePage.tsx b/apps/admin-web/src/pages/AdminRedeemCodePage.tsx
index 6afe195d5..66a1b641d 100644
--- a/apps/admin-web/src/pages/AdminRedeemCodePage.tsx
+++ b/apps/admin-web/src/pages/AdminRedeemCodePage.tsx
@@ -402,7 +402,7 @@ export function AdminRedeemCodePage({
                       <tr key={operation.operationId}>
                         <td>{operationActionLabel(operation.action)}</td>
                         <td>{operation.code}</td>
-                        <td>{operation.operatorUserId}</td>
+                        <td>{operation.operatorDisplayName}</td>
                         <td>{formatDateTime(operation.createdAt)}</td>
                       </tr>
                     ))}
diff --git a/apps/admin-web/src/pages/AdminTaskConfigPage.tsx b/apps/admin-web/src/pages/AdminTaskConfigPage.tsx
index 1c34d6a6c..33026ce0a 100644
--- a/apps/admin-web/src/pages/AdminTaskConfigPage.tsx
+++ b/apps/admin-web/src/pages/AdminTaskConfigPage.tsx
@@ -553,7 +553,7 @@ export function AdminTaskConfigPage({
                 </div>
                 <div>
                   <dt>更新人</dt>
-                  <dd>{result.updatedBy}</dd>
+                  <dd>{result.updatedByDisplayName}</dd>
                 </div>
                 <div>
                   <dt>更新</dt>
diff --git a/apps/admin-web/src/styles/admin.css b/apps/admin-web/src/styles/admin.css
index 19ff3edd7..3012d78fa 100644
--- a/apps/admin-web/src/styles/admin.css
+++ b/apps/admin-web/src/styles/admin.css
@@ -216,6 +216,17 @@ button:disabled {
   overflow: auto;
 }
 
+.admin-zero-permission-state {
+  min-height: 180px;
+  place-items: center;
+}
+
+.admin-zero-permission-state h2 {
+  margin: 0;
+  color: #6f5848;
+  font-size: 20px;
+}
+
 .admin-page {
   display: grid;
   gap: 18px;
@@ -350,6 +361,63 @@ button:disabled {
   grid-template-columns: repeat(4, minmax(0, 1fr));
 }
 
+.admin-dashboard-retention-grid {
+  display: grid;
+  grid-template-columns: repeat(3, minmax(0, 1fr));
+  gap: 14px;
+}
+
+.admin-dashboard-retention-card {
+  display: grid;
+  min-width: 0;
+  min-height: 112px;
+  grid-template-columns: minmax(0, 1fr) auto;
+  grid-template-rows: auto 1fr;
+  gap: 8px 16px;
+  align-items: center;
+  padding: 16px;
+}
+
+.admin-dashboard-retention-card + .admin-dashboard-retention-card {
+  border-left: 1px solid #ead8ca;
+}
+
+.admin-dashboard-retention-card > span {
+  color: #8f7868;
+  font-size: 13px;
+  font-weight: 750;
+}
+
+.admin-dashboard-retention-card > strong {
+  grid-row: 1 / -1;
+  grid-column: 2;
+  color: #8f3f27;
+  font-size: 30px;
+  font-variant-numeric: tabular-nums;
+  line-height: 1.1;
+  white-space: nowrap;
+}
+
+.admin-dashboard-retention-card > div {
+  display: flex;
+  min-width: 0;
+  align-items: baseline;
+  gap: 8px;
+}
+
+.admin-dashboard-retention-card small {
+  min-width: 0;
+  color: #a38f80;
+  font-size: 12px;
+}
+
+.admin-dashboard-retention-card b {
+  flex: 0 0 auto;
+  color: #755a49;
+  font-size: 13px;
+  font-variant-numeric: tabular-nums;
+}
+
 .admin-dashboard-chart-grid,
 .admin-dashboard-operations {
   grid-template-columns: repeat(2, minmax(0, 1fr));
@@ -406,7 +474,10 @@ button:disabled {
   gap: 8px;
   min-height: 196px;
   overflow-x: auto;
+  overscroll-behavior-inline: contain;
   padding: 4px 2px 0;
+  scrollbar-color: #bdaea3 #f4e5d7;
+  scrollbar-width: thin;
 }
 
 .admin-dashboard-bar-item {
@@ -513,6 +584,90 @@ button:disabled {
   grid-template-columns: minmax(0, 1.1fr) minmax(300px, 0.9fr);
 }
 
+.admin-accounts-layout {
+  display: grid;
+  grid-template-columns: minmax(240px, 0.42fr) minmax(0, 1fr);
+  gap: 16px;
+  align-items: start;
+}
+
+.admin-account-list {
+  align-content: start;
+}
+
+.admin-account-list-items {
+  display: grid;
+  gap: 8px;
+}
+
+.admin-account-list-items > button {
+  display: flex;
+  min-width: 0;
+  min-height: 58px;
+  align-items: center;
+  justify-content: space-between;
+  gap: 12px;
+  border: 1px solid #eaded2;
+  border-radius: 8px;
+  color: #755a49;
+  background: #fffdf9;
+  padding: 10px 12px;
+  text-align: left;
+}
+
+.admin-account-list-items > button[data-active="true"] {
+  border-color: #c87955;
+  background: #f9eee5;
+}
+
+.admin-account-list-items > button > span {
+  display: grid;
+  min-width: 0;
+  gap: 3px;
+}
+
+.admin-account-list-items strong,
+.admin-account-list-items small {
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.admin-account-list-items small {
+  color: #8f7868;
+  font-size: 12px;
+}
+
+.admin-permission-fieldset {
+  min-width: 0;
+  margin: 0;
+  border: 1px solid #e1ccbb;
+  border-radius: 8px;
+  padding: 14px;
+}
+
+.admin-permission-fieldset legend {
+  color: #6f5848;
+  font-size: 13px;
+  font-weight: 750;
+  padding: 0 6px;
+}
+
+.admin-permission-grid {
+  display: grid;
+  grid-template-columns: repeat(3, minmax(0, 1fr));
+  gap: 10px 14px;
+}
+
+.admin-permission-grid label {
+  display: flex;
+  min-width: 0;
+  align-items: center;
+  gap: 8px;
+  color: #5f4738;
+  font-size: 13px;
+}
+
 .admin-stack,
 .admin-form {
   display: grid;
@@ -566,7 +721,17 @@ button:disabled {
 }
 
 .admin-inline-identity > div {
+  display: grid;
   min-width: 0;
+  gap: 2px;
+}
+
+.admin-inline-identity small {
+  display: block;
+  max-width: 100%;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
 }
 
 .admin-database-user-cell,
@@ -655,6 +820,55 @@ button:disabled {
   display: block;
 }
 
+.admin-asset-query-resource-cell {
+  display: flex;
+  align-items: flex-start;
+  gap: 6px;
+}
+
+.admin-asset-query-resource-cell > div:last-child small {
+  display: block;
+  max-width: 92px;
+  margin-top: 4px;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.admin-asset-query-expand-button {
+  display: inline-flex;
+  flex: 0 0 28px;
+  width: 28px;
+  height: 28px;
+  align-items: center;
+  justify-content: center;
+  border: 0;
+  background: transparent;
+  color: #78523e;
+  cursor: pointer;
+}
+
+.admin-asset-query-expand-spacer,
+.admin-asset-query-child-branch {
+  display: block;
+  flex: 0 0 28px;
+  width: 28px;
+}
+
+.admin-asset-query-child-row {
+  background: #fffaf5;
+}
+
+.admin-asset-query-resource-cell-child {
+  padding-left: 12px;
+}
+
+.admin-asset-query-child-branch {
+  height: 34px;
+  border-bottom: 1px solid #d8c3b3;
+  border-left: 1px solid #d8c3b3;
+}
+
 .admin-asset-query-prompt-text {
   display: block;
   max-width: 100%;
@@ -1117,7 +1331,7 @@ button:disabled {
   margin: 0;
 }
 
-.admin-info-list div {
+.admin-info-list > div {
   display: grid;
   grid-template-columns: minmax(90px, 0.34fr) minmax(0, 1fr);
   gap: 12px;
@@ -1307,29 +1521,30 @@ button:disabled {
 }
 
 .admin-asset-query-table {
+  min-width: 1080px;
   table-layout: fixed;
 }
 
 .admin-asset-query-table th:nth-child(1),
 .admin-asset-query-table td:nth-child(1) {
-  width: 10%;
+  width: 13%;
 }
 
 .admin-asset-query-table th:nth-child(2),
 .admin-asset-query-table td:nth-child(2),
 .admin-asset-query-table th:nth-child(3),
 .admin-asset-query-table td:nth-child(3) {
-  width: 14%;
+  width: 13%;
 }
 
 .admin-asset-query-table th:nth-child(4),
 .admin-asset-query-table td:nth-child(4) {
-  width: 34%;
+  width: 27%;
 }
 
 .admin-asset-query-table th:nth-child(5),
 .admin-asset-query-table td:nth-child(5) {
-  width: 8%;
+  width: 10%;
 }
 
 .admin-asset-query-table th:nth-child(6),
@@ -1337,6 +1552,11 @@ button:disabled {
   width: 10%;
 }
 
+.admin-asset-query-table th:nth-child(7),
+.admin-asset-query-table td:nth-child(7) {
+  width: 10%;
+}
+
 .admin-showcase-review-table {
   table-layout: fixed;
 }
@@ -1861,6 +2081,7 @@ button:disabled {
   .admin-dashboard-operations,
   .admin-two-column,
   .admin-two-column-wide,
+  .admin-accounts-layout,
   .admin-pricing-grid,
   .admin-form-row,
   .admin-filter-grid,
@@ -1870,6 +2091,10 @@ button:disabled {
     grid-template-columns: 1fr;
   }
 
+  .admin-permission-grid {
+    grid-template-columns: repeat(2, minmax(0, 1fr));
+  }
+
   .admin-dashboard-heading {
     display: grid;
   }
@@ -1890,10 +2115,19 @@ button:disabled {
   }
 
   .admin-dashboard-metric-grid,
-  .admin-dashboard-operation-grid {
+  .admin-dashboard-operation-grid,
+  .admin-dashboard-retention-grid {
     grid-template-columns: repeat(2, minmax(0, 1fr));
   }
 
+  .admin-dashboard-retention-card:nth-child(odd) {
+    border-left: 0;
+  }
+
+  .admin-dashboard-retention-card:nth-child(n + 3) {
+    border-top: 1px solid #ead8ca;
+  }
+
   .admin-field-compact {
     max-width: none;
   }
@@ -1965,6 +2199,10 @@ button:disabled {
 }
 
 @media (max-width: 560px) {
+  .admin-permission-grid {
+    grid-template-columns: 1fr;
+  }
+
   .admin-login-panel,
   .admin-panel {
     padding: 16px;
@@ -2022,11 +2260,19 @@ button:disabled {
     font-size: 22px;
   }
 
-  .admin-info-list div {
+  .admin-info-list > div {
     grid-template-columns: 1fr;
     gap: 3px;
   }
 
+  .admin-asset-query-detail-layout {
+    grid-template-columns: 1fr;
+  }
+
+  .admin-asset-query-detail-thumb-button {
+    justify-self: center;
+  }
+
   .admin-dashboard-tabs {
     width: 100%;
   }
@@ -2035,8 +2281,30 @@ button:disabled {
     grid-template-columns: 1fr;
   }
 
+  .admin-dashboard-retention-card {
+    grid-template-columns: 1fr;
+    grid-template-rows: auto;
+  }
+
+  .admin-dashboard-retention-card + .admin-dashboard-retention-card {
+    border-top: 1px solid #ead8ca;
+    border-left: 0;
+  }
+
+  .admin-dashboard-retention-card > strong {
+    grid-row: auto;
+    grid-column: auto;
+  }
+
+  .admin-dashboard-retention-card > div {
+    align-items: flex-start;
+    flex-direction: column;
+    gap: 3px;
+  }
+
   .admin-dashboard-metric-grid,
-  .admin-dashboard-operation-grid {
+  .admin-dashboard-operation-grid,
+  .admin-dashboard-retention-grid {
     grid-template-columns: 1fr;
   }
 
diff --git a/deploy/container/api-server.env.example b/deploy/container/api-server.env.example
index 002bc4990..0cca35b21 100644
--- a/deploy/container/api-server.env.example
+++ b/deploy/container/api-server.env.example
@@ -58,6 +58,7 @@ AUTH_REFRESH_COOKIE_SECURE=false
 GENARRATIVE_SPACETIME_SERVER_URL=http://spacetimedb:3101
 GENARRATIVE_SPACETIME_DATABASE=genarrative-loadtest
 GENARRATIVE_SPACETIME_TOKEN=
+# HTTP 角色使用 8 条无 read-model 订阅的调用连接，并额外创建 1 条共享缓存读连接。
 GENARRATIVE_SPACETIME_POOL_SIZE=8
 GENARRATIVE_SPACETIME_PROCEDURE_TIMEOUT_SECONDS=45
 
diff --git a/deploy/env/api-server.env.example b/deploy/env/api-server.env.example
index 2e4406d75..617553225 100644
--- a/deploy/env/api-server.env.example
+++ b/deploy/env/api-server.env.example
@@ -69,6 +69,7 @@ GENARRATIVE_SPACETIME_DATABASE=genarrative-prod
 GENARRATIVE_SPACETIME_TOKEN=
 # 只保存受保护文件路径；不要把 bootstrap secret 明文写入生产 env。
 GENARRATIVE_SPACETIME_RUNTIME_SERVICE_BOOTSTRAP_SECRET_FILE=/var/lib/genarrative/spacetime/runtime-service-bootstrap-secret.txt
+# HTTP 角色使用 8 条无 read-model 订阅的调用连接，并额外创建 1 条共享缓存读连接。
 GENARRATIVE_SPACETIME_POOL_SIZE=8
 GENARRATIVE_SPACETIME_PROCEDURE_TIMEOUT_SECONDS=45
 
diff --git a/docs/README.md b/docs/README.md
index 67c19ef4b..c177be6ec 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -46,7 +46,7 @@ React 组件测试的用户行为、稳定契约、hook / model 分层断言口
 
 本地通过 SSH alias 管理多台服务器、查看硬件 / systemd / HTTP 健康状态并执行受控服务启停的 egui 桌面工具见 [【开发运维】本地SSH服务器管理面板技术方案-2026-06-11.md](./technical/【开发运维】本地SSH服务器管理面板技术方案-2026-06-11.md)。
 
-生产部署切换到 systemd + Nginx + SpacetimeDB 自托管的总方案见 [PRODUCTION_DEPLOYMENT_PLAN_2026-05-02.md](./technical/PRODUCTION_DEPLOYMENT_PLAN_2026-05-02.md)，该文档也是当前生产 Jenkinsfile 的唯一入口。Pingora 只作为独立二进制影子网关试点时，边界、路由口径与替换前验收见 [【开发运维】Pingora独立网关试点-2026-06-11.md](./technical/【开发运维】Pingora独立网关试点-2026-06-11.md)。SpacetimeDB 表结构变更、自动迁移边界和保留旧数据的分阶段迁移流程见 [SPACETIMEDB_SCHEMA_CHANGE_CONSTRAINTS.md](./technical/SPACETIMEDB_SCHEMA_CHANGE_CONSTRAINTS.md)；private 表迁移 JSON 导入导出、HTTP 413 分片导入和旧数据库迁移流水线经验见 [SPACETIMEDB_JSON_STRING_MIGRATION_PROCEDURE_2026-04-27.md](./technical/SPACETIMEDB_JSON_STRING_MIGRATION_PROCEDURE_2026-04-27.md) 与 [JENKINS_SPACETIMEDB_DATABASE_MIGRATION_PIPELINES_2026-04-29.md](./technical/JENKINS_SPACETIMEDB_DATABASE_MIGRATION_PIPELINES_2026-04-29.md)；后台管理独立前端工程技术方案见 [ADMIN_WEB_CONSOLE_TECHNICAL_SOLUTION_2026-04-30.md](./technical/ADMIN_WEB_CONSOLE_TECHNICAL_SOLUTION_2026-04-30.md)，Dashboard 默认入口、运营指标和统计口径见 [【后台管理】Dashboard运营看板方案-2026-06-23.md](./technical/【后台管理】Dashboard运营看板方案-2026-06-23.md)。
+生产部署切换到 systemd + Nginx + SpacetimeDB 自托管的总方案见 [PRODUCTION_DEPLOYMENT_PLAN_2026-05-02.md](./technical/PRODUCTION_DEPLOYMENT_PLAN_2026-05-02.md)，该文档也是当前生产 Jenkinsfile 的唯一入口。Pingora 只作为独立二进制影子网关试点时，边界、路由口径与替换前验收见 [【开发运维】Pingora独立网关试点-2026-06-11.md](./technical/【开发运维】Pingora独立网关试点-2026-06-11.md)。SpacetimeDB 表结构变更、自动迁移边界和保留旧数据的分阶段迁移流程见 [SPACETIMEDB_SCHEMA_CHANGE_CONSTRAINTS.md](./technical/SPACETIMEDB_SCHEMA_CHANGE_CONSTRAINTS.md)；private 表迁移 JSON 导入导出、HTTP 413 分片导入和旧数据库迁移流水线经验见 [SPACETIMEDB_JSON_STRING_MIGRATION_PROCEDURE_2026-04-27.md](./technical/SPACETIMEDB_JSON_STRING_MIGRATION_PROCEDURE_2026-04-27.md) 与 [JENKINS_SPACETIMEDB_DATABASE_MIGRATION_PIPELINES_2026-04-29.md](./technical/JENKINS_SPACETIMEDB_DATABASE_MIGRATION_PIPELINES_2026-04-29.md)；后台管理独立前端工程技术方案见 [ADMIN_WEB_CONSOLE_TECHNICAL_SOLUTION_2026-04-30.md](./technical/ADMIN_WEB_CONSOLE_TECHNICAL_SOLUTION_2026-04-30.md)，Dashboard 默认入口、运营指标和统计口径见 [【后台管理】Dashboard运营看板方案-2026-06-23.md](./technical/【后台管理】Dashboard运营看板方案-2026-06-23.md)，owner/member 多账号、18 个一级 Tab 权限和逐请求鉴权方案见 [【后台管理】多账号与Tab访问权限方案-2026-07-14.md](./technical/【后台管理】多账号与Tab访问权限方案-2026-07-14.md)。
 
 SpacetimeDB 表结构变更、自动迁移边界和保留旧数据的分阶段迁移流程见 [SPACETIMEDB_SCHEMA_CHANGE_CONSTRAINTS.md](./technical/SPACETIMEDB_SCHEMA_CHANGE_CONSTRAINTS.md)。
 
diff --git a/docs/project-memory/shared-memory/decision-log.md b/docs/project-memory/shared-memory/decision-log.md
index ccf5ba094..beabdfa46 100644
--- a/docs/project-memory/shared-memory/decision-log.md
+++ b/docs/project-memory/shared-memory/decision-log.md
@@ -66,19 +66,27 @@
 - 验证方式：确定性测试覆盖发现根、优先级、YAML/路径/符号链接/预算、metadata 清洗、正文按需可见和 fingerprint 漂移；正式 `openai_chat / gpt-5.5` 的 `project-skill` suite 必须证明 hash-only fixture 先失败、匹配 Skill 在首个变更前读取、无关 Skill 不读取、唯一目标文件修改、Agent 与宿主验证通过，以及 Provider lifecycle、唯一回复、配置隔离和零泄漏全部闭合。
 - 关联文档：`docs/technical/【技术方案】AI游戏创作Agent Runtime V1.1-2026-07-12.md`、`docs/technical/【技术方案】AI游戏创作智能体App实施计划-2026-06-24.md`。
 
-## 2026-07-13 图片画布生成资源支持提交前统一命名
+## 2026-07-14 后台账号采用 owner 引导账号与一级 Tab 实时授权
+
+- 背景：后台此前只支持一组环境变量管理员，所有 `/admin/api/*` 共用统一 admin 门禁，无法给运营、审核等人员分配独立账号和页面范围。
+- 决策：现有 `GENARRATIVE_ADMIN_USERNAME/PASSWORD` 账号固定作为不可编辑 owner；新增 member 独立保存到私有 `admin_account` 表，密码使用 Argon2id 摘要。登录凭据快照与普通账号快照在类型层分离，普通列表、按 ID 查询和写入响应不包含 `password_hash`。Argon2id 在 blocking 任务中运行并由 api-server 有界限流；未知、停用和 owner 错密账号使用 dummy hash 抹平耗时。member 权限粒度固定为后台 18 个一级 Tab，“账号管理”只允许 owner 且不可授予 member。member 每次请求重新读取当前账号并校验启停、`token_version` 和 Tab 权限；权限、密码或启停变化递增版本并立即淘汰旧 JWT。账号不存在返回 `401`，SpacetimeDB 故障保留 `502/503` 而不清理有效 token。前端导航过滤和页面挂载门禁只负责体验，正式授权由 api-server 的 API-to-Tab 矩阵执行，未登记的新后台路由对 member 默认拒绝。后台面向运营展示管理员身份时统一使用 `displayName`；持久审计仍保存稳定 subject，由 api-server 解析显示名称，前端不得暴露账号 ID 或用登录用户名代替。写接口必须在主事务前加载显示名目录，或在主事务后降级解析，不能把已提交写入伪装为失败。
+- 影响范围：`admin_account`、SpacetimeDB typed procedures / client facade、后台 JWT 与 session DTO、`/admin/api/accounts*`、后台路由权限中间件、admin-web 导航和账号管理页。
+- 验证方式：SpacetimeDB schema / client / API 定向测试、`npm run check:admin-account-procedures` 隔离 procedure smoke、完整路由矩阵测试、admin-web 权限路由与账号 API 测试、owner/member 浏览器 smoke、`npm run check:spacetime-schema`、编码与 diff 门禁。
+- 关联文档：`docs/technical/【后台管理】多账号与Tab访问权限方案-2026-07-14.md`。
+
+## 2026-07-13 图片画布生成资源统一命名
 
 - 背景：图片画布的普通图片、规范、角色、图标图集、UI 设计、宣发素材、视频和音频默认使用“类型 + 数字”命名，用户只能在生成后单独重命名素材，画布图层、项目资源和素材库名称容易不一致。
-- 决策：主生成状态统一使用可选 `assetLabel`，所有生成面板提供同一个资源名称输入。名称最多 80 个字符，提交时去除首尾空格；留空时继续使用现有自动编号名称。一次提交解析出的名称必须同时用于 `assetLabel`、`canvasCompletion.title`、本地结果图层标题、项目资源和账号素材库，不允许各链路自行生成不同名称。
-- 派生产物：图标和角色动作后端契约补齐 `assetLabel`。带背景原图、图片修改 provider 原始输出等中间产物基于主名称追加“（原图）”或“（原始输出）”；图标切片继续按用户填写的图标描述命名，不继承图集名称覆盖独立素材语义。
+- 决策：主生成状态继续使用可选 `assetLabel`，名称最多 80 个字符并在提交时去除首尾空格；当前生成面板不展示“资源名称”标签和输入框，默认沿用现有自动编号名称，历史状态或内部调用若携带非空名称，仍必须让同一个名称贯穿 `assetLabel`、`canvasCompletion.title`、本地结果图层标题、项目资源和账号素材库，不允许各链路自行生成不同名称。移除名称输入后，角色、图标图集、UI 设计和角色动作等提示词输入恢复统一可见边框。
+- 派生产物：图标和角色动作后端契约补齐 `assetLabel`。带背景原图、角色动作绿幕预览等具有独立复用价值的中间产物基于主名称追加“（原图）”等后缀；普通图片和图片修改的纯尺寸变换在内存完成后只上传一次，不生成“原始输出”副本。图标切片继续按用户填写的图标描述命名，不继承图集名称覆盖独立素材语义。
 - 影响范围：图片画布生成状态与面板、提交模型、图标和角色动作请求契约、项目资源 / 素材库持久化和相关编辑器文档。
-- 验证方式：覆盖自定义名、空白回退、长度限制，以及图片 / 图标 / 视频 / 音频 / 角色动作的请求名称、完成快照标题和素材名称一致性；运行前端定向测试、Rust 契约与 API 定向测试、`npm run typecheck`、`npm run check:encoding`、`git diff --check`。
+- 验证方式：覆盖生成面板不渲染资源名称输入、提示词边框、空白回退、内部自定义名与长度限制，以及图片 / 图标 / 视频 / 音频 / 角色动作的请求名称、完成快照标题和素材名称一致性；运行前端定向测试、Rust 契约与 API 定向测试、`npm run typecheck`、`npm run check:encoding`、`git diff --check`。
 
 ## 2026-07-13 图片画布多产物生成任务必须保存全部可恢复产物
 
 - 背景：角色形象、图标 spritesheet 和 UI 素材提取会先得到带纯色背景的原图，再执行抠图或拆分；图片修改会先得到模型对齐尺寸的原始输出，角色动作会先得到绿幕预览视频，再抽帧和抠图。此前部分原始产物只登记到 OSS，或者要等后处理成功后才进入项目资源，用户无法在失败后找回已经生成成功的内容。
-- 决策：凡一次资产生成任务产生多个可恢复产物，后端必须先把上游已返回的中间产物写入 OSS、`asset_object`、项目资源和账号素材库，再执行抠图、尺寸恢复、抽帧或拆分；未指定素材文件夹时进入默认“项目”文件夹。角色形象、图标 spritesheet 和 UI 素材提取同时保留纯色背景原图与透明后处理结果；图片修改保留模型原始输出与尺寸恢复结果；角色动作把绿幕预览视频作为一个可复用素材保存，逐帧源图继续留在同一任务 OSS 路径，不把 32 至 48 帧逐张灌入素材库。普通图片、去背景、音频等没有独立上游中间产物的任务不制造重复副本。
-- 画布与降级：有项目上下文的图片多产物继续由同一次 `canvasCompletion` 写入权威画布快照，生成器 `generatedLayerId` 锚定主后处理结果。图标和 UI 图集自动拆分是 best-effort；识别或切片持久化失败仍完成整张透明图集，并在 inline、队列轮询和刷新后任务列表中提示非阻断 warning，不得借用失败错误字段。
+- 决策：凡一次资产生成任务产生多个具有独立复用价值的产物，后端必须把上游已返回的中间产物写入 OSS、`asset_object`、项目资源和账号素材库，再执行抠图、抽帧或拆分；未指定素材文件夹时进入默认“项目”文件夹。角色形象、图标 spritesheet 和 UI 素材提取同时保留纯色背景原图与透明后处理结果。普通图片和图片修改的纯尺寸变换不属于独立产物：provider 回图保留在内存，变换成功只上传变换结果，变换失败只上传 provider 原图，整个流程只写一次 OSS 并只创建一个素材，不能制造重复“原始输出”。`nanobanana2` 使用标量清晰度档位和独立比例，保留 provider 输出尺寸，不按 `WIDTHxHEIGHT` 解析。角色动作把绿幕预览视频作为一个可复用素材保存，逐帧源图继续留在同一任务 OSS 路径，不把 32 至 48 帧逐张灌入素材库。去背景、音频等没有独立上游中间产物的任务不制造重复副本。
+- 画布、成本与降级：有项目上下文的图片多产物继续由同一次 `canvasCompletion` 写入权威画布快照，生成器 `generatedLayerId` 锚定主后处理结果。图标和 UI 图集自动拆分是 best-effort；识别或切片持久化失败仍完成整张透明图集，并在 inline、队列轮询和刷新后任务列表中提示非阻断 warning，不得借用失败错误字段。provider 原图或角色动作预览视频承载该任务的模型生成成本，抠图、逐帧处理、透明图集和切片等后处理派生产物的 `generation_cost_mud_points = 0`，避免把生图成本误显示成抠图成本；所有中间产物沿用所属任务的真实 `asset_kind`，角色原图仍为 `character`、图标和 UI 图集原图仍为 `icon-spritesheet`、角色动作预览仍为 `character-animation`，不得再写新的“原图类型”。后台素材查询按任务分页，最终产物作为父行并显示任务总成本，每个中间产物作为可展开的独立子行显示阶段生成器和阶段成本。扣费确认边界保持为 provider 成功，OSS、尺寸恢复和画布回填不延长退款保护。
 - 影响范围：`server-rs/crates/api-server/src/editor_project.rs`、`character_animation_assets.rs`、外部生成任务摘要、图片画布完成快照、账号素材库和前端生成提示。
 - 验证方式：覆盖中间产物登记先于后处理、默认素材文件夹、图集拆分降级、inline / queue warning 和主结果锚定的定向测试，并运行 `cargo check -p api-server --manifest-path server-rs/Cargo.toml`、`npm run check:spacetime-schema`、前端定向测试、`npm run check:encoding`、`git diff --check`。
 - 关联文档：`docs/【编辑器】生成类面板Lovart统一改造方案-2026-06-17.md`、`docs/technical/【前端架构】图片画布编辑器MVP接入方案-2026-06-11.md`。
@@ -294,6 +302,7 @@
 - 决策：`陶泥儿精选` 的公开事实改为独立 `editor_showcase_asset` 审核表。生成素材默认不公开；用户在账号级素材库对 `sourceType="generated"` 且有媒体内容的素材提交审核，后端快照素材信息并写入 `pending`。后台审核通过后写入 `approved`，但默认 `display_enabled=false` 且 `showcase_category=null`，运营可按前台具体 Tab 手动设置分类并开启展示；未设置分类的素材展示开启后进入前台“全部”，但不进入角色 / UI / 音乐 / 美宣具体分类。审核通过时按 `generation_cost_mud_points` 返还 50% 泥点；拒绝后写入 `rejected`。公开接口 `GET /api/editor/showcase/resources` 返回已通过、展示开启且媒体非空的快照，按通过时间和 `showcaseId` 倒序分页，并可携带后台配置的固定活动卡。旧 `editor_project_resource.public_showcase_enabled` 和旧 PATCH 接口只保留兼容，不再驱动精选公开。
 - 影响范围：`server-rs/crates/spacetime-module/src/editor_project_storage.rs`、`spacetime-client` 绑定与 mapper、`api-server` 编辑器和后台路由、admin-web 精选审核页、素材库右键菜单、`/creation` 精选瀑布流、图片画布文档和后端表目录。
 - 验证方式：运行 `npm run spacetime:generate`、`npm run check:spacetime-schema`、`cargo check --manifest-path server-rs/Cargo.toml -p spacetime-module -p spacetime-client -p api-server`、前端 / 后台 typecheck 与精选相关组件测试，确认默认不公开、提交后 pending、审核通过后展示和返还、展示开关与点赞生效。
+- 后续修正：精选批准、确定性返还流水和返还完成标记必须由同一个 SpacetimeDB procedure 在单事务内落地，失败时不得先留下 `approved`；已公开精选私有对象通过同 owner 的精确 `assetObjectId` / `objectKey` 派生匿名读取授权，不把 `generated-*` 前缀整体公开。
 - 关联文档：`docs/【玩法创作】创作主页与项目入口改版计划-2026-06-18.md`、`docs/technical/【前端架构】图片画布编辑器MVP接入方案-2026-06-11.md`、`docs/【后端架构】server-rs与SpacetimeDB数据契约-2026-05-15.md`。
 
 ## 2026-07-03 外部编辑器 API 生成默认写入画布与素材库
@@ -503,7 +512,7 @@
 ## 2026-06-18 图片画布 UI 设计图提取素材保留图集
 
 - 背景：UI 设计图需要从成图中继续抽取可复用独立素材；原图标素材生成只把拆分后的图标放入画布，spritesheet 原图没有保留，后续追溯和二次切图不方便。
-- 决策：`assetKind="ui-design"` 图层浮动工具栏新增 `提取素材`，点击后先进入红框素材框选编辑态，默认矩形框选，并支持椭圆框选和画笔自由框选。至少存在一个框选区域后才能提交；前端把红色轮廓绘入原 UI 设计图并将合成图作为 `/api/editor/ui-designs/assets/extractions` 的参考图。后端固定 `gpt-image-2` 和纯色背景素材提取提示词，返回结构复用图标 spritesheet 响应。UI 提取把 spritesheet 图集作为 `assetKind="icon-spritesheet"` 图层放到画布，再放拆分后的 `assetKind="icon"` 素材。2026-07-03 起，UI 提取的纯色背景由 `screenColor` 选择并经 BgFilter 透明化。2026-07-13 起，图标素材生成先把带背景原图和透明 spritesheet 同时写入项目资源、账号素材库并回填画布，未指定文件夹时落默认“项目”文件夹，再 best-effort 按 alpha 连通域拆分独立图标；拆分失败不改变生成成功状态，响应以空 `iconImageSrcs` 和结构化 `sliceWarning` 返回原因，用户可从图集工具栏手动重试。手动拆分不计费，限制单边 `4096`、总像素 `2048×2048`、最多 `64` 个切片，所有切片用 `sourceResourceId` 指向透明图集。本条新决策取代“图标素材生成只保留图集”的旧口径。
+- 决策：`assetKind="ui-design"` 图层浮动工具栏新增 `提取素材`，点击后先进入红框素材框选编辑态，默认矩形框选，并支持椭圆框选和画笔自由框选。至少存在一个框选区域后才能提交；前端把红色轮廓绘入原 UI 设计图并将合成图作为 `/api/editor/ui-designs/assets/extractions` 的参考图。后端固定 `gpt-image-2` 和纯色背景素材提取提示词，返回结构复用图标 spritesheet 响应。UI 提取把 spritesheet 图集作为 `assetKind="icon-spritesheet"` 图层放到画布，再放拆分后的 `assetKind="icon"` 素材。2026-07-03 起，UI 提取的纯色背景由 `screenColor` 选择并经 BgFilter 透明化。2026-07-13 起，图标素材生成先把带背景原图和透明 spritesheet 同时写入项目资源、账号素材库并回填画布，未指定文件夹时落默认“项目”文件夹，再 best-effort 按 alpha 连通域拆分独立图标；拆分失败不改变生成成功状态，响应以空 `iconImageSrcs` 和结构化 `sliceWarning` 返回原因，用户可从图集工具栏手动重试。手动拆分不计费，限制单边 `4096`、总像素 `2048×2048`、最多 `64` 个切片，所有切片用 `sourceResourceId` 指向透明图集。`icon-spritesheet` 图集继续显示并允许快速编辑，只有拆分后的 `assetKind="icon"` 单图标隐藏并拒绝快速编辑；工具栏、右键菜单、打开流程和提交兜底必须共用同一判定。本条新决策取代“图标素材生成只保留图集”的旧口径。
 - 影响范围：图片画布浮动工具栏、编辑器图片生成 BFF、`platform-image` 图集连通域拆分、画布图层类型和编辑器文档。
 - 验证方式：运行图片画布工具栏 / 图集落层 / 生成提交相关前端测试，`cargo test -p platform-image generated_asset_sheets --manifest-path server-rs/Cargo.toml`，以及 `cargo test -p api-server editor_ui_design_asset_extraction_prompt_is_fixed --manifest-path server-rs/Cargo.toml`。
 - 关联文档：`docs/【编辑器】画板UI设计图生成入口设计-2026-06-17.md`、`docs/【编辑器】画板图标素材生成入口设计-2026-06-15.md`。
@@ -4730,9 +4739,44 @@
 ## 2026-07-13 后台充值退款使用钱包占用与统一用户详情
 
 - 背景：普通 V3 退款已经能从回调、查单和账单收口现金事实，但后台主动退款若先调微信再扣泥点，会在用户余额不足时产生本可避免的欠账；后台各页面也没有统一查询用户余额、绑定状态和充值订单的入口。
-- 决策：新增 `profile_recharge_refund_hold`，后台执行退款前按累计部分退款公式原子占用本次应追回的永久泥点，再使用客户端稳定 `requestId` 派生 `out_refund_no` 调微信。部分退款额外占用 1 泥点并发舍入缓冲，防止占用创建后到达的外部退款跨越累计 `floor` 边界；全额退款不加缓冲。`SUCCESS` 扣款并结算匹配占用，`CLOSED` 释放，`PROCESSING / ABNORMAL` 保持；结果未知时不擅自释放，至少等待 10 分钟并连续 3 次退款查单收到官方 `RESOURCE_NOT_EXISTS` 才由 worker 释放。普通消费必须排除全部活动占用。
+- 决策：新增 `profile_recharge_refund_hold`，后台执行退款前按累计部分退款公式原子占用本次应追回的永久泥点，再使用客户端稳定 `requestId` 派生 `out_refund_no` 调微信。重试必须同时匹配原订单、退款号、退款金额、管理员和归一化原因，不能绕过底层完整幂等校验。部分退款额外占用 1 泥点并发舍入缓冲，防止占用创建后到达的外部退款跨越累计 `floor` 边界；全额退款不加缓冲。`SUCCESS` 扣款并结算匹配占用，`CLOSED` 释放，`PROCESSING / ABNORMAL` 保持；结果未知时不擅自释放，至少等待 10 分钟并连续 3 次退款查单收到官方 `RESOURCE_NOT_EXISTS` 才由 worker 释放。普通消费必须排除全部活动占用。
 - 欠账与冻结：支付侧已经成功退款时不能回滚现金事实；永久泥点不足部分继续只写订单 settlement 的 `unrecovered_points`，限制普通消费，后续永久泥点优先自动偿还。每日免费和会员周期泥点不参与。人工冻结单独使用 `profile_wallet_manual_restriction`，解除人工冻结不解除退款欠账限制。
-- 人工复核：交易号或订单总额冲突只允许管理员确认退款归属，退款行追加不可变的管理员、原因、时间后重新运行标准结算；该操作不是“直接解冻”，余额不足仍形成欠账。会员退款、未知错误和非法结算计划不显示该入口，也不能复用泥点钱包冻结语义。
+- 人工复核：交易号或订单总额冲突只允许管理员确认退款归属；管理员 DTO 与确认面板必须并排展示本地订单和微信退款事实的交易号、订单总额与冲突类型。提交请求携带界面所见 `expectedErrorCode`，SpacetimeDB 事务核对当前错误码一致后，退款行才追加不可变的管理员、原因、时间和获批错误码并重新运行标准结算；已处理请求只有管理员、归一化原因和错误码全部一致时才视为幂等重放，状态变化或任一审计内容不一致继续 fail-closed。获批错误码通过正式读取契约展示，一次确认只豁免对应冲突，其他不变量继续 fail-closed。该操作不是“直接解冻”，余额不足仍形成欠账。会员退款、未知错误和非法结算计划不显示该入口，也不能复用泥点钱包冻结语义。
+- 发布基线：退款功能和退款事实表尚未进入 release，首次上线只以 release 已有 schema 和数据为迁移基线；不为 master 上未发布的退款中间结构保留旧行 normalization 或历史人工复核兼容。
 - 后台边界：充值订单、预检、执行、应急退款号登记、用户详情和钱包冻结均只挂在管理员鉴权路由。用户详情由 `user_id` 或陶泥号经认证服务解析，返回头像、昵称、脱敏手机号、绑定状态、钱包分桶、占用、欠账和最近订单；后台语义明确的用户字段复用同一个图标按钮和弹窗，管理员主体及 `admin:*` 合成 ID 不打开用户详情。
 - 部分退款预检：微信支付查单 `trade_state=REFUND` 只表示已发生退款，不代表全额退款。刷新已登记退款后，本地累计成功退款大于 0 且小于订单总额、且不存在非终态退款、活动 hold、欠账或人工冻结时，可以继续退本地剩余额度；没有本地成功退款事实能解释 `REFUND` 时继续失败关闭并要求登记或账单对账。
 - 影响范围：`module-runtime`、`spacetime-module`、`spacetime-client`、`api-server` 管理员 BFF / refund worker、`shared-contracts` 与 `apps/admin-web`。
+
+## 2026-07-14 Jenkins Git 源收口到本机 loopback
+
+- 背景：Jenkins controller 与 Gitea SSH 当前同机运行，live Job 的 `Pipeline script from SCM` 已使用 `127.0.0.1:2222`，但仓库 Jenkinsfile 内部 checkout 仍固定到局域网 IP，导致入口 SCM 与执行阶段来源不一致。
+- 决策：所有生产 Job 的 SCM URL 和 Jenkinsfile 内部源码准备统一使用 `ssh://git@127.0.0.1:2222/GenarrativeAI/Genarrative.git`，继续使用 `genarrative-local-gitea-ssh`，不保留局域网 IP、HTTP 内网或公网 fallback。该决策覆盖 2026-06-19 的局域网 SSH 地址口径。
+- 目标机边界：`127.0.0.1` 只允许在 Jenkins controller / Built-In Node 用于 Git。数据库导入导出与 Server-Provision 都必须在带 `linux && genarrative-build` 标签的 Built-In Node 完成 checkout 和 commit 校验，再通过 stash 把必要脚本交给 dev / release 目标 agent；目标 agent 不得自行 checkout Git 或挂载 Git SSH 凭据。
+- 影响范围：生产构建、Full、数据库导入导出和 Server-Provision Jenkinsfile，生产运维文档、共享踩坑记录与生产运维静态门禁。
+- 验证方式：`npm run check:production-ops`、`npm run check:encoding`、`bash -n scripts/jenkins-checkout-source.sh`、`git diff --check`；只读核对 live Job `config.xml` 的 SCM URL，并在 Jenkins 凭据环境对 loopback SSH 地址执行 `git ls-remote ... HEAD`。
+
+## 2026-07-14 后台 Dashboard 修正访问趋势并增加新增用户留存
+
+- 背景：Dashboard 本月范围包含未来日期，四张图可停在不同横向窗口；“访问人数”又把整个时段 UV 塞到终止日，0 值仍显示短柱。访问模块分布从 `tracking_event LIMIT 50000` 的任意截断样本计算，页面却继续展示精确值并产生置顶告警。
+- 决策：本周、本月快捷范围和手动日期均不晚于北京时间今天；访问人数趋势按日去重登录用户绘制，图头与时段卡保留跨日去重 UV，0 值不绘柱，四图同步横向滚动。“当前使用人数（五分钟统计一次）”纠正为滚动口径“近 5 分钟活跃用户”。
+- 聚合边界：不新增持久化表或字段；新增仅 runtime service identity 可调用的 `get_admin_dashboard_stats_and_return` procedure，在 SpacetimeDB 事务快照内聚合现有 profile、tracking 私有事实，经 `spacetime-client` facade 返回紧凑投影；素材与钱包仍走原查询。api-server 不再依赖固定 50,000 行原始明细读取来生成访问模块分布或精确统计；该权威聚合失败时 Dashboard 请求失败，不把未知统计降级成 0。
+- 扩展性边界：现有表缺少覆盖跨 scope、跨日期统计的现成索引，本阶段为保持精确性仍在 procedure 内遍历相关事实并监控耗时；数据规模继续增长时改为日期前缀索引或持久化日聚合事实，不恢复固定 `LIMIT` 截断。
+- 留存口径：筛选范围内 `profile_dashboard_state.created_at` 的北京时间注册日构成 cohort；在精确 `D+1` / `D+7` 存在有效登录 user scope 日聚合即留存。观察日必须早于今天；D1、D7 分别返回留存人数、可观察人数和四舍五入后的基点率，按人数加权汇总，零分母前端显示 `-`。
+- 影响范围：SpacetimeDB Dashboard 聚合 procedure、`spacetime-client` facade、`/admin/api/dashboard` 与 shared contracts、`apps/admin-web` Dashboard 页面和运营文档。
+- 验证方式：SpacetimeDB 聚合与 api-server 定向 Rust 测试、Dashboard Vitest、`npm run admin-web:typecheck`、`npm run check:spacetime-schema`、`npm run check:spacetime-runtime-access`、`npm run check:encoding`、`git diff --check`，并用桌面 / 移动浏览器核对留存、日期、每日 UV、零值与滚动同步。
+
+## 2026-07-15 后台 Dashboard 增加新增用户付费率
+
+- 背景：Dashboard 已能展示筛选时段的新增用户数和 D1 / D7 留存，但缺少同一新增 cohort 的真实付费转化指标。
+- 决策：新增用户付费率的分母为筛选期内 `profile_dashboard_state.created_at` 归属的新增用户，分子为其中截至查询时至少有一笔 `profile_recharge_order.paid_at` 的去重用户；已退款仍代表曾发生付费转化，未支付订单不计。
+- 聚合边界：继续扩展仅 runtime service identity 可调用的 `get_admin_dashboard_stats_and_return` procedure，不新增持久化表或字段，前端只展示 BFF 返回的付费人数、新增用户数和基点率。
+- 验证方式：SpacetimeDB Dashboard 聚合测试、api-server admin 测试、Dashboard Vitest、`npm run admin-web:typecheck`、`npm run check:spacetime-schema`、`npm run check:spacetime-runtime-access`、`npm run check:encoding`、`git diff --check`，并用桌面 / 移动浏览器核对付费率卡片。
+
+## 2026-07-14 SpacetimeDB 调用池与缓存读连接分离
+
+- 背景：HTTP 角色原先在每个 `GENARRATIVE_SPACETIME_POOL_SIZE` 槽位首次建连时订阅同一批 read model；release 配置为 8 时会保存 8 份相同行缓存和 subscription handles，放大 api-server 内存。
+- 决策：`pool_size` 条连接只承接 procedure / reducer 调用并保持无订阅；HTTP 角色额外创建且只创建 1 条共享缓存读连接，全部 `read_after_connect` 读取统一路由到该连接。缓存连接只在应用 facade 中作为只读用途，不宣称 SDK 或 identity 具备连接级只读权限。
+- 并发与恢复：缓存读连接通过 `Arc` 共享，读取不占用调用池 permit，也不使用单槽租约串行化；只有首次初始化和 broken 后重建使用单飞锁。首次建连与全部订阅共用一次总超时预算；required subscriptions 全部 applied、optional 阶段连接仍未 broken 后才发布新连接，旧连接由在途读取自然释放。
+- 就绪边界：HTTP `/readyz` 同时验证调用池握手和缓存读连接；required subscription 失败必须不就绪。非 HTTP worker / controller 不创建缓存读连接，继续使用 1 条调用连接和各自的队列窄订阅。
+- 运维口径：`GENARRATIVE_SPACETIME_POOL_SIZE=8` 表示 8 条调用连接，HTTP 基础拓扑另加 1 条缓存读连接；外部生成和充值过期监听的独立窄订阅不计入该值。读模型行缓存从 8 份降为 1 份，但 SDK 空 table metadata、8 条调用 socket 和 runner 仍存在，不承诺总 RSS 等比例降为八分之一。
+- 验证方式：`cargo test -p spacetime-client --manifest-path server-rs/Cargo.toml --lib`、`cargo check -p api-server --manifest-path server-rs/Cargo.toml`、`npm run check:encoding`、`git diff --check`；发布后在 8 个调用槽暖机后对比 api-server cgroup memory / PSS，并确认 `/readyz` 与代表性 gallery、公开详情、创作入口和用户标签读取正常。
diff --git a/docs/project-memory/shared-memory/development-workflow.md b/docs/project-memory/shared-memory/development-workflow.md
index e9c266805..c7de2181a 100644
--- a/docs/project-memory/shared-memory/development-workflow.md
+++ b/docs/project-memory/shared-memory/development-workflow.md
@@ -246,6 +246,19 @@ RAG 主要供 Agent 检索项目上下文，开发者仍按 `AGENTS.md`、`docs/
 
 ## 常用检查命令
 
+Rust 格式检查：
+
+```bash
+npm run check:rustfmt
+```
+
+仓库通过根目录 `rust-toolchain.toml` 固定 Rust `1.96.0` 和 `rustfmt` 组件，
+并通过 `rustfmt.toml` 固定 Edition 2024 格式口径。需要修复格式时运行：
+
+```bash
+cargo fmt --all --manifest-path server-rs/Cargo.toml
+```
+
 - 后端通用用户行为埋点统一通过 `record_tracking_event_and_return` procedure、`SpacetimeRuntimeClient::record_tracking_event(...)` 与 api-server `tracking` 中间件写入 `tracking_event` / `tracking_daily_stat`；后台、RPG、大鱼吃小鱼、Visual Novel、Story、Combat 默认排除；作品级游玩埋点统一使用 `work_play_start`，详细事件清单见 `docs/technical/BACKEND_TRACKING_EVENT_COVERAGE_2026-05-09.md`。
 
 编码检查：
diff --git a/docs/project-memory/shared-memory/pitfalls.md b/docs/project-memory/shared-memory/pitfalls.md
index 0ff53b029..9676c95db 100644
--- a/docs/project-memory/shared-memory/pitfalls.md
+++ b/docs/project-memory/shared-memory/pitfalls.md
@@ -55,6 +55,14 @@
 - 验证：`cargo check -p spacetime-client --manifest-path server-rs/Cargo.toml`、`cargo check -p api-server --manifest-path server-rs/Cargo.toml`、`npm run check:spacetime-schema`。
 - 关联：`server-rs/crates/spacetime-module/src/editor_project_storage.rs`、`server-rs/crates/spacetime-client/src/editor_project.rs`、`server-rs/crates/api-server/src/admin.rs`。
 
+## 后台素材查询要在分页前归一用户、游标和派生任务
+
+- 现象：输入 `SY-*` 陶泥号查不到已有素材；无筛选时只显示 80 个任务且没有“读取更多”；手动重拆图集后，`素材 N` 被单独当成零成本父任务，原图集又显示成另一组。
+- 原因：`editor_asset.owner_user_id` 保存内部 `user_id`，不保存公开陶泥号；作者陶泥号在 procedure 返回后才映射，不能直接参与素材表过滤。`spacetime-client` 的统一时间文本是 `seconds.microsZ`，若 cursor 只按 RFC3339 解析，第 80 个任务无法生成 `nextCursor`。手动图集拆分使用独立 `editor-atlas-split-*` 任务号，但切片项目资源通过 `source_resource_id` 指回原图集资源，只按当前 `task_id` 分组会割裂同一条素材生产链。
+- 处理：`api-server` 在调用素材 procedure 前把“用户 ID / 陶泥号”字段或精确 `SY-*` keyword 解析成内部 `user_id`；游标解析同时接受整数微秒、统一 `seconds.microsZ` 和 RFC3339，编码失败必须返回服务错误，不能伪装成末页，客户端传入的非法 cursor 必须返回 `400`，不能静默回到第一页。手动拆分素材保留真实 `task_id`，通过 `editor_asset_group_source_provenance` 按原 resource、asset object 或 Object Key 查找服务端生成账号素材的可信来源任务，再把来源任务写入 `editor_asset.group_task_id`；跨项目复用时同时携带当前和原始 source resource，首次历史回溯命中后补写 provenance，后续不再扫描账号全量素材。没有可信来源的新批次显式以自己的拆分任务作为 `group_task_id`，不得落回可读取用户资源元数据的 legacy 分支。每片保存 `group_task_expected_asset_count`，全部切片落库后再写不可逆的 `editor_asset_group_cohort` 完成事实；read model 依据完成事实判断批次资格，不用当前剩余行数猜测初始是否完整，因此用户后来删除切片不会让批次脱组。部分失败批次没有完成事实，始终保留为独立拆分任务。历史行兼容沿资源链回溯，删除项目时只固化直接引用待删资源且尚未固化的历史切片；固化始终保存真实来源任务，有界展示分组不得反写覆盖来源。read model 只让同根任务的一个完整拆分批次并入原任务，重复批次按真实拆分任务独立分页。带 owner 条件时先走 `by_editor_asset_owner_user_id`，不要为单用户查询扫描全站素材。后台筛选输入使用防抖并取消旧 transport；手动刷新同一查询失败时保留已有结果和游标，筛选已变化时不展示旧查询结果。
+- 验证：API 测试覆盖陶泥号组合条件、未知陶泥号、可信来源归组、`seconds.microsZ` / 极值游标和真实 / 归组 Task ID；SpacetimeDB 测试覆盖资源删除后稳定归组、部分失败批次不抢占根任务、重复拆分有界无丢失和 owner 索引分支；后台页面测试覆盖逐字输入防抖、请求取消、刷新失败保留结果、筛选请求乱序、旧分页响应失效和“用户 ID / 陶泥号”请求。再运行 `cargo test -p api-server admin_editor_asset --manifest-path server-rs/Cargo.toml`、`cargo test -p spacetime-module admin_editor_asset --manifest-path server-rs/Cargo.toml` 和 `npm run test -- apps/admin-web/src/pages/AdminEditorAssetQueryPage.test.tsx`。
+- 关联：`apps/admin-web/src/pages/AdminEditorAssetQueryPage.tsx`、`server-rs/crates/api-server/src/admin.rs`、`server-rs/crates/spacetime-module/src/editor_project_storage.rs`。
+
 ## 后台素材缩略图不要在首次挂载时全量换签
 
 - 现象：后台“素材查询”首批缩略图正常，继续向下滚动或读取更多后长期显示占位图；api-server journald 中已到达的 `/admin/api/assets/read-url` 可能全部是 `200`。
@@ -392,6 +400,14 @@
 - 验证：`npm run test -- src/components/image-editor/ImageCanvasGenerationDialogModel.test.ts src/components/image-editor/ImageCanvasQuickEditPanelView.test.tsx src/components/image-editor/useImageCanvasGenerationSubmissionWorkflow.test.tsx` 覆盖来源参数继承、模型参数切换、目标尺寸提交和图层回填；`cargo test -p api-server editor_image_edit --manifest-path server-rs/Cargo.toml` 覆盖图标类拒绝、provider 尺寸对齐和回图恢复。
 - 关联：`src/components/image-editor/ImageCanvasGenerationSubmissionModel.ts`、`src/components/image-editor/useImageCanvasGenerationSubmissionWorkflow.ts`、`src/components/image-editor/ImageCanvasGenerationLayerModel.ts`、`server-rs/crates/api-server/src/editor_project.rs`。
 
+## 图片画布纯尺寸变换必须先在内存决策再单次上传
+
+- 现象：`nanobanana2` 已返回并成功解码图片，任务随后报“尺寸无效”；普通生图若把尺寸恢复作为硬失败，provider 已成功回图后仍可能没有素材进入素材库和画布。
+- 原因：通用尺寸恢复把 `nanobanana2` 的标量清晰度档位 `512 / 1024 / 2K` 当成 `WIDTHxHEIGHT` 解析；普通图片与快速编辑还把 OSS 持久化放在尺寸恢复之后。同步 `generateContent` 返回的是内联 base64，本地兜底 task id 不能用于向 provider 回查原图。
+- 处理：`nanobanana2` 保留 provider 输出几何尺寸；其它模型仍按显式像素目标尝试恢复。普通生图和快速编辑先把 provider 回图留在内存，尺寸恢复成功后只上传变换结果，恢复失败则降级为只上传 provider 原图；每个主结果只执行一次 OSS 持久化并只创建一个素材。角色、图标图集、UI 提取和角色动作的 provider 原始输出按多产物语义单独保留并承载任务模型成本，后续抠图、逐帧处理和切片阶段成本为 0；中间产物沿用 `character`、`icon-spritesheet`、`character-animation` 等真实类型，不新增“原图类型”。扣费确认仍以 provider 成功为界，不延长到 OSS、后处理或画布回填；后台按任务显示最终产物父行，并把每个中间产物作为独立子行展开，分别展示阶段生成器和阶段成本。
+- 验证：`cargo test -p api-server editor_project --manifest-path server-rs/Cargo.toml` 覆盖 nanobanana 标量尺寸、变换失败回落 provider 原图、变换先于单次持久化；`cargo test -p api-server character_animation_assets --manifest-path server-rs/Cargo.toml` 覆盖角色动作原始预览的真实类型和成本归因；`npm run test -- apps/admin-web/src/pages/AdminEditorAssetQueryPage.test.tsx` 覆盖中间产物逐行展开和成本文案。
+- 关联：`server-rs/crates/api-server/src/editor_project.rs`、`apps/admin-web/src/pages/AdminEditorAssetQueryPage.tsx`。
+
 ## 图片画布快速编辑元数据必须记录原图引用
 
 - 现象：快速编辑生成的新图可以替换画布，但打开图片信息时“生成输入”里看不到被修改的原图。
@@ -954,12 +970,12 @@
 - 验证：`npm run test -- src/services/miniGameDraftGenerationProgress.test.ts -t "wooden fish"`，并观察木鱼生成页在 5 分钟以上等待时仍停留在合理阶段。
 - 关联：`src/services/miniGameDraftGenerationProgress.ts`、`docs/prd/【玩法创作】敲木鱼玩法模板PRD-2026-05-20.md`、`docs/【玩法创作】平台入口与玩法链路-2026-05-15.md`。
 
-## 敲木鱼点击生成出现 SpacetimeDB procedure 超时先查版本错配
+## 本地 SpacetimeDB procedure 超时或缺失先查版本错配
 
-- 现象：敲木鱼创作时点击“生成”，前端提示 `SpacetimeDB procedure 调用超时`，但服务端日志更早出现 `Failed to BSATN deserialize procedure return value` 或类似反序列化错误。
-- 原因：本机 `spacetime` CLI / standalone 版本与 `server-rs/Cargo.toml` 锁定的 `spacetimedb` 版本不一致时，procedure 返回值会在宿主侧反序列化失败，api-server 继续等待就表现成调用超时。若旧 standalone 进程还在复用，也会把这个错配继续带进新一轮创作。
-- 处理：先用 `spacetime --version` 确认 `spacetimedb tool version`，再和 `server-rs/Cargo.toml` 的 `spacetimedb = "..."` 对齐；遇到版本不匹配时先直接执行 `spacetime version install <version> && spacetime version use <version>`，或在目标就是最新版本时执行 `spacetime version upgrade`，升级后重启 `npm run dev:spacetime` 再重试。当前 dev 脚本会在启动和复用本地 SpacetimeDB 前写入并校验 `dev-spacetime-tool-version`，避免继续复用旧宿主。
-- 验证：`spacetime --version` 输出与 `server-rs/Cargo.toml` 一致，`http://127.0.0.1:3101/v1/ping` 正常，`npm run test -- scripts/dev.test.ts` 通过，敲木鱼创作点击生成不再卡在 procedure timeout。
+- 现象：敲木鱼创作时点击“生成”提示 `SpacetimeDB procedure 调用超时`，或后台 Dashboard 的指标与柱状图同时消失；服务端日志更早出现 `Failed to BSATN deserialize procedure return value`、`No such procedure`，Dashboard 请求返回 `502`。
+- 原因：本机 `spacetime` CLI / standalone 版本与 `server-rs/Cargo.toml` 锁定的 `spacetimedb` 版本不一致时，procedure 返回值会在宿主侧反序列化失败，api-server 继续等待就表现成调用超时。若旧 worktree 已删除但其 orphan standalone 仍监听原端口，API 还可能连到旧 wasm：健康检查正常，新 bindings 对应的 procedure 却尚未发布。
+- 处理：先用 `spacetime --version` 和监听端口对应的 `/proc/<pid>/exe --version` 分别核对 CLI 与真实宿主，再和 `server-rs/Cargo.toml` 的锁定版本对齐；不能把新版本模块硬发布到旧宿主。旧实例仍有需要保留的本地数据时，先用迁移 procedure 导出，在独立端口启动匹配版本、发布当前模块并增量导入，逐表对账后再把本次 API 切到新实例；旧实例在对账前不停止。当前 dev 脚本会对带版本记录的本地实例校验 `dev-spacetime-tool-version`，但显式连接历史端口时仍要核对真实进程和 module schema。
+- 验证：CLI、standalone 与 Cargo 锁定版本一致，`/v1/ping` 正常，`spacetime describe` 可找到调用中的 procedure；Dashboard 接口返回 `200` 且包含 4 张图，敲木鱼生成不再卡在 procedure timeout。另执行 `npm run test -- scripts/dev.test.ts` 验证本地调度门禁。
 - 关联：`scripts/dev.mjs`、`scripts/dev.test.ts`、`server-rs/Cargo.toml`、`docs/【开发运维】本地开发验证与生产运维-2026-05-15.md`。
 
 ## 拼图 UI spritesheet 运行态不要二次包圆底或拉伸比例
@@ -1904,13 +1920,13 @@
 - 验证：deploy 工作区应直接出现 `build/<version>/web.tar.gz` 与 `web.tar.gz.sha256`；后续仍由 `scripts/deploy/production-web-deploy.sh` 执行 checksum 校验和解压 smoke。
 - 关联：`jenkins/Jenkinsfile.production-web-deploy`、`docs/【开发运维】本地开发验证与生产运维-2026-05-15.md`。
 
-## Jenkins 生产流水线拉 Git 统一走内网 SSH
+## Jenkins 生产流水线拉 Git 统一走本机 SSH
 
-- 后续更新：2026-06-19 起常规构建 / 导入导出 / Full Build 流水线的 Jenkinsfile 内部 checkout 统一使用内网 SSH 地址 `ssh://git@192.168.35.82:2222/GenarrativeAI/Genarrative.git` 和凭据 `genarrative-local-gitea-ssh`，不再把 `http://genarrative-station/git/GenarrativeAI/Genarrative.git` 作为默认主源或 fallback，也不再配置公网 Git fallback；`Genarrative-Server-Provision` 仍是服务器初始化专用口径，Job 的 `Pipeline script from SCM` 和 Jenkinsfile 内部 checkout 都必须使用本机路径或目标 agent 可访问的内网 Git 源。
+- 后续更新：2026-07-14 起所有生产 Job 的 `Pipeline script from SCM` 和 Jenkinsfile 内部 checkout 统一使用本机 SSH 地址 `ssh://git@127.0.0.1:2222/GenarrativeAI/Genarrative.git` 与凭据 `genarrative-local-gitea-ssh`，不再保留局域网 IP、HTTP 内网地址或公网 fallback。
 - 现象：生产发布、数据库导入导出、服务器配置、构建或 `Genarrative-Full-Build-And-Deploy` 流水线执行 `GitSCM checkout` 时，如果 Jenkins 生成的 fetch 是 `+refs/heads/*:refs/remotes/origin/*`，公网 Git 链路可能在收包阶段以 `git-remote-https died of signal 15`、`curl 56 GnuTLS recv error (-9)`、`early EOF`、`invalid index-pack output` 失败；写死 `127.0.0.1:3000` 也会在当前执行 agent 不是 Gitea 所在机器时失败。
-- 原因：`127.0.0.1` 只代表当前执行阶段的 agent 自身；公网域名会绕外部链路并受公网代理、TLS、带宽和凭据影响。HTTP 私有仓库入口如果没有配置 Jenkins 凭据，会在 Git 插件日志中显示 `No credentials specified` 并以 `Failed to authenticate user` 失败。即使只使用内网 Git，如果 `GitSCM` 没有显式 refspec 并开启 `CloneOption honorRefspec=true`，Jenkins Git 插件也会拉取所有分支。
-- 处理：运行于 `linux && genarrative-build` 的 `Genarrative-Full-Build-And-Deploy` 源码解析阶段、`Genarrative-Web-Build` / `Genarrative-Api-Build` / `Genarrative-Stdb-Module-Build` checkout 阶段，以及数据库导入导出流水线的首次 `checkout([$class: 'GitSCM', ...])` 层统一使用 `GIT_REMOTE_URL=ssh://git@192.168.35.82:2222/GenarrativeAI/Genarrative.git` 和 `GIT_REMOTE_CREDENTIAL_ID=genarrative-local-gitea-ssh`，`GIT_REMOTE_FALLBACK_URL` 留空。这些首次 checkout 都必须使用目标分支 refspec、`CloneOption shallow=true depth=1 noTags=true honorRefspec=true`。后续统一走 `scripts/jenkins-checkout-source.sh`，构建类流水线以 `GENARRATIVE_JENKINS_REUSE_EXISTING_CHECKOUT=true` 复用首次 `GitSCM` 带凭据浅克隆，只有指定 commit 不在浅克隆里时才通过同一 SSH 凭据继续 fetch 和加深；`COMMIT_HASH` 为空时继续 `--depth=1 --no-tags`，指定 commit 时也先保持 `depth=1` 校验，浅历史无法证明归属时才按 `GENARRATIVE_JENKINS_CHECKOUT_DEEPEN_STEPS` 逐步加深，最后才展开完整历史。发布流水线不得为了缩短 checkout 时间清空上游构建传入的 `COMMIT_HASH`。
-- 验证：扫描本地 Jenkins live job `config.xml`，确认 SCM `<url>` 不再指向 `https://git.genarrative.world/GenarrativeAI/Genarrative.git`；扫描所有生产 Jenkinsfile 的首次 `GitSCM checkout`，确认 `GIT_REMOTE_URL` 是 `ssh://git@192.168.35.82:2222/GenarrativeAI/Genarrative.git`、`GIT_REMOTE_CREDENTIAL_ID` 是 `genarrative-local-gitea-ssh`、`GIT_REMOTE_FALLBACK_URL` 为空，`userRemoteConfigs` 带 `+refs/heads/${params.SOURCE_BRANCH}:refs/remotes/origin/${params.SOURCE_BRANCH}`，`CloneOption` 带 `honorRefspec: true`；重放 Jenkins 时 checkout 日志不应再出现 `No credentials specified`；扫描发布流水线确认传给 `scripts/jenkins-checkout-source.sh` 的 `COMMIT_HASH` 未被硬编码为空；运行 `bash -n scripts/jenkins-checkout-source.sh`。
+- 原因：`127.0.0.1` 只代表当前执行阶段的 agent 自身，因此 Git checkout 必须收口到同机运行 Gitea SSH、带 `linux && genarrative-build` 标签的 Jenkins Built-In Node；公网域名和局域网 IP 会引入额外网络、代理、TLS 与地址漂移。即使使用本机 Git，如果 `GitSCM` 没有显式 refspec 并开启 `CloneOption honorRefspec=true`，Jenkins Git 插件仍会拉取所有分支。
+- 处理：Full、Web、API、Stdb、Server-Provision 与数据库导入导出的源码准备统一在 Jenkins Built-In Node 使用 `GIT_REMOTE_URL=ssh://git@127.0.0.1:2222/GenarrativeAI/Genarrative.git` 和 `GIT_REMOTE_CREDENTIAL_ID=genarrative-local-gitea-ssh`，`GIT_REMOTE_FALLBACK_URL` 留空。数据库导入导出把经过 commit 校验的必要脚本 stash 给目标 agent，release / dev 目标阶段只 unstash，不再 checkout Git 或挂载 Git SSH 凭据。首次 checkout 保留目标分支 refspec、`CloneOption shallow=true depth=1 noTags=true honorRefspec=true`，随后由 `scripts/jenkins-checkout-source.sh` 复用并在必要时逐步加深。
+- 验证：扫描本地 Jenkins live Job `config.xml` 和所有生产 Jenkinsfile，确认 Git URL 均为 `ssh://git@127.0.0.1:2222/GenarrativeAI/Genarrative.git`，凭据仍为 `genarrative-local-gitea-ssh` 且 fallback 为空；确认数据库导入导出在 Prepare 阶段 checkout / stash，目标阶段只 unstash；在 Jenkins 凭据环境运行 `git ls-remote ssh://git@127.0.0.1:2222/GenarrativeAI/Genarrative.git HEAD`，并运行 `npm run check:production-ops`、`bash -n scripts/jenkins-checkout-source.sh`。
 - 关联：`jenkins/Jenkinsfile.production-full-build-and-deploy`、`jenkins/Jenkinsfile.production-web-build`、`jenkins/Jenkinsfile.production-api-build`、`jenkins/Jenkinsfile.production-stdb-module-build`、`jenkins/Jenkinsfile.production-web-deploy`、`jenkins/Jenkinsfile.production-api-deploy`、`jenkins/Jenkinsfile.production-stdb-module-publish`、`jenkins/Jenkinsfile.production-server-provision`、`jenkins/Jenkinsfile.production-database-export`、`jenkins/Jenkinsfile.production-database-import`、`scripts/jenkins-checkout-source.sh`、`docs/technical/PRODUCTION_DEPLOYMENT_PLAN_2026-05-02.md`。
 
 ## Jenkins 可选参数在 set -u 下不能裸读
@@ -3258,3 +3274,24 @@
 - 处理：网络结果未知时保留活动 hold，页面把原 `requestId`、订单、金额、原因和已知 `out_refund_no` 保存到当前后台标签页、当前管理员会话隔离的 `sessionStorage`，有效期 2 小时；刷新后必须与后端 active hold 的金额、原因和退款号对账一致才允许直接复用原请求，服务端明确拒绝时清理上下文。没有原请求上下文、上下文过期或管理员会话已切换时只开放预填 `out_refund_no` 的安全查单登记，不生成新 ID 硬撞活动 hold。worker 在占用创建至少 10 分钟后查同一退款号，查到退款就将验签事实写入统一 observation，只有连续 3 次查单收到官方 `RESOURCE_NOT_EXISTS` 才释放。进程重启清空连续次数并重新观察；超时、签名、配置、解析等错误一律重置次数并继续占用。
 - 补充：退款查单适配器必须保留微信 `RESOURCE_NOT_EXISTS` 业务码，并兼容同类 `ORDER_NOT_EXIST`，不能把所有非 2xx 都抹平成通用上游错误；签名有效的退款申请/查询响应仍须与本次 `out_refund_no`、订单号、交易号和金额做关联校验。已释放 hold 复用旧 `requestId` 时必须在调用微信前拒绝，并要求重新预检生成新的请求 ID。
 - 关联：`server-rs/crates/api-server/src/admin_recharge.rs`、`server-rs/crates/api-server/src/profile_recharge_refund_reconciliation.rs`、`profile_recharge_refund_hold`。
+
+## 时段 UV 不能伪装成单日趋势
+
+- 现象：访问人数卡显示整段时间有数百人，但趋势图只有终止日一根满柱，其余日期是同样高度的小短柱；横向滚动后还容易误以为后半月突然出现访问。
+- 原因：把时段跨日去重 UV 通过单值 series 塞进 `anchor_date_key`，再对 0 值强制设置最小可见高度。时段 UV、每日 UV 和每日 UV 之和是三个不同指标，不能互相替代。
+- 处理：趋势 bucket 按 `day_key + user_id` 每日去重，图头单独使用整个筛选范围跨日去重人数；0 值高度必须为 0。多张同轴图使用同一日期范围并同步横向滚动，快捷范围不生成未来日 bucket。
+- 验证：构造同一用户跨两日访问与某日零访问的 fixture，断言每日 bucket、时段去重总数和零值柱分别正确；浏览器核对四图首尾日期窗口一致。
+
+## 运营聚合不能用固定 LIMIT 的原始事实冒充精确结果
+
+- 现象：Dashboard 出现“达到单次读取上限 50000 行”告警，但模块分布和累计值仍以无“不完整”标识的精确数字展示；数据增长后结果会随任意截断样本漂移。
+- 原因：api-server 拉取 `SELECT ... LIMIT 50000` 原始事实再聚合，没有完整分页、稳定排序或数据库侧聚合。提高上限只会推迟错误，并增加响应体与内存压力。
+- 处理：精确运营指标通过受 runtime service identity 限制的 SpacetimeDB procedure 在事务内聚合，只返回紧凑统计投影，再由 `spacetime-client` facade 交给 BFF。权威聚合失败时请求必须失败，不能用默认 0 代替未知值；现有索引无法覆盖跨 scope、跨日期统计时先监控事务扫描耗时，数据增长后补日期前缀索引或持久化日聚合事实，不能退回固定 `LIMIT`。若某查询只能采样，契约和 UI 必须明确标为采样，不能展示成精确值。
+- 验证：聚合结果不随 HTTP SQL 行上限变化；超过 50,000 条事实时仍无截断告警，并用数据库事实抽样对账每日、时段、累计与分布结果。
+
+## 后台详情列表的 grid 规则不要命中嵌套身份组件
+
+- 现象：素材查询或精选素材详情弹窗中的作者陶泥号被逐字符竖排，用户详情按钮也被挤到编号旁边；窄屏下图片与详情列继续互相挤压。
+- 原因：`.admin-info-list div` 会命中列表内所有后代 `div`，把字段值内部的 `.admin-inline-identity` 和昵称容器也覆盖成双列 grid；陶泥号又允许任意位置换行，最终只剩单字符宽度。素材详情布局若始终固定为 `220px + 信息列`，移动端也没有足够空间。
+- 处理：信息列表的行布局只使用直接子选择器 `.admin-info-list > div`；作者昵称与陶泥号在身份组件内分行，陶泥号保持单行并在真正不足时省略。`560px` 以下的素材详情改为单列，缩略图居中；素材查询与精选审核共用该规则。
+- 验证：在桌面、560px、390px 和 320px 浏览器宽度打开素材详情，确认 `.admin-inline-identity` 的 computed `display` 为 `flex`、陶泥号横向显示、详情字段不溢出页面。
diff --git a/docs/project-memory/shared-memory/project-overview.md b/docs/project-memory/shared-memory/project-overview.md
index fa617a0c1..c38f161ff 100644
--- a/docs/project-memory/shared-memory/project-overview.md
+++ b/docs/project-memory/shared-memory/project-overview.md
@@ -45,7 +45,7 @@ server-rs + Axum + SpacetimeDB
 - `spacetime-client`：后端访问 SpacetimeDB 的 typed facade。
 - `module-*`：纯领域模型、命令、应用规则、领域事件和领域错误。
 - `platform-*`：OSS、LLM、认证、语音等外部平台能力。
-- `shared-contracts` / `packages/shared`：前后端 DTO 和公开契约。
+- `shared-contracts` / `packages/shared`：前后端 DTO、公开契约和跨页面复用的无业务真相 TypeScript 代码；`packages/shared` 可承载共享 UI 组件与纯工具，但不承载领域规则、后端副作用或正式状态。
 - 前端：表现、交互、临时 UI 状态和后端结果渲染。
 
 明确废弃：旧 `server-node`、Express、PostgreSQL、Go 服务端、`maincloud`、人工 `spacetime --root-dir` 口径，以及前端承接正式业务真相的路线。
diff --git a/docs/project-memory/shared-memory/team-conventions.md b/docs/project-memory/shared-memory/team-conventions.md
index ef7364769..d2fe77662 100644
--- a/docs/project-memory/shared-memory/team-conventions.md
+++ b/docs/project-memory/shared-memory/team-conventions.md
@@ -47,6 +47,7 @@
 - 新增 Markdown 文档时，文件名必须以分类标签开头，格式为 `【标签名】中文标题-日期.md`；只在任务需要时重命名历史文档，避免无关大 diff。
 - 涉及中文文本时注意 UTF-8 编码和乱码排查。
 - 涉及后端时遵循 DDD 分层，不把业务真相下沉到前端或临时兼容层。
+- `packages/shared` 用于前后端 DTO、公开契约及跨页面复用的无业务真相 UI 组件和纯工具；不得把领域规则、后端副作用或正式状态放入其中。
 - `maincloud` / `Maincloud` / `MAINCLOUD` 相关代码、脚本、测试、环境变量、命令和文档要求均视为历史残留，禁止新增、运行或引用；API smoke 统一使用 `npm run dev:api-server` 与 `/healthz`。
 - 涉及 SpacetimeDB 表结构、发布或迁移时，先看 `SPACETIMEDB_SCHEMA_CHANGE_CONSTRAINTS.md` 和 `SPACETIMEDB_TABLE_CATALOG.md`。
 - 涉及生产发布、服务器配置、Jenkins Job 重建或回滚时，先看 `PRODUCTION_DEPLOYMENT_PLAN_2026-05-02.md`。
diff --git a/docs/technical/【前端架构】图片画布编辑器MVP接入方案-2026-06-11.md b/docs/technical/【前端架构】图片画布编辑器MVP接入方案-2026-06-11.md
index 7f4bc6fef..01c745e50 100644
--- a/docs/technical/【前端架构】图片画布编辑器MVP接入方案-2026-06-11.md
+++ b/docs/technical/【前端架构】图片画布编辑器MVP接入方案-2026-06-11.md
@@ -9,7 +9,7 @@
 - 主站新增 `/editor/canvas` 路由，进入独立图片画布编辑器阶段。
 - 主站新增 `/project` 项目页，从“我的”页项目入口进入，展示当前用户所有图片画布工程；点击项目进入 `/editor/canvas?projectid=<projectId>`。
 - 创作 Tab 顶部提供编辑器入口，入口只负责跳转，不参与玩法创作链路。
-- 编辑器顶部栏采用紧凑高度，项目标题和重命名入口贴近返回项目按钮；右侧复用与主站相同的公共泥点资产入口，并以充值中心 `mudPointBalance` 为余额真相源。余额区只展开不限时、每日免费及重置信息，会员周期限时泥点保留在后端 read model 中用于存量兼容和结算但不展示；独立“充值”按钮进入“购买更多泥点”弹窗，“使用详情”进入泥点账单。
+- 编辑器顶部栏采用紧凑高度，项目标题和重命名入口贴近返回项目按钮；右侧复用与主站相同的公共泥点资产入口。顶部总余额优先展示画板按扣费、退回、到账和页面恢复链路刷新的 `profileDashboard.walletBalance`，充值中心 `mudPointBalance` 仅用于展开面板的账户明细，不覆盖已刷新的总余额。余额区只展开不限时、每日免费及重置信息，会员周期限时泥点保留在后端 read model 中用于存量兼容和结算但不展示；独立“充值”按钮进入“购买更多泥点”弹窗，“使用详情”进入泥点账单。
 - 编辑器左侧为图片素材栏，可展开 / 收起；移动端优先保持素材栏可折叠。
 - 中央画布支持背景拖拽平移、滚轮缩放、缩放百分比菜单、显示所有元素和固定比例缩放。
 - 画布左下角提供 Lovart 式状态控件：背景色圆点、素材 / 图层入口、小地图开关；小地图显示图层缩略分布和当前视口框，点击小地图执行显示所有元素。
@@ -23,7 +23,7 @@
 - 图片生成 / 修改统一经 api-server BFF 接入 VectorEngine。普通生成、生成规范和重绘保留既有 `gpt-image-2` 路径；图片快速编辑统一打开框选区域 + 单提示词 + 模型选择面板，默认沿用原图模型，不展示参考图或比例 / 尺寸控件；其中生成规范类图片固定 `16:9`、`2K`、`gpt-image-2`，面板底部用与可编辑面板一致的比例 / 尺寸 / 模型胶囊按钮展示固定参数，但按钮为禁用态，不允许在该面板改比例、尺寸或模型。`生成角色形象` 与 `生成图标素材` 支持 `nanobanana2`（`gemini-3.1-flash-image-preview`）和 `gpt-image-2`，默认 `nanobanana2`，并在两类面板之间沿用用户上次选择的模型；两类面板不展示抠图背景色或抠图模型选择；前端用户路径固定提交 `screenColor=auto` 和 `segModel=birefnet`，由后端自动决策具体抠图背景色，`anime-seg` 作为内部保留能力不在用户界面暴露。`nanobanana2` 走 `/v1beta/models/{model}:generateContent`，请求体写入 `generationConfig.imageConfig.aspectRatio/imageSize`；`gpt-image-2` 走 `/v1/images/generations` 或 `/v1/images/edits`，请求体按 VectorEngine 文档映射 `size`。宣发素材三个工作流（游戏首图、详情五图、运营海报）固定使用 `gpt-image-2`，面板模型胶囊为禁用态，不提供 `nanobanana2` 入口；前端按 workflow 同时提交 `outputSize`、`aspectRatio` 和 `imageSize`，其中游戏首图为 `720x540 / 4:3`、详情单图为 `720x1280 / 9:16`、运营海报为 `1280x720 / 16:9`；后端收到 `kind: "publication-material"` 时也强制归一为 `gpt-image-2` 生成和计费，生成回填图层优先使用生成占位的 `originalWidth/originalHeight`，即使上游回包尺寸漂移也不得把宣发素材卡片变成随机 `1:1` 或 `4:3`。纯文本生成走 `/api/editor/images/generations`，重绘在前端读入当前图层图片 Data URL 后走同一图片生成 BFF，并在原图右侧生成一张新图；普通图层重绘作为 `quick-edit` 参考图提交，角色图层重绘必须按 `kind: "character"` 提交，继续套用角色生成器提示词限定、透明 PNG 后处理和角色资产持久化。`生成视频` 走 `/api/editor/videos/generations`，前端模型入口仅展示 Seedance 2.0 Fast / Seedance 2.0 / Kling 3.0 / Kling 3.0 Omni，不展示 Veo 入口，默认 Seedance 2.0 Fast；视频参数按当前正式面板支持的比例、时长、清晰度和声音开关提交，且 Seedance Fast 与 Seedance 标准版必须按各自真实模型 ID 独立映射，不得混用。生成结果以视频图层加入画布。纯文本生成入口采用 Lovart 式画布内占位图 + 锚定生成输入框：点击生成图片后以当前视口世界中心为目标，经统一 placement 避让后创建选中的灰色占位框，输入框跟随占位框显示；待生成、生成中和失败后保留的占位图都必须继续支持拖动，生成完成时真实生成图或视频落在最新占位框位置，输入框继续跟随新生成图层；占位图失焦时隐藏高亮边框、左上角生成器名称和右上角原始尺寸，重新聚焦时再显示，且名称 / 尺寸在画布缩小时按 viewport 反向缩放保持屏幕尺寸稳定；点击所有图片 / 视频生成入口并确认请求开始后，必须隐藏对应设置面板，只保留画布内占位图或原图预览，并在预览上显示 Lovart 式生成中遮罩，避免“面板仍占屏”或“预览一起消失”。图片快速编辑和重绘在调用图片 BFF 前必须把当前图层图片源读取为图片 Data URL；视频素材快速编辑走视频生成 BFF，不允许走图片模型；角色动作的 `生成动画` 仍固定使用 `seedance2.0-fast` 动作 / 视频模型，角色动作素材的 `快速编辑` 按当前帧图片走图片编辑。前端不持有 provider 密钥；上游失败或配置缺失时恢复当前生成设置面板展示失败，不创建 mock 成功图。
 - 图片画布抠图分两类：手动去除背景面向用户任意图片，走登录态同源 BFF `POST /api/editor/images/background-removals` 并转发远端 BiRefNet；编辑器自己生成的标准纯色背景抠图资产在保存源图后统一调用独立 BgFilter 服务 `GENARRATIVE_EDITOR_BGFILTER_BASE_URL/remove-background`，默认 `http://58.87.105.82/bgfilter/remove-background`，默认请求超时 `180000ms`（BgFilter CPU 推理）。角色形象生成、图标 spritesheet 生成和 UI 设计图素材提取的前端用户路径都固定把 `screenColor=auto` 注入请求体，但用户可见 `generationInputs.fields` 不再记录 `抠图背景色` 或 `抠图模型`；api-server 在组装 prompt 前调用背景决策模块，从 12 个候选色中选择具体 hex，最多重试 3 次，失败后兜底 `#CFEFFF`。后端仍保留手动 hex 解析能力供内部兼容。最终生图 prompt 和 BgFilter `screen_color` multipart 字段只接收解析后的具体 hex，不透传 `auto`。三条 BgFilter 路径还必须固定把默认 `segModel=birefnet` 传为 `seg_model`；后端仍保留识别 `anime-seg` 的内部兼容能力，但前端用户入口不展示也不提交该值。这里的 `birefnet` 只是 BgFilter 管线内部后端，不等同于手动去背景的独立 BiRefNet 服务。后端在调用 BgFilter 前必须先把带纯色背景 / 绿幕源图写入 OSS；BgFilter 请求失败、返回非成功状态、空图片或非法图片时，以及连续失败达到 `GENARRATIVE_EDITOR_BGFILTER_CIRCUIT_FAILURE_THRESHOLD=3` 后的 `GENARRATIVE_EDITOR_BGFILTER_CIRCUIT_COOLDOWN_SECONDS=300` 秒熔断期，api-server 都先调用阿里云通用抠图，只有阿里云失败才用本地 `editor_green_screen` 按同一 `screenColor` 兜底去背。角色动作生成的序列帧背景色已与生图统一：前端固定提交 `screenColor=auto`，后端视觉决策出具体 hex 并把源角色图合成到该背景色后再图生视频；抽帧后逐帧优先阿里云通用抠图，失败降级本地 `editor_green_screen`（按选定背景色，而非固定 `#00FF00`）。BiRefNet 手动去背景服务地址为 `GENARRATIVE_EDITOR_BACKGROUND_REMOVAL_BASE_URL/remove-background`，默认 `http://58.87.105.82/remove-background`；BgFilter 可选访问令牌来自 `GENARRATIVE_EDITOR_BGFILTER_TOKEN`，未配置时复用 `GENARRATIVE_EDITOR_BACKGROUND_REMOVAL_TOKEN`，所有令牌都只在服务端注入，前端不持有令牌。api-server 对上游结果做响应字节和图片尺寸上限保护，并先落 OSS / asset object，再返回 `imageSrc/objectKey/assetObjectId/taskId`；queue 模式下手动去背景进入 SpacetimeDB 外部生成队列，画布任务侧栏只展示服务器任务阶段，生成中才显示耗时，不显示百分比；有项目上下文时前端同时创建去背景生成占位并把 `canvasCompletion` 交给后端，完成后由后端写入结果图层和最新项目快照。
 - 多产物生成以后端项目快照为唯一画布真相：同一任务的原始产物、抠图 / 透明化结果和拆分结果都要先登记为 `editor_project_resource`，再通过一次 `canvasCompletion` 原子写入画布。角色形象、图标 spritesheet 和 UI 素材提取的纯色背景原图不能只留在 OSS；透明后处理结果保持主图层和 `generatedLayerId` 锚点，原图及其它附属产物从主结果右侧开始错开放置。无项目上下文时不创建项目资源或画布图层。
-- 图片快速编辑面板只保留一个提示词输入框和模型选择，不展示额外参考图或比例 / 尺寸控件；原图 / 原素材作为 `/api/editor/images/edits` 的 `sourceImageSrc` 直接提交，不作为 `referenceImageSrcs`。打开快速编辑时画布必须自动平移缩放，让原素材完整落在可视区上半部分，底部面板固定出现在素材下方且不遮挡内容，竖屏 UI 素材也必须完整展示。快速编辑右侧显示矩形、椭圆、画笔框选工具，但进入时不默认启用；点击工具后显示选中态，再点同一工具取消启用。完成框选后，画布红色细框显示连续序号，提示词可按这些编号填写每个区域怎么改。点击 `修改` 后仍停留在当前快速编辑面板显示修改中，不创建独立 `Quick Edit Generator` 画布占位；生成成功后直接用结果覆盖原图图层，失败时保留当前面板并显示错误。
+- 图片快速编辑面板只保留一个提示词输入框和模型选择，不展示额外参考图或比例 / 尺寸控件；原图 / 原素材作为 `/api/editor/images/edits` 的 `sourceImageSrc` 直接提交，不作为 `referenceImageSrcs`。完整图标图集 `icon-spritesheet` 支持快速编辑，拆分后的单个 `icon` 不提供该入口，前后端必须使用同一素材类型规则。打开快速编辑时画布必须自动平移缩放，让原素材完整落在可视区上半部分，底部面板固定出现在素材下方且不遮挡内容，竖屏 UI 素材也必须完整展示。快速编辑右侧显示矩形、椭圆、画笔框选工具，但进入时不默认启用；点击工具后显示选中态，再点同一工具取消启用。完成框选后，画布红色细框显示连续序号，提示词可按这些编号填写每个区域怎么改。点击 `修改` 后仍停留在当前快速编辑面板显示修改中，不创建独立 `Quick Edit Generator` 画布占位；生成成功后直接用结果覆盖原图图层，失败时保留当前面板并在错误红框中显示具体错误文案。
 - 底部生成类按钮每次点击都必须创建独立的画布生成对象；新建规范、角色形象或图标素材时，只切换当前编辑面板，不得销毁此前尚未生成或已生成后的其它生成对象状态。归档为非当前编辑对象的生成占位仍可拖动、删除和等待异步完成，完成 / 失败回写必须按生成对象 ID 读取最新占位状态，不能使用提交瞬间的旧快照。
 - 画布右上角提供自动隐藏任务侧栏。列表为空且侧栏关闭时只保留图标开关；生成或去背景任务进入时默认打开；用户可手动切换开关状态。
 - 画布底部工具栏 / 面板 Dock 提供“画布 Agent”入口。点击后打开右侧独立 Agent 对话面板；桌面端为右侧窄面板，移动端占满可用宽度。该面板与素材侧栏、图层侧栏、右上角任务侧栏互斥，打开 Agent 时必须收起其它侧栏，打开其它侧栏或任务侧栏时也必须收起 Agent。Agent 面板不得在当前画布内容下方追加内联内容，也不默认展示大段功能说明文案。
@@ -48,15 +48,15 @@
 - 新增 `editor_project` 表保存图片画布工程：`projectId`、`ownerUserId`、标题、创建时间和更新时间；历史 layout 字段暂保留为兼容列，不再作为权威画布数据。
 - 新增 `editor_canvas` 表保存工程下的画布：`canvasId`、`projectId`、`ownerUserId`、标题、viewport、图层布局 JSON、创建时间和更新时间。当前编辑器使用项目默认画布，后续可扩展为一个 project 下多个 canvas。
 - 新增 `editor_asset_folder` 表保存账号级素材文件夹：`folderId`、`ownerUserId`、名称、排序、折叠状态、系统默认标记、创建时间和更新时间。素材文件夹不归属于 project，同一个账号进入任一项目都能看到。
-- 新增 `editor_asset` 表保存账号级素材：`assetId`、`ownerUserId`、`folderId`、名称、图片读取地址、可选封面 `thumbnailSrc`、OSS / asset object 引用、图片尺寸、来源类型、prompt、actualPrompt、model、provider、taskId、`assetKind`、`generationInputs`、`generationCostMudPoints`、创建时间和更新时间。素材只跟账号走，不跟 project 走；角色、图标、UI 设计图、视频和音频等生成结果的用户可见输入快照随素材保存。
+- 新增 `editor_asset` 表保存账号级素材：`assetId`、`ownerUserId`、`folderId`、名称、图片读取地址、可选封面 `thumbnailSrc`、OSS / asset object 引用、图片尺寸、来源类型、prompt、actualPrompt、model、provider、taskId、可选 `groupTaskId`、可选 `groupTaskExpectedAssetCount`、`assetKind`、`generationInputs`、`generationCostMudPoints`、创建时间和更新时间。素材只跟账号走，不跟 project 走；`taskId` 保留真实生成 / 拆分操作身份，`groupTaskId` 保存服务端验证后的来源任务，`groupTaskExpectedAssetCount` 保存该拆分批次完整时应有的素材数；角色、图标、UI 设计图、视频和音频等生成结果的用户可见输入快照随素材保存。
 - 新增 `editor_showcase_asset`、`editor_showcase_asset_like` 和 `editor_showcase_campaign_config` 表承接 `陶泥儿精选`：生成素材默认不公开，用户在素材菜单中提交精选审核后生成独立快照；后台审核通过后先返还 50% 生成成本泥点，但仍需运营手动设置精选分类并开启展示才进入公开精选。公开列表不再读取 `editor_project_resource.public_showcase_enabled`，而是读取已通过、展示开启且分类合法的精选快照，支持点赞数和首位活动卡。
 - `editor_project_resource` 表保存工程画布引用过的资源快照：`resourceId`、`projectId`、`ownerUserId`、OSS / asset object 引用、图片尺寸、来源类型、prompt、actualPrompt、model、provider、taskId、sourceResourceId、`assetKind`、`generationInputs`、创建时间和更新时间。上传素材被拖入画布时会复制为 project resource，图层只引用 resourceId；图片、图标和 UI 素材生成 BFF 在请求携带 `projectId` 时由后端直接创建新 resource，并把 `resourceId` 随生成响应返回给前端。图片生成请求如果同时携带 `canvasCompletion`（生成器 `dialogId`、标题和占位框，或无 dialog 的右侧完成占位），BFF / worker 在生成成功后必须直接读取当前项目布局，优先使用最新 `generation-dialog` 占位框位置；只有当前布局仍存在对应 `generation-dialog` 时才插入轻量结果图层、把生成器标记为 `idle` 并写入 `generatedLayerId`，沿用后端当前 viewport 保存布局，再返回或刷新最新项目快照；前端只应用该快照刷新显示，不把生成完成态作为本地业务真相，也不在项目加载时根据资源行推断完成态。有项目上下文但后端没有返回项目快照时，前端不得本地补结果图层，只保留当前生成器交互状态等待下一次项目刷新。
 - 项目封面图是画布当前视口栅格化后的静态快照资源，不在项目列表页临时重放 `layers + viewport`。前端在项目加载后和防抖保存 layout 时生成 320x240 PNG，走私有 OSS / asset object 上传，再创建 `editor_project_resource`，其中 `assetKind="project-cover-snapshot"`、`sourceType="uploaded"`。`/project` 与 `/creation` 最近项目卡只读取最新封面快照资源渲染；没有封面快照时显示普通项目占位，不回退为实时画布组合。
 - 图片、音频、视频和角色动画帧文件本体继续走 OSS / asset object；浏览器读取私有 generated 对象统一经 `/api/assets/read-url` 换签，签名 URL 可在 session 内复用，但不得作为持久化真相。`/api/assets/read-url` 属于页面展示层高频后台请求，前端统一在 `assetReadUrlService` 内做同 key pending 去重、session 缓存和跨组件节流；UI 设计切片、角色动画帧或大量素材恢复时不得绕过该服务并发换签，否则单页可在同一秒内打满发布入口 `genarrative_api_rps` burst。
 - 登录态上传和生成结果必须先落 OSS / asset object，再向 `editor_project_resource` / `editor_asset` 写入轻量 `imageSrc: "/<objectKey>"`、`objectKey` 和 `assetObjectId`；未登录演示态可以在内存里使用 Data URL 预览，但项目、素材库、项目资源和 `editor_canvas.layers_json` 不得写入 `data:image/*`、`data:video/*`、`data:audio/*` 或 `blob:`。旧数据读取时如果已有 `objectKey`，`imageSrc` 归一成 `/<objectKey>`；没有 `objectKey` 的旧 Data URL 需要走修复上传并回写轻量引用。裁扩在项目上下文中虽然由前端 canvas 本地渲染 PNG，也必须先上传 OSS / asset object 并创建 `editor_project_resource`，再把带正式 `resourceId/objectKey/assetObjectId` 的裁扩图层加入画布；不能先把 `local-resource-*` + Data URL 图层交给项目保存或后续去背景。上传到生成面板参考图槽位的图片必须先创建 `editor_project_resource` 行；没有当前工程 ID 时才创建账号级 `editor_asset` 行，随后把对应 `resourceId` 或 `assetId` 写入参考图临时状态，生成请求仍使用临时状态中的图片源或 `objectKey`。
 - 资源表保存资源和素材级元数据；图层位置、层级、分组选中所需 ID 和 groupId 保存在 `editor_canvas` 的布局 JSON。布局 JSON 是混合数组：普通图层按 `layerId/resourceId` 保存，生成器占位和生成器对话框按 `itemType: "generation-dialog"` 保存，不新增单独表。普通图层的新保存不再把 `assetKind/generationInputs` 写入布局 JSON；刷新时优先从 `editor_project_resource` 恢复，旧布局中的同名字段只作为兼容兜底。生成器快照必须包含生成器 ID、模式、提示词、参数、参考图、状态、占位框位置和可选 `generatedLayerId`；角色、图标等纯色抠图生成器的前端用户路径不保存或恢复 `screenColor` / `segModel`，同源重绘也不再从 `generationInputs.fields` 恢复 `抠图背景色` 或 `抠图模型`；宣发素材生成器还必须保存并恢复 `publicationWorkflowId`、`publicationGameInfo` 和 `publicationReferences`，避免刷新后生成卡片字段或参考图丢失。生成器快照中的参考图同样只保存 `resourceId/sourceAssetId` 行引用和展示所需 label，不保存图片 Data URL、signed URL 或 `objectKey`；刷新时用 `editor_project_resource` / `editor_asset` 行恢复临时生成请求所需图片源。生成成功后仍保存该快照，只是渲染时由 `generatedLayerId` 锚定到成品图层而不重复显示灰色占位框。`generationInputs.references` 是用户可见输入快照中的行级索引，只允许保存 `{ title, label, refType, refId }`；生成接口所需的图片 Data URL、signed URL 或 `objectKey` 只存在于提交前的临时参考图状态和请求体字段，不进入资源 / 素材元数据。图层展示尺寸不再作为独立 `Size` 真相保存，刷新与新建图层均按 `Resolution`（`originalWidth/originalHeight`）原分辨率显示。图层组第一版是画布内布局语义，不单独建表。
-- 图片类、生成视频和音频结果除作为 `editor_project_resource` 和画布图层保存外，还要写入账号级 `editor_asset` 素材库；该写入由生成 BFF 在请求携带 `assetFolderId` 时完成。`GENARRATIVE_EXTERNAL_GENERATION_MODE=queue` 下，画布图片、改图、图标素材、UI 素材提取、角色动作、视频、音效和背景音乐生成都先返回 `queueState`，前端轮询 `/api/runtime/external-generation/jobs/{jobId}` 到完成后重新读取项目快照；`inline` 或无项目上下文时才使用响应中的 resource / asset 快照做本地落画布兜底，不再把同一生成结果二次调用素材创建接口。生成请求失败、inline 完成或 queue 任务终态完成 / 失败后，右上角泥点 chip 必须通过 `/profile/dashboard` 回读余额，不做本地乐观扣减。生成视频会单独抽取首帧封面并写入 `thumbnailSrc`，素材栏和拖回画布时沿用该封面作为 poster。
-- 生成面板的资源命名统一写入可选 `assetLabel`，最大 80 字符并在提交时 trim。留空时提交模型保留原有自动编号；非空时同一个名称必须贯穿 `assetLabel`、`canvasCompletion.title`、项目资源、账号素材和本地兜底图层，刷新后不得退回模板名。图标图集与角色动作请求同样支持该字段，中间原图使用主名称加固定后缀，拆分素材继续按素材描述命名。
+- 图片类、生成视频和音频结果除作为 `editor_project_resource` 和画布图层保存外，还要写入账号级 `editor_asset` 素材库；该写入由生成 BFF 在请求携带 `assetFolderId` 时完成。角色、图标图集、UI 提取和角色动作等多产物任务把 provider 原始输出及后处理结果分别入库：所有条目沿用 `character`、`icon-spritesheet`、`character-animation` 等真实类型，provider 原始输出承载任务模型成本，后处理派生产物阶段成本为 0。后台素材查询以最终产物为父行、每个中间产物为可展开的独立子行，分页只计算父任务；手动重拆图集保留独立 `taskId` 用于存储隔离和日志排障，通过私有 provenance 从服务端生成账号素材的 source resource、asset object 或 Object Key 取得可信来源任务，并把它写入 `groupTaskId`，不信任客户端可提交的 resource `taskId/assetKind`；跨项目复用后仍可通过稳定媒体引用找回来源。没有可信来源的新拆分显式归到自身任务，不走历史资源链回溯。每个手动切片同时写入 `groupTaskExpectedAssetCount`，全部切片落库后写独立 cohort 完成事实；后台 read model 只让同一根任务的一个已完成拆分批次并入原图集父项，用户后来删除单片不会让批次脱组，部分失败批次和后续重复拆分批次按各自真实任务分页，避免残缺批次抢占根任务、单组无限增长或素材丢失。历史行在项目资源仍存在时兼容回溯，删除项目资源前只固化直接受影响行的真实来源字段，有界展示 ID 不反写数据库。`GENARRATIVE_EXTERNAL_GENERATION_MODE=queue` 下，画布图片、改图、图标素材、UI 素材提取、角色动作、视频、音效和背景音乐生成都先返回 `queueState`，前端轮询 `/api/runtime/external-generation/jobs/{jobId}` 到完成后重新读取项目快照；`inline` 或无项目上下文时才使用响应中的 resource / asset 快照做本地落画布兜底，不再把同一生成结果二次调用素材创建接口。生成请求失败、inline 完成或 queue 任务终态完成 / 失败后，右上角泥点 chip 必须通过 `/profile/dashboard` 回读余额，不做本地乐观扣减。生成视频会单独抽取首帧封面写入 `thumbnailSrc`，素材栏和拖回画布时沿用该封面作为 poster。
+- 生成面板不展示资源名称输入，默认使用原有自动编号；提示词输入保持统一可见边框。内部命名契约仍使用可选 `assetLabel`，最大 80 字符并在提交时 trim；历史状态或内部调用携带非空名称时，同一个名称必须贯穿 `assetLabel`、`canvasCompletion.title`、项目资源、账号素材和本地兜底图层，刷新后不得退回模板名。图标图集与角色动作请求同样兼容该字段，中间原图使用主名称加固定后缀，拆分素材继续按素材描述命名。
 - 画布 Agent 会话按“SpacetimeDB 元数据 + OSS 消息正文”存储：`editor_agent_conversation` 只保存 `conversationId/projectId/ownerUserId/title/messagesObjectKey/deleted/createdAt/updatedAt` 等会话元数据；消息正文整体保存为私有 OSS JSON 文档 `editor-agent/{conversationId}.json`。消息文档单对象上限为 2 MiB，同一会话的消息追加和 SSE 最终写回由 api-server 按 `conversationId` 串行化，避免“读 OSS → 改消息 → 写 OSS”并发覆盖。前端只通过 api-server BFF 读取和发送会话，不直接读写 SpacetimeDB，也不直接读写 OSS。
 - Agent 消息附件只允许引用当前工程画布资源或账号素材库图片，来源类型为 `canvas_resource` / `library_asset`，最多 9 张。附件请求可携带展示用 `imageSrc/thumbnailSrc/objectKey/width/height/label`，但持久化真相仍以后端校验后的 resource / asset 行和 OSS 对象为准；不得把 Data URL、signed URL 或 blob URL 当作会话长期事实。
 - 前端不直接订阅 SpacetimeDB，统一通过 api-server 的 `/api/editor/projects*` BFF 读写。
@@ -85,11 +85,11 @@
 - `POST /api/editor/assets`：批量或单个创建账号级素材，登录态上传必须写入 OSS / asset object 引用和 `/<objectKey>` 轻量路径，不允许把 Data URL / signed URL 写入素材库。
 - `PATCH /api/editor/assets/{assetId}`：重命名素材或移动素材到文件夹。
 - `DELETE /api/editor/assets/{assetId}`：删除素材。已放入画布的 project resource 不被级联删除，避免旧画布丢图。
-- `POST /api/editor/images/generations`：按提示词调用 VectorEngine 生成图片；角色生成可携带 `model`、`screenColor`、`segModel`、`aspectRatio`、`imageSize` 和 `referenceImageSrcs`，生成成功后 api-server 先保存带纯色背景源图，再调用 BgFilter 并传入 `screen_color=<screenColor>`、`seg_model=<segModel>` 生成透明 PNG。宣发素材携带 `kind: "publication-material"` 时固定归一为 `gpt-image-2`，不支持 `nanobanana2`。`nanobanana2` 参考图作为 `inline_data` 进入 `generateContent`，`gpt-image-2` 参考图进入 edits。普通重绘继续走该接口并把当前图层图片作为参考图；图片快速编辑不走该接口。请求可携带 `projectId`、`assetFolderId`、`assetKind`、`generationInputs` 和 `sourceResourceId`，后端生成成功后创建 project resource / 账号素材并在响应中返回 resource / asset 快照。
+- `POST /api/editor/images/generations`：按提示词调用 VectorEngine 生成图片；普通图片的 provider 回图先留在内存，尺寸变换成功后只上传变换结果，变换失败则只上传 provider 原图，主结果只写一次 OSS 且不额外创建“原始输出”。角色生成可携带 `model`、`screenColor`、`segModel`、`aspectRatio`、`imageSize` 和 `referenceImageSrcs`，生成成功后 api-server 先保存带纯色背景源图，再调用 BgFilter 并传入 `screen_color=<screenColor>`、`seg_model=<segModel>` 生成透明 PNG。宣发素材携带 `kind: "publication-material"` 时固定归一为 `gpt-image-2`，不支持 `nanobanana2`。`nanobanana2` 参考图作为 `inline_data` 进入 `generateContent`，`gpt-image-2` 参考图进入 edits；`nanobanana2` 的 `512 / 1024 / 2K` 是标量清晰度档位，后端保留 provider 输出几何尺寸，不按 `宽x高` 解析。普通重绘继续走该接口并把当前图层图片作为参考图；图片快速编辑不走该接口。请求可携带 `projectId`、`assetFolderId`、`assetKind`、`generationInputs` 和 `sourceResourceId`，后端生成成功后创建 project resource / 账号素材并在响应中返回 resource / asset 快照。
 - `POST /api/editor/images/background-removals`：接收当前图片源，校验登录态后由 api-server 解析为图片文件并转发到 BiRefNet 去背景服务；请求可携带 `projectId`、`targetLayerId`、`assetFolderId`、`assetLabel`、`sourceResourceId` 和 `canvasCompletion`，有 `canvasCompletion` 时完成后按生成占位写入结果图层，否则沿用旧的目标图层替换路径；响应返回 `imageSrc`、`objectKey`、`assetObjectId`、`width`、`height`、`taskId`、`elapsedMs`、`provider` 和可选 `project` 快照。服务地址由 `GENARRATIVE_EDITOR_BACKGROUND_REMOVAL_BASE_URL` 配置，令牌只在服务端通过 `GENARRATIVE_EDITOR_BACKGROUND_REMOVAL_TOKEN` 注入。
 - `POST /api/editor/icon-spritesheets/generations`：按图标规范图和素材描述数组生成 spritesheet，生成成功后 api-server 先保存带纯色背景 spritesheet 源图，再调用 BgFilter 生成透明 spritesheet。请求支持 `model`、`screenColor`、`segModel`、`aspectRatio`、`imageSize`、`priceMudPoints`、`projectId`、`assetFolderId` 和 `generationInputs`；`priceMudPoints` 必须来自编辑器生成计费配置中对应生图模型的尺寸档位（如 `nanobanana2` 的 `0.5K / 1K / 2K` 或 `gpt-image-2` 的 `1K / 2K`），后端用 `editor_generation_config` 校验后才调用上游；`nanobanana2` 走原生 `generateContent` 并写入 `generationConfig.imageConfig.aspectRatio/imageSize`，`0.5K` 传 `"512"`；`gpt-image-2` 走 `/v1/images/edits`。后端保存透明 spritesheet project resource / 账号素材，并随响应返回对应快照。
 - `POST /api/editor/ui-designs/assets/extractions`：前端把红色框选轮廓绘入本地临时图后，先将该图上传 OSS 并确认 asset object，再以返回的 `objectKey` 作为参考图入队；Data URL / Blob URL 只允许停留在上传前的浏览器临时态。接口固定 `gpt-image-2` 和自动决策纯色背景素材提取提示词生成素材 spritesheet，生成成功后 api-server 先保存带纯色背景 spritesheet 源图，再调用 BgFilter 生成透明 spritesheet，并按连通域自动拆分为 `素材 1..N`，返回结构复用图标 spritesheet 响应。请求必须携带 `screenColor`、`segModel`、`aspectRatio: "1:1"`、`imageSize: "1K" | "2K"` 和 `priceMudPoints`；框选数量不超过 6 个时前端按 `1:1·1K` 与 gpt-image-2 1K 价格提交，超过 6 个时按 `1:1·2K` 与 2K 价格提交。后端必须在调用上游前校验比例、尺寸和泥点价格，只允许 `1:1 / 1K / 2K`。请求可携带 `projectId`、`assetFolderId`、`generationInputs` 和 `spritesheetLabel`，后端保存 spritesheet / 拆分素材并返回对应 resource / asset 快照；前端必须把 spritesheet 原图与拆分素材都加入画布。
-- `POST /api/editor/images/edits`：按提示词和当前图片的已登记 `objectKey` / `resourceId` 调用 VectorEngine edits，返回新的生成图片元数据；图片快速编辑当前只提交 `sourceImageSrc`，不提交隐藏的 `referenceImageSrcs`。画布快速编辑必须把源图精确 `originalWidth x originalHeight` 作为业务目标 `size` 提交，不能重新映射为近似比例或 1K / 2K 预设；api-server 在 VectorEngine provider 边界把目标尺寸和所有 multipart 参考图临时补齐到 16 的倍数，回图后恢复到业务目标精确尺寸，再落 OSS、project resource、账号素材和画布快照。16 对齐尺寸不得泄漏到响应、持久化资源或图层 Resolution。本地红框标记图必须先上传再提交 objectKey；请求携带 project / asset 上下文时由后端创建新 resource / asset，前端只消费响应快照。
+- `POST /api/editor/images/edits`：按提示词和当前图片的已登记 `objectKey` / `resourceId` 调用 VectorEngine edits，返回新的生成图片元数据；图片快速编辑当前只提交 `sourceImageSrc`，不提交隐藏的 `referenceImageSrcs`。画布快速编辑必须把源图精确 `originalWidth x originalHeight` 作为业务目标 `size` 提交，不能重新映射为近似比例或 1K / 2K 预设；api-server 在 VectorEngine provider 边界把目标尺寸和所有 multipart 参考图临时补齐到 16 的倍数，回图后在内存恢复业务目标尺寸，成功时只上传恢复结果，失败时只上传 provider 原图。无论是否发生尺寸恢复都只创建一个 project resource / 账号素材，不显示重复“原始输出”。16 对齐尺寸不得泄漏到正常完成的最终响应、资源或图层 Resolution；变换失败降级时以实际 provider 原图尺寸为准。本地红框标记图必须先上传再提交 objectKey；请求携带 project / asset 上下文时由后端创建新 resource / asset，前端只消费响应快照。
 - `POST /api/editor/videos/generations`：按视频描述、模型、比例、时长、分辨率、模式、声音、默认联网搜索标记和泥点价格生成视频。前端可选模型为 `seedance2.0-fast`、`seedance2.0`、`kling3.0`、`kling3.0-omni`，默认 `seedance2.0-fast`；后端必须将 `seedance2.0-fast` 映射到 `doubao-seedance-2-0-fast-260128`，将 `seedance2.0` 映射到 `doubao-seedance-2-0-260128`，两者不得混用。后端允许 6 类比例、4 到 15 秒整数、`480p / 720p / 1080p`，并拒绝 `seedance2.0-fast + 1080p`；`sound=on/off` 映射 Ark `generate_audio=true/false`。后端复用 Ark / VectorEngine content generation task 轮询链路，下载最终视频并持久化到 OSS；请求携带 `projectId` / `assetFolderId` 时同步创建 project resource / 账号素材并返回 `project` / `asset` 快照，基础响应返回 `videoSrc`、尺寸、prompt、model、provider、taskId、durationSeconds、resolution 和 `priceMudPoints`。
 - `POST /api/editor/audios/sound-effects/generations` 与 `POST /api/editor/audios/background-music/generations`：按音效 / 背景音乐参数生成音频并持久化到 OSS；请求携带 `projectId` / `assetFolderId` 时同步创建 project resource / 账号素材并返回 `project` / `resource` / `asset` 快照，基础响应返回 `audioSrc`、prompt、model、provider、taskId、duration、歌词和 `priceMudPoints`。
 
diff --git a/docs/technical/【后台管理】Dashboard运营看板方案-2026-06-23.md b/docs/technical/【后台管理】Dashboard运营看板方案-2026-06-23.md
index 51cad8109..0c951c3d2 100644
--- a/docs/technical/【后台管理】Dashboard运营看板方案-2026-06-23.md
+++ b/docs/technical/【后台管理】Dashboard运营看板方案-2026-06-23.md
@@ -4,7 +4,8 @@
 
 - 后台管理默认入口为 `#dashboard`，原服务 / 数据库状态页保留为 `#overview`，导航展示名为“服务总览”。
 - Dashboard 由 `GET /admin/api/dashboard` 提供统一 BFF 投影，前端只展示后端返回的 `range`、`metrics`、`charts`、`operations` 和 `warnings`。
-- 本次不修改 SpacetimeDB schema，不新增统计表；读取现有 private 表后在 api-server 聚合。
+- 不新增持久化统计表或字段；profile / tracking 私有事实由仅 runtime service identity 可调用的 `get_admin_dashboard_stats_and_return` procedure 在同一事务快照内聚合，再经 `spacetime-client` facade 返回 api-server；素材与钱包继续复用原有查询。api-server 不再通过固定 `LIMIT` 拉取原始访问明细后自行拼装精确指标；该权威聚合失败时整个 Dashboard 请求失败，不用 0 伪装未知值。
+- 当前 profile / tracking 表没有覆盖这些跨 scope、跨日期统计的现成索引，因此 procedure 为保证精确性仍需遍历相关事实；上线后需监控调用耗时，数据规模继续增长时再以日期前缀索引或持久化日聚合事实替换，不能重新引入固定行数截断。
 
 ## 查询参数
 
@@ -13,10 +14,10 @@
 - `granularity` 默认为 `day`。
 - `anchor` 使用北京时间日历日期，保留给 `day` / `week` / `month` 兼容旧查询口径。`week` 和 `month` 选择包含该日期的自然周 / 自然月。
 - `period` 使用 `startDate` / `endDate` 作为闭区间自定义时段，最多 366 天。
-- 前端统一展示起始日期和终止日期两个日期选择器；点击“本日 / 本周 / 本月”按当天真实日期自动填充对应自然日 / 自然周 / 自然月范围并刷新，手动修改起止日期后按当前日期范围查询。
+- 前端统一展示起始日期和终止日期两个日期选择器；点击“本日 / 本周 / 本月”分别填充当天、当周周一至当天、当月月初至当天并刷新，不生成北京时间今天之后的未来日期；手动修改起止日期也不能超过北京时间今天。
 - 前端默认日期和“本日 / 本周 / 本月”快捷入口都按 `Asia/Shanghai` 计算，不使用浏览器本地时区。
 - 前端每 5 分钟自动刷新一次，同时保留手动刷新按钮。
-- 图表横轴按后端返回的 bucket label 展示；本月和较长自定义时段使用固定最小日期列宽并允许横向滚动，避免日期刻度互相挤压。
+- 图表横轴按后端返回的 bucket label 展示；本月和较长自定义时段使用固定最小日期列宽并允许横向滚动，四张趋势图同步滚动位置，保证同屏日期可横向比较。0 值 bucket 不绘制伪柱。
 
 ## 指标口径
 
@@ -24,15 +25,21 @@
 - 消耗泥点数：`profile_wallet_ledger` 中 `source_type = asset_operation_consume` 且 `amount_delta < 0` 的流水绝对值，按 `created_at` 映射到北京时间业务日。
 - 总注册用户：`profile_dashboard_state` 行数。
 - 新增用户数：`profile_dashboard_state` 中 `created_at` 落在当前筛选时间窗内的账号数，按北京时间业务日归属，支持本日 / 本周 / 本月快捷日期范围。
+- 新增用户付费率：分母为当前筛选时间窗内的新增用户，分子为这些用户中截至本次查询时已至少完成一次真实支付的去重人数。真实支付以 `profile_recharge_order.paid_at` 存在且不晚于本次查询时刻为准；只创建订单或未支付订单不计，已退款订单仍表示曾经发生过付费转化，因此保留在分子。返回付费人数、新增用户数和四舍五入后的基点率；分母为 0 时 DTO 返回 0，前端百分比显示 `-`。
 - 访问次数：`tracking_daily_stat` 中 `scope_kind = site` 的日聚合次数。它表示站点级成功路由 / 站点级事件，不把用户级钱包、任务、生成等业务操作混入访问次数。
-- 访问人数：当前数据只具备登录用户维度，按 `tracking_daily_stat` 中 `scope_kind = user` 的 `scope_id` 去重；匿名访问人数需要未来补充稳定 visitor id 后才能统计。
-- 当前使用人数：最近 5 分钟内 `tracking_event` 中有 `user_id` 的登录用户去重；不跟随页面选择的历史日 / 周 / 月。
+- 访问人数：当前数据只具备登录用户维度，按 `tracking_daily_stat` 中 `scope_kind = user`、`count > 0` 且 `scope_id` 非空、非 `anonymous` 的用户去重；匿名访问人数需要未来补充稳定 visitor id 后才能统计。时段指标按整个筛选范围跨日去重，趋势图按 `day_key + scope_id` 每日去重，不能把时段 UV 塞到终止日，也不能把每日 UV 之和当成时段 UV。
+- 近 5 分钟活跃用户：以请求时刻为终点，最近 5 分钟内 `tracking_event` 中有 `user_id` 的登录用户去重；不跟随页面选择的历史日 / 周 / 月。这是滚动窗口，不是每 5 分钟才采样一次。
+- 次日 / 七日留存 cohort：`profile_dashboard_state.created_at` 按北京时间归日，注册日落在当前筛选闭区间内。该投影是现有运营注册口径，不等同认证账号表；未来若切换正式注册事实，必须单独变更契约，不能静默替换。
+- 留存活跃：用户在注册日恰好 `D+1` / `D+7` 的 `tracking_daily_stat` 中存在上述有效 user scope 行；同一用户同日多个事件只计一次，不按“1 / 7 天内累计回访”计算。筛选范围约束注册 cohort，观察日允许晚于筛选结束日。
+- 留存成熟条件：目标观察日必须早于当前北京时间业务日；观察日为今天时因当天尚未完整结束而排除。D1、D7 的可观察人数通常不同，分别返回 `eligibleUsers`、`retainedUsers` 与 `rateBasisPoints = round(retainedUsers * 10000 / eligibleUsers)`；分母为 0 时 DTO 返回 0，前端百分比显示 `-`。汇总率按总人数加权，不平均每日百分比。
 - 运营汇总页签：复用同一时间窗，展示运营指标卡、素材类型分布和访问模块分布。
 
 ## 前后端文件
 
 - 后端路由：`server-rs/crates/api-server/src/modules/admin.rs`
 - 后端聚合：`server-rs/crates/api-server/src/admin.rs`
+- SpacetimeDB 聚合 procedure：`server-rs/crates/spacetime-module/src/admin_dashboard.rs`
+- 后端访问 facade：`server-rs/crates/spacetime-client/src/admin_dashboard.rs`
 - 契约：`server-rs/crates/shared-contracts/src/admin.rs`、`apps/admin-web/src/api/adminApiTypes.ts`
 - 前端页面：`apps/admin-web/src/pages/AdminDashboardPage.tsx`
 - 后台路由：`apps/admin-web/src/app/adminRoutes.ts`
@@ -47,5 +54,8 @@
 ## 验证
 
 - `cargo test -p api-server --manifest-path server-rs/Cargo.toml admin`
+- `cargo test -p spacetime-module --manifest-path server-rs/Cargo.toml admin_dashboard`
+- `npm run check:spacetime-schema`
+- `npm run check:spacetime-runtime-access`
 - `npm run admin-web:typecheck`
 - `npx vitest run apps/admin-web/src/pages/AdminDashboardPage.test.tsx apps/admin-web/src/app/adminRoutes.test.ts --reporter verbose`
diff --git a/docs/technical/【后台管理】多账号与Tab访问权限方案-2026-07-14.md b/docs/technical/【后台管理】多账号与Tab访问权限方案-2026-07-14.md
new file mode 100644
index 000000000..d6d31d693
--- /dev/null
+++ b/docs/technical/【后台管理】多账号与Tab访问权限方案-2026-07-14.md
@@ -0,0 +1,430 @@
+# 后台管理多账号与 Tab 访问权限方案
+
+更新时间：`2026-07-14`
+
+## 1. 文档定位
+
+本文定义陶泥儿后台从单一环境变量管理员扩展为“1 个 owner 引导账号 + 多个 member 持久账号”的编码契约，并为每个一级 Tab 建立前后端一致的访问权限。
+
+本次只增加后台管理员账号与整页访问权限，不引入页面内按钮级、字段级或只读权限。正式实现必须同时完成前端导航过滤和后端 API 鉴权；前端过滤只改善体验，不能作为安全边界。
+
+## 2. 当前基线与目标
+
+当前后台由 `GENARRATIVE_ADMIN_USERNAME`、`GENARRATIVE_ADMIN_PASSWORD` 提供唯一管理员账号，`apps/admin-web/src/app/adminRoutes.ts` 定义 18 个一级 Tab，`server-rs/crates/api-server/src/modules/admin.rs` 中的后台路由只校验统一的管理员 JWT。
+
+改造后的目标如下：
+
+1. 现有环境变量账号升级为 `owner`，仍由部署环境提供，不迁移、不复制到 SpacetimeDB。
+2. owner 始终拥有全部 18 个业务 Tab 权限，并独占“账号管理”Tab 和账号管理 API。
+3. owner 可以创建、修改、启停 member；member 保存在 SpacetimeDB 私有表 `admin_account`。
+4. member 按一级 Tab 分配权限；获得一个 Tab 权限即获得该页面内全部读写能力，页面内部二级 Tab、弹窗和操作区继承一级权限。
+5. member JWT 每次请求都重新读取当前账号并校验 `enabled`、`token_version` 和实时权限，权限、密码或启停变更应立即让旧 JWT 失效。
+
+## 3. 角色与不可变规则
+
+### 3.1 owner
+
+- owner 用户名和密码继续读取 `GENARRATIVE_ADMIN_USERNAME`、`GENARRATIVE_ADMIN_PASSWORD`。
+- owner 是环境变量构造的虚拟账号，不写入 `admin_account`，不允许通过后台改名、改密、禁用或删除。
+- owner 始终拥有本文列出的全部 18 个可分配权限，不能在前端取消，也不从数据库加载权限。
+- “账号管理”是 owner-only 能力。它可以作为新增一级路由 `accounts` / `#accounts` 展示，但 `accounts` 不进入 `ADMIN_TAB_PERMISSIONS`，不能写入 member 的 `permissions_json`。
+- owner 会话返回 `accountRole = "owner"`、`roles = ["admin", "owner"]`；账号管理权限必须根据服务端确认的 `accountRole` 判断，不能只相信前端角色字符串。
+- owner 配置缺失时，后台整体保持未启用状态；不能依赖数据库中的 member 绕过 owner 引导配置启动后台。
+
+### 3.2 member
+
+- member 只来自 `admin_account`，不新增第二套环境变量账号。
+- member 会话返回 `accountRole = "member"`、`roles = ["admin", "member"]` 和当前实时 `tabPermissions`。
+- member 永远不能访问账号管理页面或账号管理 API，也不能给自己或他人分配 `accounts`。
+- member 的一个一级 Tab 权限覆盖该页面的查询、创建、修改、启停、退款等全部现有操作，不拆成 `read` / `write`。
+- 页面内二级 Tab、筛选视图、抽屉、弹窗和共享详情弹窗继承触发它的一级 Tab 权限，不另设 permission id。
+
+## 4. 权限标识
+
+`ADMIN_TAB_PERMISSIONS` 必须是 shared-contracts 与 admin-web 共用的闭合集合，值与现有 `AdminRouteId` 一致。18 个可分配权限如下，顺序同时作为前端寻找“第一可访问项”的稳定顺序：
+
+| permission id | 一级 Tab | hash |
+| --- | --- | --- |
+| `dashboard` | Dashboard | `#dashboard` |
+| `overview` | 服务总览 | `#overview` |
+| `tables` | 表查询 | `#tables` |
+| `debug` | API 调试 | `#debug` |
+| `tracking` | 埋点数据 | `#tracking` |
+| `gray-release` | 灰度发布 | `#gray-release` |
+| `redeem` | 兑换码 | `#redeem` |
+| `invite` | 邀请码 | `#invite` |
+| `profile-wallet` | 账号配置 | `#profile-wallet` |
+| `tasks` | 任务配置 | `#tasks` |
+| `recharge-products` | 充值商品 | `#recharge-products` |
+| `recharge-orders` | 充值管理 | `#recharge-orders` |
+| `editor-generation-pricing` | 模型定价 | `#editor-generation-pricing` |
+| `editor-showcase` | 精选审核 | `#editor-showcase` |
+| `editor-assets` | 素材查询 | `#editor-assets` |
+| `creation-announcement` | 入口公告 | `#creation-announcement` |
+| `creation-entry` | 入口开关 | `#creation-entry` |
+| `work-visibility` | 作品可见性 | `#work-visibility` |
+
+权限数组必须去重并按上表顺序规范化后保存。保存时拒绝未知值和 `accounts`；读取旧数据时遇到未知值应忽略并记录告警，绝不能将未知值解释为全权限。空数组合法，表示 member 可以登录但没有业务页面权限。
+
+后续新增一级 Tab 时，必须在同一次改动中更新：
+
+- shared-contracts 的 `ADMIN_TAB_PERMISSIONS`。
+- admin-web 的路由定义、权限标签和第一可访问项顺序。
+- 本文 API-to-Tab 权限矩阵。
+- 后端路由权限测试；没有明确权限映射的新 `/admin/api/*` 路由必须默认拒绝 member，而不是默认放行。
+
+## 5. 数据模型
+
+新增 SpacetimeDB 私有表 `admin_account`。表不能标记 `public`，浏览器不能订阅或直查；所有读写都由 `api-server -> spacetime-client facade -> 受限 procedure` 完成。
+
+| 字段 | Rust / SpacetimeDB 类型 | 约束与语义 |
+| --- | --- | --- |
+| `account_id` | `String` | 主键；服务端生成不可变 opaque id，建议 `admin-account-<uuid>`，请求体不得指定 |
+| `username` | `String` | `unique`；登录名，创建后不可修改；按 `trim + ASCII lowercase` 规范化 |
+| `display_name` | `String` | 展示名，去除首尾空白后 1 至 64 字符 |
+| `password_hash` | `String` | Argon2id PHC 字符串；只在内部登录查询中返回给 api-server，永不进入 HTTP DTO、日志或前端状态 |
+| `permissions_json` | `String` | 规范化后的 Tab permission JSON；只允许第 4 节 18 个值，空数组为 `[]` |
+| `enabled` | `bool` | 是否允许登录和继续使用现有 JWT |
+| `token_version` | `u64` | 初始为 `1`；权限、密码或启停状态发生有效变化时加 `1` |
+| `created_by` | `String` | 创建者后台 subject；当前只能是 owner subject |
+| `updated_by` | `String` | 最近更新者后台 subject；当前只能是 owner subject |
+| `created_at` | `Timestamp` | 创建时间，使用 `ctx.timestamp` |
+| `updated_at` | `Timestamp` | 最近更新时间，使用 `ctx.timestamp` |
+
+账号规则：
+
+- `username` 建议限制为 3 至 64 个字符，只允许 ASCII 字母、数字、`.`、`_`、`-`；规范化后做唯一性校验。
+- owner 用户名属于保留名称。创建 member 时必须同时与当前规范化后的 owner 用户名比较并拒绝冲突，不能只依赖 `admin_account.username` 唯一索引。
+- 密码明文只存在于登录、创建和改密请求生命周期内；限制为 6 至 128 个字符，并复用 `platform-auth` 的 Argon2id 哈希与校验能力。Argon2id 必须在 blocking 任务中执行，api-server 通过有界信号量限制同时 hash / verify 数量，不得占用 Tokio worker 或无界堆积高成本任务。
+- 不提供物理删除 API。离职或停用通过 `enabled = false` 完成，以保留 `created_by`、`updated_by` 和账号标识。
+- `display_name` 单独变化只更新 `updated_by`、`updated_at`，不要求递增 `token_version`；权限、密码、`enabled` 任一有效变化必须在同一事务中递增版本。
+- `u64` 版本到达上限时更新失败关闭，不能回绕。
+
+## 6. SpacetimeDB 与 facade 边界
+
+建议新增 `server-rs/crates/spacetime-module/src/admin_account.rs`，并在 `spacetime-client` 增加对应 admin facade。至少提供以下 typed procedures：
+
+| procedure | 用途 | 是否可返回 `password_hash` |
+| --- | --- | --- |
+| `get_admin_account_by_username_and_return` | member 登录查询 | 是，仅返回给 api-server 内部认证路径 |
+| `get_admin_account_by_id_and_return` | member JWT 逐请求校验 | 否 |
+| `list_admin_accounts_and_return` | owner 账号列表 | 否 |
+| `create_admin_account_and_return` | owner 创建 member | 否 |
+| `update_admin_account_and_return` | owner 更新展示名、密码 hash、权限、启停 | 否 |
+
+所有 `admin_account` procedures 都必须在事务入口调用现有 `require_editor_generation_runtime_service_identity(...)` 等价的统一 runtime service identity 守卫，只允许 api-server 当前 runtime service identity 调用。不能因为它们位于后台命名空间就接受任意 SpacetimeDB client identity，也不能新增 public table/view 暴露账号或 hash。
+
+写 procedure 接收由 api-server 从已认证 owner 会话生成的 `actor_subject`，校验非空后写入 `created_by` / `updated_by`。SpacetimeDB 仍以 `ctx.sender()` 校验调用方是 runtime service identity；不能把请求体中的 actor 当成调用身份。
+
+procedure result 使用 typed snapshot，不使用不透明 `row_json`。账号列表 snapshot 明确排除 `password_hash`；登录专用 snapshot 与普通账号 DTO 分离，避免序列化时误回传 hash。
+
+## 7. 登录与 JWT 契约
+
+### 7.1 登录优先级
+
+`POST /admin/api/login` 按下列固定顺序处理：
+
+1. 规范化提交的用户名。
+2. 若用户名等于 owner 用户名，直接校验 `GENARRATIVE_ADMIN_PASSWORD`。
+3. owner 密码不匹配时返回统一的“管理员用户名或密码错误”，不得继续查询同名 member。
+4. 用户名不等于 owner 时，按规范化用户名查询 `admin_account`。
+5. member 不存在、`enabled = false` 或 Argon2id 校验失败时返回同一登录错误，不泄露账号是否存在或被停用。
+6. member 登录成功后，用当前 `account_id`、`token_version` 签发后台 JWT。
+
+owner 优先既保持原账号行为，也防止数据库同名记录遮蔽或降级 owner。密码比较不得写日志；member 必须复用 Argon2id 校验，不能存明文或可逆密文。未知 member、已停用 member 和 owner 错误密码路径仍执行同成本 dummy Argon2id 校验，避免从响应耗时枚举启用账号。
+
+### 7.2 JWT claims 与逐请求校验
+
+后台 JWT 继续使用后台独立 TTL 与签名配置。claims 至少能区分：
+
+- `account_type`: `owner | member`。
+- owner 的稳定 subject，或 member 的 `account_id` subject。
+- `token_version`：member 使用表中当前值；owner 使用固定虚拟值，不能由数据库覆盖。
+- `roles`：保留 `admin`，并追加 `owner` 或 `member`。
+
+权限不作为 JWT 中的授权真相。即使为调试在 claims 中携带 permissions，后端也必须忽略它并读取实时账号。
+
+`require_admin_auth` 每次请求都要构造“当前账号”：
+
+1. 验签并校验后台 issuer、过期时间和 `admin` role。
+2. owner JWT：与当前环境变量构造的 owner subject 匹配，得到始终启用、全权限的虚拟当前账号；owner 不查 `admin_account`。
+3. member JWT：按 claim 中 `account_id` 调用 `get_admin_account_by_id_and_return`，账号不存在或 `enabled = false` 时拒绝。只有明确的账号不存在才视为凭据失效；SpacetimeDB 超时、断连或 procedure 故障必须失败关闭但保留 `502/503` 依赖错误语义，不能伪装成 `401` 导致前端清除 token。
+4. member claim 的 `token_version` 必须与表中当前值完全一致，否则返回 `401 Unauthorized` 并要求重新登录。
+5. 将服务端实时构造的 `AuthenticatedAdmin` 放入 request extensions，后续权限 middleware 只读取该对象，不再相信原始 claims。
+
+权限、密码、启停更新递增 `token_version` 后，目标 member 的所有旧 JWT 从下一次请求开始失效。owner 修改自己的环境变量密码仍通过部署配置和服务重启完成；owner 不入表，因此不使用 member 的 `token_version` 机制。
+
+### 7.3 会话响应
+
+`AdminSessionPayload` 在现有字段基础上增加：
+
+```text
+accountRole: "owner" | "member"
+tabPermissions: string[]
+```
+
+owner 返回全部 18 个 permission id；member 返回数据库中的实时规范化数组。`GET /admin/api/me` 同样执行逐请求校验并返回实时权限，供刷新页面后恢复导航。
+
+后台所有面向运营展示的管理员身份统一使用 `displayName`。审计表继续保存稳定 subject，例如 owner subject 或 `admin-account-<uuid>`；api-server 在返回兑换码、邀请码等操作记录时，按 owner 运行态和 `admin_account` 批量解析显示名称，同时兼容历史用户名记录。已无法解析的历史主体统一展示“已停用管理员”，前端不得直接渲染 `operatorUserId`、账号 ID 或登录用户名代替显示名称。对写接口，显示名目录必须在主事务前加载，或在主事务成功后降级为占位文案；不得因二次读取失败把已提交写入伪装成失败。
+
+## 8. 权限中间件与错误语义
+
+在统一 `require_admin_auth` 之后增加可复用的权限守卫，支持：
+
+- `require_admin_permission(permission)`：owner 自动通过；member 必须包含该 permission。
+- `require_any_admin_permission([permission...])`：owner 自动通过；member 至少包含一个，用于共享 API。
+- `require_admin_owner`：只接受服务端确认的 owner。
+
+返回语义统一如下：
+
+- `401 Unauthorized`：token 缺失、无效、过期，member 不存在、被停用或 `token_version` 过期。
+- `403 Forbidden`：会话有效但缺少目标 Tab 权限，或 member 请求 owner-only API。
+- 前端收到 `401` 清除本地 token 并回到登录页；收到 `403` 不应伪装成掉线，应刷新 `/me` 权限并跳转到第一可访问项或零权限空态。
+
+## 9. API-to-Tab 权限矩阵
+
+下表覆盖 `server-rs/crates/api-server/src/modules/admin.rs` 当前全部路由，并追加账号管理 API。`A OR B` 表示 member 拥有任一权限即可；owner 对全部行自动通过。
+
+| Method | 路径 | 权限 |
+| --- | --- | --- |
+| `POST` | `/admin/api/login` | 公开登录入口，不要求 JWT |
+| `GET` | `/admin/api/me` | 任意有效后台会话 |
+| `GET` | `/admin/api/overview` | `overview` |
+| `GET` | `/admin/api/dashboard` | `dashboard` |
+| `POST` | `/admin/api/debug/http` | `debug` |
+| `GET` | `/admin/api/tracking/events` | `tracking` |
+| `GET` | `/admin/api/tracking/event-keys` | `tracking OR tasks` |
+| `GET` | `/admin/api/database/tables` | `tables` |
+| `GET` | `/admin/api/database/tables/{table_name}/rows` | `tables` |
+| `GET` | `/admin/api/creation-entry/config` | `gray-release OR creation-announcement OR creation-entry` |
+| `POST` | `/admin/api/creation-entry/config` | `creation-entry` |
+| `POST` | `/admin/api/creation-entry/config/banners` | `creation-announcement` |
+| `POST` | `/admin/api/creation-entry/config/interactions` | `creation-entry` |
+| `GET` | `/admin/api/feature-gates` | `gray-release` |
+| `PUT` | `/admin/api/feature-gates` | `gray-release` |
+| `GET` | `/admin/api/editor-generation-pricing` | `editor-generation-pricing` |
+| `POST` | `/admin/api/editor-generation-pricing` | `editor-generation-pricing` |
+| `GET` | `/admin/api/editor-assets` | `editor-assets` |
+| `GET` | `/admin/api/assets/read-url` | `editor-assets OR editor-showcase` |
+| `GET` | `/admin/api/editor-showcase/assets` | `editor-showcase` |
+| `POST` | `/admin/api/editor-showcase/assets/review` | `editor-showcase` |
+| `POST` | `/admin/api/editor-showcase/assets/display` | `editor-showcase` |
+| `GET` | `/admin/api/editor-showcase/campaign` | `editor-showcase` |
+| `POST` | `/admin/api/editor-showcase/campaign` | `editor-showcase` |
+| `POST` | `/admin/api/editor-showcase/campaign/image-upload-ticket` | `editor-showcase` |
+| `GET` | `/admin/api/works/visibility` | `work-visibility` |
+| `POST` | `/admin/api/works/visibility` | `work-visibility` |
+| `GET` | `/admin/api/profile/redeem-codes` | `redeem` |
+| `POST` | `/admin/api/profile/redeem-codes` | `redeem` |
+| `POST` | `/admin/api/profile/redeem-codes/disable` | `redeem` |
+| `GET` | `/admin/api/profile/invite-codes` | `invite` |
+| `POST` | `/admin/api/profile/invite-codes` | `invite` |
+| `GET` | `/admin/api/profile/tasks` | `tasks` |
+| `POST` | `/admin/api/profile/tasks` | `tasks` |
+| `POST` | `/admin/api/profile/tasks/disable` | `tasks` |
+| `GET` | `/admin/api/profile/wallet-config` | `profile-wallet` |
+| `POST` | `/admin/api/profile/wallet-config` | `profile-wallet` |
+| `GET` | `/admin/api/profile/recharge-products` | `recharge-products` |
+| `POST` | `/admin/api/profile/recharge-products` | `recharge-products` |
+| `GET` | `/admin/api/profile/recharge-orders` | `recharge-orders` |
+| `POST` | `/admin/api/profile/recharge-refunds/preview` | `recharge-orders` |
+| `POST` | `/admin/api/profile/recharge-refunds/execute` | `recharge-orders` |
+| `POST` | `/admin/api/profile/recharge-refunds/register` | `recharge-orders` |
+| `POST` | `/admin/api/profile/recharge-refunds/manual-review/resolve` | `recharge-orders` |
+| `GET` | `/admin/api/profile/users/detail` | `tables OR tracking OR recharge-orders OR editor-showcase OR editor-assets OR work-visibility` |
+| `POST` | `/admin/api/profile/wallet-restriction` | `recharge-orders` |
+| `GET` | `/admin/api/accounts` | owner-only |
+| `POST` | `/admin/api/accounts` | owner-only |
+| `PUT` | `/admin/api/accounts/{account_id}` | owner-only |
+
+三个共享读取接口必须按 OR 规则实现，不能为了复用简单中间件扩大成“任意 member 可访问”：
+
+- `/admin/api/assets/read-url` 只服务素材查询和精选审核。
+- `/admin/api/profile/users/detail` 只服务当前实际包含用户详情入口的表查询、埋点数据、充值管理、精选审核、素材查询和作品可见性页面。
+- `GET /admin/api/creation-entry/config` 同时为灰度发布、入口公告和入口开关提供页面初始化数据；写操作仍按具体页面单独收紧。
+
+## 10. 账号管理 HTTP 契约
+
+账号管理 API 放在现有 `/admin/api` 命名空间，统一使用现有 success/error envelope。
+
+### 10.1 `GET /admin/api/accounts`
+
+返回：
+
+```text
+accounts: Array<{
+  accountId,
+  username,
+  displayName,
+  tabPermissions,
+  enabled,
+  tokenVersion,
+  createdBy,
+  updatedBy,
+  createdAt,
+  updatedAt
+}>
+```
+
+首项由 api-server 根据环境变量合成只读 owner 记录，后续 member 按用户名和账号 ID 稳定排序。不得返回 `password` 或 `passwordHash`，owner 记录必须带 `accountRole = "owner"` 且前后端都拒绝编辑。
+
+### 10.2 `POST /admin/api/accounts`
+
+请求：
+
+```text
+{
+  username: string,
+  displayName: string,
+  password: string,
+  tabPermissions: string[],
+  enabled?: boolean
+}
+```
+
+`password` 创建时必填；`enabled` 默认 `true`。api-server 完成用户名、密码和权限校验，使用 Argon2id 生成 hash 后调用创建 procedure。用户名冲突返回 `409 Conflict`；参数非法返回 `400 Bad Request`。响应为不含任何密码字段的 `account`。
+
+### 10.3 `PUT /admin/api/accounts/{account_id}`
+
+请求：
+
+```text
+{
+  displayName: string,
+  password?: string,
+  tabPermissions: string[],
+  enabled: boolean
+}
+```
+
+`username` 和 `account_id` 不可修改。更新请求完整提交显示名称、Tab 权限和启停状态；密码省略表示不修改，空字符串密码作为非法参数拒绝。api-server 只在提供新密码时生成新 hash。procedure 比较有效变化，在权限、密码或启停任一变化时只递增一次 `token_version`，并在同一事务写入账号字段、`updated_by`、`updated_at`。响应仍不返回密码或 hash。
+
+## 11. admin-web 行为
+
+### 11.1 路由与导航
+
+- `adminRoutes` 增加权限元数据；18 个业务路由使用同名 permission id。
+- `accounts` 路由只在 `admin.accountRole === "owner"` 时加入侧栏和移动底栏，不属于 member 可分配列表。
+- member 导航只渲染 `admin.tabPermissions` 包含的业务路由。页面组件也必须只在当前路由已授权时挂载，避免隐藏导航后仍发起无权限 API。
+- owner 渲染全部业务路由和账号管理路由。
+
+### 11.2 hash 回落
+
+登录成功、`GET /me` 恢复会话、权限刷新和 `hashchange` 时都执行同一解析：
+
+1. 当前 hash 对应可访问路由时保持不变。
+2. hash 未知、属于无权限业务 Tab，或 member 访问 `#accounts` 时，使用 `replaceState` 回落到按第 4 节顺序找到的第一可访问业务 Tab。
+3. member 权限为空时，不回落 Dashboard；渲染独立的零权限空态，只保留账号信息和退出登录，不挂载任何业务页，也不发起业务 API。
+4. owner 的默认项仍可保持 Dashboard；账号管理不改变 18 个业务路由的排序。
+
+后端返回 `403` 时，前端重新请求 `/me` 获取实时权限并执行上述回落。即使前端状态陈旧或被篡改，后端权限 middleware 仍必须拒绝越权请求。
+
+### 11.3 账号管理页
+
+- 权限编辑器展示 18 个明确的 checkbox，每项使用现有 Tab 中文名称；不能展示或提交 `accounts`。
+- 创建和编辑使用独立弹窗或抽屉，不在列表下方追加表单。
+- 编辑时密码字段默认空，空表示请求中省略 `password`；页面永不展示现有密码或 hash。
+- 停用使用开关并二次确认。保存成功后以 API 返回 account snapshot 更新列表。
+- owner 以只读项显示在账号列表首位，页面顶部同时标明当前 owner；owner 行不可进入编辑表单，后端也拒绝以 owner subject 调用更新接口。
+
+## 12. 实现落点
+
+建议按以下边界落地，避免在前端或 `api-server` 重新发明持久化规则：
+
+- `shared-contracts`：`ADMIN_TAB_PERMISSIONS`、扩展后的 `AdminSessionPayload`、账号管理 request/response DTO。
+- `spacetime-module`：私有表、输入类型、typed procedures、唯一性与版本递增事务。
+- `spacetime-client`：生成绑定、row mapper、登录查询与账号管理 facade。
+- `api-server`：owner/member 登录编排、Argon2id、逐请求账号解析、权限 middleware、账号管理 handlers。
+- `apps/admin-web`：权限感知路由、hash 回落、零权限空态、owner-only 账号管理页。
+
+不能将 `permissions_json` 的解析与授权只放在前端；不能让 admin-web 直连 SpacetimeDB；不能用进程内 member 列表替代 `admin_account`。
+
+## 13. 迁移、绑定与发布顺序
+
+`admin_account` 是新增私有表，没有旧数据回填。原环境变量 owner 不入表，因此迁移不创建 owner 行。
+
+实现 schema 后必须：
+
+1. 将 `admin_account` 加入 `server-rs/crates/spacetime-module/src/migration.rs` 的导入导出/迁移表目录，保证备份迁移保留 member。
+2. 将表和 procedures 加入 `docs/【后端架构】server-rs与SpacetimeDB数据契约-2026-05-15.md` 的机器可读表目录与后台契约。
+3. 生成并提交 `spacetime-client` bindings，不手改生成文件。
+4. 先发布 SpacetimeDB module，再发布依赖新 procedures 的 api-server，最后发布 admin-web。
+
+本地生成与门禁命令：
+
+```bash
+npm run spacetime:generate
+npm run check:admin-account-procedures
+npm run check:spacetime-runtime-access
+npm run check:spacetime-schema
+npm run check:server-rs-ddd
+```
+
+本地迁移联调优先使用项目脚本：
+
+```bash
+npm run dev:spacetime
+npm run dev:api-server
+```
+
+需要人工发布到指定 SpacetimeDB 时必须显式目标，不使用 `spacetime --root-dir`：
+
+```bash
+spacetime publish <database> \
+  --server <server-url> \
+  --module-path server-rs/crates/spacetime-module \
+  --yes=migrate
+```
+
+回滚旧 api-server 时保留 `admin_account` 表和数据；旧版本只认识 owner，不会读取 member。不得为了回滚删除表或清空 member 数据。
+
+## 14. 测试与验收
+
+### 14.1 后端与数据
+
+- owner 使用原环境变量账号密码登录成功，且不生成 `admin_account` 行。
+- owner 用户名匹配但密码错误时，不回退到 member 查询。
+- member 密码使用 Argon2id 校验；账号不存在、密码错误、停用账号返回相同登录错误。
+- member 私表不能被普通 SpacetimeDB identity 查询或调用 procedure；只有 runtime service identity 可读写。
+- 创建重复规范化用户名、owner 保留用户名、未知权限或 `accounts` 权限均失败。
+- GET/POST/PUT 账号 API 任何响应和日志都不包含明文密码或 `password_hash`。
+- 权限、密码、启停更新各自会递增 `token_version`；同一次请求修改多项只递增一次；仅改展示名不递增。
+- member 被停用、改密或改权限后，旧 JWT 下一次请求返回 401；重新登录后获得实时权限。
+- API-to-Tab 矩阵逐路由覆盖 `modules/admin.rs`，每条路由至少测试 owner 成功、具备权限的 member 成功、缺权限 member 返回 403。
+- 三个共享读取接口分别覆盖每个允许 permission 的成功用例，以及无关 permission 的 403 用例。
+- owner-only 账号 API 对任意 member 都返回 403，即使其 `permissions_json` 被污染为包含 `accounts`。
+
+### 14.2 前端
+
+- owner 看到 18 个业务 Tab 和账号管理；member 只看到被分配的业务 Tab。
+- 每个一级 Tab 内的二级 Tab、弹窗和写操作继承一级权限并正常使用，不出现“页面可见但内部 API 403”的错误映射。
+- 直接输入无权限 hash 自动替换为第一可访问项，不短暂挂载无权限页面。
+- 当前 Tab 权限被 owner 收回后，下一请求触发重新登录；新会话恢复后落到第一可访问项。
+- 零权限 member 登录后显示空态，不回落 Dashboard、不发送 Dashboard 或其它业务请求，并可正常退出。
+- 桌面侧栏和移动底栏应用同一过滤结果；账号创建/编辑弹层在移动端和桌面端都可操作。
+- 编辑账号时页面不读取、不显示、不回填密码；不改密码时 PUT 请求不包含 `password`。
+
+### 14.3 建议验证命令
+
+```bash
+cargo test -p spacetime-module --manifest-path server-rs/Cargo.toml admin_account
+cargo test -p spacetime-client --manifest-path server-rs/Cargo.toml admin_account
+cargo test -p api-server --manifest-path server-rs/Cargo.toml admin
+npm run check:admin-account-procedures
+npx vitest run apps/admin-web/src/app/adminRoutes.test.ts \
+  apps/admin-web/src/app/AdminApp.test.tsx \
+  apps/admin-web/src/pages/AdminAccountManagementPage.test.tsx
+npm run admin-web:typecheck
+npm run check:encoding
+git diff --check
+```
+
+API smoke 使用 `npm run dev:api-server` 启动后端，先检查 `/healthz`，再用 owner 和至少两个不同权限集合的 member 验证登录、`/admin/api/me`、共享 OR 路由、越权 403 和 `token_version` 即时失效。
+
+## 15. 非目标
+
+- 不提供 member 自助改密、忘记密码、MFA、SSO 或外部身份源。
+- 不提供按钮级、字段级、只读/读写分离权限。
+- 不提供 owner 数据库化、多个 owner 或 member 删除。
+- 不改变普通用户认证、普通用户 `token_version` 或主站权限体系。
+- 不把后台账号暴露为公开 SpacetimeDB 表、浏览器 subscription 或普通用户账号。
diff --git a/docs/【协作规范】Agent工作入口与执行准则-2026-06-22.md b/docs/【协作规范】Agent工作入口与执行准则-2026-06-22.md
index a2d523728..d93111563 100644
--- a/docs/【协作规范】Agent工作入口与执行准则-2026-06-22.md
+++ b/docs/【协作规范】Agent工作入口与执行准则-2026-06-22.md
@@ -66,7 +66,7 @@ RAG 默认不安装运行时依赖，也不把 LanceDB、Transformers.js 或本
 - 领域规则沉到 `module-*`；SpacetimeDB 表、reducer、procedure、事务 adapter 和 row mapper 留在 `spacetime-module`。
 - 后端访问 SpacetimeDB 统一经 `spacetime-client` facade。
 - HTTP / SSE / BFF 和外部副作用编排留在 `api-server`；OSS、LLM、认证、语音等外部平台能力留在 `platform-*`。
-- 前后端 DTO 和公开契约留在 `shared-contracts` / `packages/shared`。
+- 前后端 DTO、公开契约和跨页面复用的无业务真相 TypeScript 代码留在 `shared-contracts` / `packages/shared`；共享 UI 组件与纯工具可留在 `packages/shared`，但领域规则、后端副作用和正式状态不得下沉。
 - 契约、路由、DTO 去留和 breaking change 以当前后端架构文档、`api-server/src/app.rs`、`shared-contracts` 和 `packages/shared` 为准。
 
 后端修改后按当前 DDD 文档执行验收。涉及 API smoke 时，使用 `npm run dev:api-server` 重新拉起后端并检查 `/healthz`；不要使用旧 `maincloud` 启动口径。
diff --git a/docs/【后端架构】SpacetimeDB连接池租约Drop兜底与取消安全-2026-06-11.md b/docs/【后端架构】SpacetimeDB连接池租约Drop兜底与取消安全-2026-06-11.md
index e72bec65a..c8045545f 100644
--- a/docs/【后端架构】SpacetimeDB连接池租约Drop兜底与取消安全-2026-06-11.md
+++ b/docs/【后端架构】SpacetimeDB连接池租约Drop兜底与取消安全-2026-06-11.md
@@ -30,11 +30,24 @@
 
 ## 验收
 
-- `cargo test -p spacetime-client --manifest-path server-rs/Cargo.toml --lib`（35 通过，含上述新测试）
+- `cargo test -p spacetime-client --manifest-path server-rs/Cargo.toml --lib`（44 通过，含上述连接池与缓存连接测试）
 - `cargo test -p api-server --manifest-path server-rs/Cargo.toml readyz`（2 通过）
 - `cargo check -p api-server --manifest-path server-rs/Cargo.toml`
 
+## 2026-07-14 缓存读连接拆分
+
+HTTP 角色的连接拓扑调整为“`pool_size` 条调用连接 + 1 条缓存读连接”：
+
+1. 调用连接池只承接 procedure / reducer 回调，不订阅 read model，也不装载订阅行；`GENARRATIVE_SPACETIME_POOL_SIZE=8` 表示 8 条调用连接，不包含额外的缓存读连接。
+2. 缓存读连接只由 `read_after_connect` 使用，并持有一份 required / optional read-model subscriptions。多个本地读取通过 `Arc` 共享同一 SDK `ClientCache`，初始化和断线重建使用单飞锁，读取本身不经过单槽 semaphore 串行化。
+3. 缓存读连接断线后，下一次读取只重建一条连接并等待 required subscriptions 全部 applied；首次建连与 required / optional 订阅共用一次总超时预算，optional 阶段发生断线时禁止发布 broken 连接；旧连接由在途读取持有到结束后再断开。
+4. `/readyz` 对 HTTP 角色同时检查调用池连接和缓存读连接；required subscription 失败时不得报告 ready。worker / controller 关闭 read-model cache 时不创建额外连接。
+5. 这里的“只读”是 facade 用途边界。SpacetimeDB Rust SDK 2.6 没有连接级 read-only builder；缓存连接仍使用相同 runtime identity，但代码不向 procedure / reducer 调用路径暴露它。
+
+该拆分把相同 read-model 行缓存从 `pool_size` 份降为 1 份；SDK 每条连接仍会注册空 table metadata，总 WebSocket 数在 HTTP 角色中会从 `pool_size` 增加到 `pool_size + 1`，因此不能把总 RSS 简单承诺为原来的 `1 / pool_size`。
+
 ## 运维提示
 
 - 此修复解决的是"取消导致的永久泄漏"。StDB 真慢时仍会出现成批 45 秒超时（连接被在途请求合法占用），那是容量/上游问题，应结合 `GENARRATIVE_SPACETIME_POOL_SIZE` 与 StDB 负载排查，不要再怀疑池泄漏。
 - 健康检查 `/readyz` 在池被在途请求占满时仍可能短暂 503（stage=pool_acquire），恢复后自动转好，无需重启。
+- HTTP 角色排查连接数时按“调用池 + 1 条缓存读连接”计算；外部生成唤醒和充值过期监听还有各自的窄订阅连接，不属于调用池或缓存读连接。
diff --git a/docs/【后端架构】server-rs与SpacetimeDB数据契约-2026-05-15.md b/docs/【后端架构】server-rs与SpacetimeDB数据契约-2026-05-15.md
index ff9519ea4..696e8ac0a 100644
--- a/docs/【后端架构】server-rs与SpacetimeDB数据契约-2026-05-15.md
+++ b/docs/【后端架构】server-rs与SpacetimeDB数据契约-2026-05-15.md
@@ -34,7 +34,7 @@ SpacetimeDB 版本口径：当前 Rust crate `spacetimedb`、`spacetimedb-sdk`
 3. SpacetimeDB 表结构、reducer、procedure 和持久化 row shape 留在 `spacetime-module`。
 4. 后端访问 SpacetimeDB 必须经 `spacetime-client` facade。
 5. HTTP 鉴权、BFF 聚合、SSE、外部模型编排、OSS 上传和第三方回调在 `api-server`。
-6. 前端共享 DTO 通过 `shared-contracts` 和 `packages/shared` 对齐，不在页面内重新发明旧接口。
+6. 前端共享 DTO 通过 `shared-contracts` 和 `packages/shared` 对齐，不在页面内重新发明旧接口；`packages/shared` 还可复用无业务真相的 UI 组件和纯工具，领域规则、后端副作用与正式状态仍留在各自分层。
 7. 微信能力按两层收口：`server-rs/crates/platform-wechat` 承载微信协议 client、订阅消息 `stable_token` / `subscribeMessage.send`、微信支付 V3 / 虚拟支付消息推送的 HTTP header、签名、验签、解密、mock 响应和协议 payload 解析；`server-rs/crates/api-server/src/wechat.rs` 与 `wechat/*` 承载 Axum handler、AppConfig 到平台配置的映射、Genarrative 用户 / 订单 / 钱包 / SSE / 错误 envelope 编排。`platform-auth` 当前仍承载微信 OAuth / 小程序登录 provider 协议，`api-server::wechat::provider` 只作为组合根 adapter，不在业务 handler 内散落 provider 构造。
 
 验证：
@@ -54,15 +54,15 @@ npm run check:server-rs-ddd
 路由树由 `server-rs/crates/api-server/src/app.rs` 统一构造。当前主要分组：
 
 - 健康检查：`GET /healthz`。
-- 后台管理：`/admin/api/*`，包括登录、Dashboard 运营看板、概览、HTTP debug、埋点、表查询、精选审核、素材查询、创作入口开关、作品互动配置、作品可见性、兑换码、邀请码、任务配置和充值商品配置。Dashboard 指标口径见 [`docs/technical/【后台管理】Dashboard运营看板方案-2026-06-23.md`](./technical/【后台管理】Dashboard运营看板方案-2026-06-23.md)。
+- 后台管理：`/admin/api/*`，包括登录、Dashboard 运营看板、概览、HTTP debug、埋点、表查询、精选审核、素材查询、创作入口开关、作品互动配置、作品可见性、兑换码、邀请码、任务配置、充值商品配置和后台账号管理。环境变量管理员固定作为 owner，持久化 member 每次请求按当前 `enabled`、`token_version` 和一级 Tab 权限实时校验；账号管理仅 owner 可访问，未登记权限映射的新后台路由对 member 默认拒绝。完整权限矩阵见 [`docs/technical/【后台管理】多账号与Tab访问权限方案-2026-07-14.md`](./technical/【后台管理】多账号与Tab访问权限方案-2026-07-14.md)，Dashboard 指标口径见 [`docs/technical/【后台管理】Dashboard运营看板方案-2026-06-23.md`](./technical/【后台管理】Dashboard运营看板方案-2026-06-23.md)。
 - 认证与账号：`/api/auth/*`、`/api/profile/me`，包括短信、密码、微信、refresh session、多端会话和登出。
 - 个人中心：`/api/profile/*`，包括钱包流水、任务、领奖、充值、反馈、邀请和兑换等账号侧能力。
 - 平台基础能力：`/api/llm/*`、`/api/speech/volcengine/*`，只保留通用 LLM 和语音代理。
-- 资产基础能力：`/api/assets/direct-upload-tickets`、`/api/assets/sts-upload-credentials`、`/api/assets/objects/*`、`/api/assets/read-url`、`/api/assets/read-bytes`，负责直传、确认、绑定和读取。两个读取入口共用同一授权函数，并通过受 runtime service identity 限制的 procedure 在同一事务快照内按配置 bucket 与精确 key 权威查询 `asset_object`、计算 `public_work_asset_read_grant`；不得把任意连接的订阅 cache miss 或命中解释为当前授权真相。一旦存在 metadata，即使 key 命中 legacy 前缀，也必须按 `PublicRead`、当前登录 owner，或同 owner 的公开作品派生授权精确读取；只有同 bucket / key 的权威查询确认未登记时，才允许显式 `legacyPublicPath` 命中 `platform_oss::LEGACY_PUBLIC_PREFIXES` curated 白名单后匿名兼容。已登记资产继续保持 `private`，公开作品只获得与正式发布快照生命周期一致的派生读授权，不得批量改为 `PublicRead` 或放开 `generated-*` 前缀。任意未登记 `objectKey`、跨 owner 和未获授权的匿名私有读取统一返回不存在，`read-bytes` 不得成为绕过 `read-url` 授权的同源代理；公开派生授权、`PublicRead` 和 legacy 兼容读取签发的 URL 统一限制为最长 600 秒，owner / admin 读取保持原有有效期口径。
+- 资产基础能力：`/api/assets/direct-upload-tickets`、`/api/assets/sts-upload-credentials`、`/api/assets/objects/*`、`/api/assets/read-url`、`/api/assets/read-bytes`，负责直传、确认、绑定和读取。两个读取入口共用同一授权函数，并通过受 runtime service identity 限制的 procedure 在同一事务快照内按配置 bucket 与精确 key 权威查询 `asset_object`、计算公开作品或公开精选派生授权；不得把任意连接的订阅 cache miss 或命中解释为当前授权真相。一旦存在 metadata，即使 key 命中 legacy 前缀，也必须按 `PublicRead`、当前登录 owner、同 owner 的公开作品派生授权，或同 owner 且已通过、已展示、返还完成的 `editor_showcase_asset` 精确授权读取；只有同 bucket / key 的权威查询确认未登记时，才允许显式 `legacyPublicPath` 命中 `platform_oss::LEGACY_PUBLIC_PREFIXES` curated 白名单后匿名兼容。已登记资产继续保持 `private`，公开作品和公开精选只获得与正式公开快照生命周期一致的精确派生读授权，不得批量改为 `PublicRead` 或放开 `generated-*` 前缀。任意未登记 `objectKey`、跨 owner 和未获授权的匿名私有读取统一返回不存在，`read-bytes` 不得成为绕过 `read-url` 授权的同源代理；公开派生授权、`PublicRead` 和 legacy 兼容读取签发的 URL 统一限制为最长 600 秒，owner / admin 读取保持原有有效期口径。
 - 外部 OpenAPI：`/api/external/v1/openapi.json`、`/api/external/v1/assets/direct-upload-tickets`、`/api/external/v1/assets/objects/confirm`、`/api/external/v1/assets/read-url`、`/api/external/v1/editor/*`，使用 Bearer API Key 鉴权；API Key 管理仍在登录态 `/api/profile/api-keys`，不进入外部 OpenAPI JSON。主站和 External 的 asset object confirm 都必须从已认证主体派生 owner，不能信任请求体 owner；同 bucket / key 已登记后不得改变 owner。
 - 创作 / 游玩支撑能力：`/api/creation-entry/config`、`/api/ai/tasks*`、`/api/runtime/frontend-config`、`/api/runtime/chat/*`、`/api/runtime/settings`、`/api/runtime/save/snapshot`、`/api/profile/browse-history`、`/api/profile/save-archives*`、`/api/profile/play-stats`、`/api/assets/history`、`/api/assets/character-visual/*`、`/api/assets/character-animation/*`、`/api/assets/character-workflow-cache*`、`/api/assets/hyper3d/*`、`/api/runtime/custom-world/asset-studio/*`、`/api/editor/projects*`、`/api/editor/projects/{projectId}/agent-conversations`、`/api/editor/agent-conversations/{conversationId}*`。`/api/runtime/frontend-config` 由 `api-server` 从运行时环境变量下发非敏感 UI 开关；画板右侧 Agent 入口由 `GENARRATIVE_ENABLE_IMAGE_EDITOR_AGENT_SIDEBAR` 控制，默认关闭，前端不再读取 `VITE_*` 构建期变量决定生产显示。`/api/runtime/custom-world/asset-studio/*` 解析默认角色形象 / 动作提示词时可以在 OSS 缓存不可用或未配置时按无缓存返回默认提示；保存 workflow 缓存和真实素材读写仍必须要求 OSS 正常可用。
 - 后台入口配置：`/admin/api/creation-entry/config`、`/admin/api/creation-entry/config/banners` 和 `/admin/api/creation-entry/config/interactions`。
-- 后台素材查询：`GET /admin/api/editor-assets` 通过 `admin_list_editor_assets_and_return` 后台只读 procedure 读取私有账号级 `editor_asset` 中 `source_type = 'generated'` 的素材，支持 `ownerUserId`、`keyword`、`createdAfter`、`createdBefore`、`cursor` 和 `limit`；返回缩略图 / Object Key、作者展示名、陶泥号、提示词、生成输入和生成成本，只用于查询，不提供分类筛选，也不执行精选审核、返还或展示状态修改，不通过后台 SQL 直查私有表。图片放大、视频和音频预览统一调用仅后台管理员会话可访问的 `GET /admin/api/assets/read-url`；该入口仅为预览允许后台跨 owner 签名，不改变主站 `/api/assets/read-*` 或 External API 的 owner 边界。成功换签后必须写入 `event_key = admin_asset_read_url` 的 `tracking_event`，记录管理员 subject、Object Key / legacy path 和有效期，不记录 signed URL。
+- 后台素材查询：`GET /admin/api/editor-assets` 通过 `admin_list_editor_assets_and_return` 后台只读 procedure 读取私有账号级 `editor_asset` 中 `source_type = 'generated'` 的素材，支持 `ownerUserId`、`keyword`、`createdAfter`、`createdBefore`、`cursor` 和 `limit`；`ownerUserId` 接受内部用户 ID 或精确陶泥号，精确 `SY-*` keyword 也会在调用 procedure 前经认证服务解析成内部 `user_id`，未知陶泥号直接返回空列表。带 owner 条件时 procedure 直接走 `by_editor_asset_owner_user_id`，再按任务分组并以最终产物父项分页；响应中每个父项通过 `children` 携带可展开的中间产物，子项各占一行而不单独占分页名额。手动重拆图集保留真实 `editor-atlas-split-*` `task_id`；来源任务只能通过私有 provenance 由服务端生成账号素材的 source resource / asset object / Object Key 推导，再写入 `group_task_id`，不能信任素材库兼容推断值或普通资源创建接口可提交的 `task_id/asset_kind`；procedure 只有当前 editor generation runtime service identity 才能写入归组与完成事实。没有可信来源的现代拆分显式归到自身任务，不进入 legacy 回溯。每个切片同时写入 `group_task_expected_asset_count`，全部预期 asset ID 成功落库并逐行校验后写入不可逆 cohort 完成事实；read model 只让具有完成事实的一个拆分批次并入原图集父项，用户后来删除单片不会改变初始完成状态，部分失败批次与后续重复拆分按真实任务独立分页，避免残缺批次抢占根任务、单组无限增长或丢素材。历史行兼容沿项目资源链回溯，删除项目时只固化直接引用待删资源且尚未固化的历史行，持久化真实来源任务，不把有界展示 ID 反写覆盖来源。父项返回任务生成器和任务总成本，子项返回阶段生成器和阶段成本。provider 原图 / 角色动作预览承载模型生成成本，抠图、逐帧处理、透明图集和切片成本为 0；中间产物使用所属任务真实 `asset_kind`，不再新写 `editor_green_screen_source`，历史旧值只在 read model 中按 Object Key 映射为 `character`、`icon-spritesheet` 或 `character-animation` 并把旧任务成本只读归回 provider 原始产物。游标固定由父任务微秒时间和素材 ID 组成，API 必须同时识别整数微秒、`seconds.microsZ` 与 RFC3339 时间文本；内部时间无法编码时返回服务错误，不得静默返回 `nextCursor = null`。接口只用于查询，不提供分类筛选，也不执行精选审核、返还或展示状态修改，不通过后台 SQL 直查私有表。图片放大、视频和音频预览统一调用仅后台管理员会话可访问的 `GET /admin/api/assets/read-url`；该入口仅为预览允许后台跨 owner 签名，不改变主站 `/api/assets/read-*` 或 External API 的 owner 边界。成功换签后必须写入 `event_key = admin_asset_read_url` 的 `tracking_event`，记录管理员 subject、Object Key / legacy path 和有效期，不记录 signed URL。
 - 自定义世界 / RPG：`/api/runtime/custom-world*`、`/api/story/*`、`/api/runtime/chat/*`。
 - 拼图：`/api/runtime/puzzle/*`。
 - 抓大鹅 Match3D：`/api/creation/match3d/*`、`/api/runtime/match3d/*`。
@@ -203,16 +203,16 @@ npm run check:server-rs-ddd
 13. 所有微信真实渠道都以微信支付通知或服务端查单确认 `SUCCESS` 为到账事实；小程序、H5 跳转和 Native 二维码返回都不能直接发放泥点或会员。
 14. 微信 JSAPI / H5 / 小程序 / Native 下单统一显式传 5 分钟 `time_expire`，格式为 RFC3339 秒级时间；Native 额外通过 `wechatNativePayment.expiresAt` 下发给前端二维码弹窗展示。
 15. 真实微信渠道的新建 pending 充值订单会写入 SpacetimeDB 原生 scheduled 表 `profile_recharge_order_expiration_timer`。到期 reducer 只做数据库内状态转换：订单仍为 `pending` 时更新为 `expired` 并写 `expired_at`，同时删除 timer。HTTP `api-server` 只订阅这张活跃 timer 表的删除事件，收到 `order_id` 后通过 procedure 重新读取订单，只有状态确认为 `expired` 才执行微信查单补偿；支付或主动关闭同样会删除 timer，但会被状态判断忽略。监听断线期间遗漏的删除事件由未检查过期订单 catch-up 补齐，不订阅完整 `profile_recharge_order` 历史表。普通微信支付查单中 `SUCCESS` 可把 `expired` 补确认成 `paid` 入账；`NOTPAY` 会调用微信关单并把本地订单保持为 `expired`；`CLOSED` / `REVOKED` / `PAYERROR` / `ORDER_NOT_EXIST` 只记录检查结果。`wechat_mp_virtual` 使用小程序 `access_token` 和虚拟支付 AppKey 调用官方 `/xpay/query_order`，只在返回单号、支付类型 `order_type=0/7`、金额、合法 `paid_time` 与本地契约一致且状态为 `2/3/4` 时补入账；退款类型 `1/8` 不得触发充值，其余已知状态只记录检查结果。`short_series_goods` 从 `status=2` 恢复时先幂等入账，再调用 `/xpay/notify_provide_goods`，失败后允许基于本地 `paid` 状态只重试发货；`short_series_coin` 不调用现金单发货接口。`external-generation-worker` / controller 不处理充值过期。
-16. 普通微信支付 V3 退款事实由 `profile_recharge_refund` 保存，回调、退款 API 响应、主动查单和交易账单发现统一调用 `record_profile_recharge_refund_observation_and_return`。`out_refund_no` 是商户幂等键，`provider_refund_id` 唯一；重复 observation 必须校验订单、交易、金额、状态和指纹，不允许仅按主键直接吞掉冲突。
+16. 普通微信支付 V3 退款事实由 `profile_recharge_refund` 保存，回调、退款 API 响应、主动查单和交易账单发现统一调用 `record_profile_recharge_refund_observation_and_return`。`out_refund_no` 是商户幂等键，`provider_refund_id` 唯一；退款申请响应和主动查单等生产者生成 observation ID 时必须同时纳入来源和事实指纹，同一来源同一事实稳定重放、不同来源不得复用 ID；重复 observation 必须校验订单、交易、金额、状态、来源和指纹，不允许仅按主键直接吞掉冲突。
 17. `profile_recharge_order_refund_settlement` 按原订单聚合累计成功退款金额和权益回收。部分退款不改充值订单 `paid`；累计金额等于订单金额时才改为 `refunded`。历史支付和首充资格以 `paid_at` 是否存在判断，退款不把用户重新变成首充。
-18. 泥点退款按累计成功退款比例计算目标回收量，全额退款强制精确回收原 `points_delta`。自动回收只扣普通永久泥点，每日免费和会员周期限时泥点保持不变；不足部分持久化为 `shortfall` 并冻结正式钱包消费，后续 worker 只重试本地回收。已成功退款的泥点订单若出现微信交易号、订单总额冲突或结算计划无效，必须将 settlement 标记为 `wallet_frozen` 并阻断普通消费。管理员只能对交易号或订单总额冲突执行“确认退款归属”：procedure 在退款行尾部不可变记录管理员、原因和时间后重新运行标准结算，能追回的永久泥点照常扣除，余额不足继续形成欠账；不能直接清空冻结或伪造已追回量。非法结算计划仍保持冻结等待数据/代码修复。流水来源为 `recharge_refund_recovery`。会员充值没有可逆 grant 快照，退款统一标记 `manual_review`，不猜测回滚档位、有效期或周期泥点，也不复用泥点退款冻结语义。
+18. 泥点退款按累计成功退款比例计算目标回收量，全额退款强制精确回收原 `points_delta`。自动回收只扣普通永久泥点，每日免费和会员周期限时泥点保持不变；不足部分持久化为 `shortfall` 并冻结正式钱包消费，后续 worker 只重试本地回收。已成功退款的泥点订单若出现微信交易号、订单总额冲突或结算计划无效，必须将 settlement 标记为 `wallet_frozen` 并阻断普通消费。管理员只能对交易号或订单总额冲突执行“确认退款归属”：BFF 必须把微信退款事实的交易号、订单总额、当前冲突类型与本地订单值并排下发并展示，提交时携带管理员实际看到的 `expectedErrorCode`，SpacetimeDB procedure 在同一事务内核对当前错误码一致后，才在退款行尾部不可变记录管理员、原因、时间和本次获批的错误码并重新运行标准结算；已处理请求只有管理员、归一化原因和错误码全部一致时才视为幂等重放，状态变化或任一审计内容不一致必须 fail-closed。一次确认只豁免对应的交易号或订单总额冲突，渠道、支付状态及其他未获批冲突继续 fail-closed。能追回的永久泥点照常扣除，余额不足继续形成欠账；不能直接清空冻结或伪造已追回量。非法结算计划仍保持冻结等待数据/代码修复。流水来源为 `recharge_refund_recovery`。会员充值没有可逆 grant 快照，退款统一标记 `manual_review`，不猜测回滚档位、有效期或周期泥点，也不复用泥点退款冻结语义。
 19. 外部现金退款 `SUCCESS` 必须先持久化并 ACK，即使本地订单缺失、金额冲突、权益不足或会员需要人工处理，也不能回滚已经发生的现金事实。冲突 observation 记录 resolution code 并进入告警；只有验签、解密、契约解析或 SpacetimeDB 持久化失败才让微信重试。
 20. 主动查询与退款交易账单 worker 只由 HTTP 角色运行并由 `WECHAT_PAY_REFUND_RECONCILIATION_ENABLED=true` 显式开启。生产 env 示例和 API deploy 会为缺失配置补 `true`；当 `WECHAT_PAY_ENABLED=true + WECHAT_PAY_PROVIDER=real` 时显式关闭该开关必须阻断发布，启动日志也必须明确记录启用或异常关闭状态。非终态退款按 1 / 5 / 10 / 20 / 30 分钟衰减查单；北京时间次日 10 点后按 30 个稳定分片轮转补扫微信 API 可查询的近 90 天 `bill_type=REFUND` 交易账单，每 30 分钟覆盖完整窗口。单行失败不阻塞同日其他退款或其他日期，但该日不写完成 checkpoint 并继续重试；昨日返回 `NO_STATEMENT_EXIST` 时至少延迟到次日 10 点后再确认空账单。账单申请响应验签，GZIP 解压后按 SHA1 验真，CSV 用结构化 parser 和十进制定点金额解析；发现手工退款后必须再查单取得当前状态。
 21. 普通 V3 支付通知同时校验 AppID、商户号、本地订单渠道、金额和微信支付单号；`success_time` 缺失或非法时拒绝，不能用本机时间补齐。晚到通知遇到 `refunded` 订单只做交易号一致性幂等校验，不再次发放权益。
-22. 后台主动退款只支持普通 V3 泥点订单。`api-server` 先做微信支付订单查单预检，再调用 SpacetimeDB procedure 原子创建退款 hold；只有 hold 成功才允许调用微信退款。虚拟支付、会员、未支付、对账未完成、退款已满额、人工冻结、退款欠账或永久泥点不足必须 fail-closed。
-23. `profile_recharge_refund_hold` 以稳定 `out_refund_no` 为主键，保存订单、用户、本次退款金额、占用永久泥点、管理员、原因和 `active / settled / released` 状态。部分退款的 hold 在累计应追回增量之外额外保留 1 泥点并发舍入缓冲，全额退款不加缓冲；活动 hold 不改变钱包总额，但普通钱包消费必须预留全部活动 hold；成功退款 observation 扣款并结算匹配 hold，关闭退款释放 hold，外部退款追回不得消耗其他活动 hold。
+22. 后台主动退款只支持 `wechat_mp`、`wechat_jsapi`、`wechat_h5`、`wechat_native` 普通 V3 泥点订单。`api-server` 必须先按正式支付渠道和商品类型拦截不支持的订单，再做微信支付订单查单预检，然后调用 SpacetimeDB procedure 原子创建退款 hold；只有 hold 成功才允许调用微信退款。`wechat_mp_virtual`、历史非正式渠道值、会员、未支付、对账未完成、退款已满额、人工冻结、退款欠账或永久泥点不足必须在调用普通 V3 provider 前 fail-closed。
+23. `profile_recharge_refund_hold` 以稳定 `out_refund_no` 为主键，保存订单、用户、本次退款金额、占用永久泥点、管理员、原因和 `active / settled / released` 状态。重试只有在订单、`out_refund_no`、退款金额、管理员和归一化原因全部与原 hold 一致时才可复用，任一不一致都按幂等内容冲突 fail-closed，不能用新原因调用微信后保留旧审计。部分退款的 hold 在累计应追回增量之外额外保留 1 泥点并发舍入缓冲，全额退款不加缓冲；活动 hold 不改变钱包总额，但普通钱包消费必须预留全部活动 hold；成功退款 observation 扣款并结算匹配 hold，关闭退款释放 hold，外部退款追回不得消耗其他活动 hold。
 24. 退款欠账继续以 `profile_recharge_order_refund_settlement.unrecovered_points` 为唯一真相；不新增平行 debt 累计。`profile_wallet_manual_restriction` 只保存人工冻结，普通消费同时检查人工冻结与退款欠账。后续永久泥点到账后继续偿还欠账，每日免费与会员周期泥点不参与；解除人工冻结不得清除退款欠账限制。
-25. 管理员充值订单、用户详情、退款预检/执行、应急退款号登记、退款人工复核和钱包冻结接口只留在 `api-server` 管理员鉴权路由。人工复核 BFF 必须从管理员会话写入操作人，要求非空原因，并调用 runtime service identity 受限 procedure；前端不得自行改 settlement 或钱包冻结。外部微信副作用由 `platform-wechat` 执行，退款/hold/钱包事务留在 `spacetime-module`，后台前端只展示 BFF 返回的正式状态。
+25. 管理员充值订单、用户详情、退款预检/执行、应急退款号登记、退款人工复核和钱包冻结接口只留在 `api-server` 管理员鉴权路由。人工复核 BFF 必须从管理员会话写入操作人，要求非空原因，返回微信退款交易号、订单总额以及获批错误码等正式审计字段，并调用 runtime service identity 受限 procedure；后台确认面板必须展示这些后端事实，前端不得自行改 settlement 或钱包冻结。外部微信副作用由 `platform-wechat` 执行，退款/hold/钱包事务留在 `spacetime-module`，后台前端只展示 BFF 返回的正式状态。
 
 ## 创作入口泥点扣费契约
 
@@ -504,6 +504,13 @@ npm run check:server-rs-ddd
 - 说明：外部 OpenAPI 调用使用的账号级 API Key 凭据表，只保存 key prefix、SHA-256 hash、作用域、撤销状态和使用时间；明文 Key 只在 `/api/profile/api-keys` 创建接口返回一次，不进入 SpacetimeDB，且 API Key 管理接口不写入外部 OpenAPI JSON。v1 默认作用域为 `editor:project`、`editor:canvas`、`editor:image-generate`、`editor:asset`；其中 `editor:project` 覆盖项目列表、最近项目、创建、读取、重命名和删除，`editor:canvas` 覆盖默认画布布局保存，`editor:image-generate` 覆盖编辑器现有图片生成、重绘 / 调整、规范图、宣发素材、图标 spritesheet 生成 / 拆分、UI 设计图素材拆分、角色动画、视频、音效和背景音乐生成，`editor:asset` 覆盖素材直传凭证、素材对象确认、签名读取、账号级素材库和项目画布资源记录操作。
 - 索引：`by_external_api_key_owner_user_id` 用于登录态 API Key 列表；`key_hash` 唯一索引用于外部 API 鉴权。
 
+### `admin_account`
+
+- Rust 结构体：`AdminAccount`
+- 源码：`server-rs/crates/spacetime-module/src/admin_account_storage.rs`
+- 说明：后台 member 私有账号表，保存规范化用户名、展示名、Argon2id 密码摘要、一级 Tab 权限 JSON、启停状态、会话版本和创建 / 更新审计字段。原环境变量管理员作为虚拟 owner，不写入该表。账号查询与写入 procedure 只接受 runtime service identity；HTTP 列表和写响应不返回密码摘要。
+- 索引：`account_id` 为主键，`username` 为唯一登录名；权限、密码或启停状态发生变化时在同一事务递增 `token_version`，使旧 JWT 下一次请求立即失效。
+
 ### `editor_agent_conversation`
 
 - Rust 结构体：`EditorAgentConversation`
@@ -544,9 +551,23 @@ npm run check:server-rs-ddd
 
 - Rust 结构体：`EditorAsset`
 - 源码：`server-rs/crates/spacetime-module/src/editor_project_storage.rs`
-- 说明：图片画布账号级素材表，保存用户上传 / 生成素材的名称、文件夹、图片读取地址、可选封面 `thumbnail_src`、OSS 引用、尺寸、来源类型、prompt、provider、task、`asset_kind`、`generation_inputs_json`、可选 `source_resource_id` 和 `generation_cost_mud_points`。素材在同一账号的所有项目中可见；图片 / 图标 / UI 提取等生成 BFF 在请求携带 `asset_folder_id` 时负责创建账号级生成素材并返回 asset 快照，若同次生成也创建了 `editor_project_resource`，则把该 `resource_id` 写入 `source_resource_id`。角色动作生成保留原始绿幕视频中间素材，同时把最终帧序列作为一条 `asset_kind = character-animation` 素材入库：首帧写入 `image_src` / `thumbnail_src`，完整帧列表、FPS、时长和预览视频写入 `generation_inputs_json.characterAnimation`，不把每帧拆成独立素材。生成视频会抽取首帧封面写入 `thumbnail_src`，素材库和再次放入画布时用它作为 video poster。素材库快照通过 `asset_id` 回查对应 `editor_showcase_asset`，供左侧素材菜单展示 `pending` / `approved` / `rejected` 审核状态；公开事实不落在账号素材表，素材库只发起提交审核。素材放入画布时复制为 `editor_project_resource` 并由图层引用 resourceId，画布从 resource / asset 级元数据恢复素材类别和用户可见生成输入快照。
+- 说明：图片画布账号级素材表，保存用户上传 / 生成素材的名称、文件夹、图片读取地址、可选封面 `thumbnail_src`、OSS 引用、尺寸、来源类型、prompt、provider、真实操作 `task_id`、可选后台归组 `group_task_id`、拆分批次预期数量 `group_task_expected_asset_count`、`asset_kind`、`generation_inputs_json`、可选 `source_resource_id` 和 `generation_cost_mud_points`。归组字段追加在表尾并默认 `None`，只用于稳定派生任务的后台分组，不替代 `task_id`；批次是否初始完整以独立完成事实为准，不按当前剩余素材数反推。素材在同一账号的所有项目中可见；图片 / 图标 / UI 提取等生成 BFF 在请求携带 `asset_folder_id` 时负责创建账号级生成素材并返回 asset 快照，若同次生成也创建了 `editor_project_resource`，则把该 `resource_id` 写入 `source_resource_id`。角色动作生成保留原始绿幕视频中间素材，同时把最终帧序列作为一条 `asset_kind = character-animation` 素材入库：首帧写入 `image_src` / `thumbnail_src`，完整帧列表、FPS、时长和预览视频写入 `generation_inputs_json.characterAnimation`，不把每帧拆成独立素材。生成视频会抽取首帧封面写入 `thumbnail_src`，素材库和再次放入画布时用它作为 video poster。素材库快照通过 `asset_id` 回查对应 `editor_showcase_asset`，供左侧素材菜单展示 `pending` / `approved` / `rejected` 审核状态；公开事实不落在账号素材表，素材库只发起提交审核。素材放入画布时复制为 `editor_project_resource` 并由图层引用 resourceId，画布从 resource / asset 级元数据恢复素材类别和用户可见生成输入快照。
 - 索引：`by_editor_asset_owner_user_id`、`by_editor_asset_folder_id`。
 
+### `editor_asset_group_source_provenance`
+
+- Rust 结构体：`EditorAssetGroupSourceProvenance`
+- 源码：`server-rs/crates/spacetime-module/src/editor_project_storage.rs`
+- 说明：手动图集拆分的私有可信来源索引。仅当账号素材由后端生成链路写入且具有正式 `source_resource_id` 时，按 owner + source resource、asset object 和 Object Key 记录真实来源 `task_id`；普通素材 / 资源创建请求不能直接写该表。跨项目复用素材后可通过稳定媒体引用找回原任务，历史行首次扫描命中后补写索引。
+- 主键：`lookup_key`。
+
+### `editor_asset_group_cohort`
+
+- Rust 结构体：`EditorAssetGroupCohort`
+- 源码：`server-rs/crates/spacetime-module/src/editor_project_storage.rs`
+- 说明：手动拆分批次的私有完成事实。api-server 只有在预期的全部 asset ID 已成功落库并由 runtime service identity 逐行校验 owner、真实 task、归组 task 和预期数量一致后才能插入；事实写入后不随用户删除单片素材而撤销。没有完成事实的现代批次不能并入来源根任务。
+- 主键：`cohort_id`。
+
 ### `editor_showcase_asset`
 
 - Rust 结构体：`EditorShowcaseAsset`
@@ -763,14 +784,14 @@ npm run check:server-rs-ddd
 
 - Rust 结构体：`ProfileRechargeRefund`
 - 源码：`server-rs/crates/spacetime-module/src/runtime/profile.rs`
-- 作用：普通微信支付 V3 退款单聚合。以 `out_refund_no` 为主键、`provider_refund_id` 唯一，保存原订单/微信支付单、四个分金额、微信状态、最近观察、权益目标/已回收/未回收量和人工处理错误码。交易号或订单总额冲突经管理员确认归属后，追加保存处理管理员、非空原因和处理时间；三字段只写一次，作为重新执行正式结算的审计事实。数据库迁移导入旧退款行时，缺失的三个审计字段必须补 `null`，保证升级前冷备可恢复。
+- 作用：普通微信支付 V3 退款单聚合。以 `out_refund_no` 为主键、`provider_refund_id` 唯一，保存原订单/微信支付单、四个分金额、微信状态、最近观察、权益目标/已回收/未回收量和人工处理错误码。管理员读取契约同步暴露微信交易号、订单总额和人工复核获批错误码。交易号或订单总额冲突经管理员确认归属后，追加保存处理管理员、非空原因、处理时间和本次获批的错误码；四字段只写一次，作为重新执行正式结算的审计事实。
 - 索引：`by_profile_recharge_refund_order_id`、`by_profile_recharge_refund_status_updated_at`。
 
 ### `profile_recharge_refund_observation`
 
 - Rust 结构体：`ProfileRechargeRefundObservation`
 - 源码：`server-rs/crates/spacetime-module/src/runtime/profile.rs`
-- 作用：退款事实的追加观察记录。保存 callback / api_request / query / trade_bill 来源、稳定 observation ID、金额、状态、脱敏通知引用、事实指纹和 resolution code；不保存回调密文、签名、密钥、原始 CSV 或短时下载 URL。
+- 作用：退款事实的追加观察记录。保存 callback / api_request / query / trade_bill 来源、按“来源 + 事实指纹”稳定生成的 observation ID、金额、状态、脱敏通知引用、事实指纹和 resolution code；同一事实从不同来源进入时使用不同 ID，不保存回调密文、签名、密钥、原始 CSV 或短时下载 URL。
 - 索引：`by_profile_recharge_refund_observation_out_refund_no`、`by_profile_recharge_refund_observation_order_id`。
 
 ### `profile_recharge_order_refund_settlement`
diff --git a/docs/【开发运维】本地开发验证与生产运维-2026-05-15.md b/docs/【开发运维】本地开发验证与生产运维-2026-05-15.md
index 22fd2cc1d..b64ab30f7 100644
--- a/docs/【开发运维】本地开发验证与生产运维-2026-05-15.md
+++ b/docs/【开发运维】本地开发验证与生产运维-2026-05-15.md
@@ -57,7 +57,9 @@ Windows 本地如果已在 `%LOCALAPPDATA%\Genarrative\ffmpeg\bin` 安装 FFmpeg
 
 本地排查外部内容生成 worker 队列时，默认同一 Rust 进程同时监听 HTTP 并消费 `external_generation_job` 队列；更接近生产的验证应分别启动 `api`、`external-generation-worker` 和 `external-generation-controller`。生产默认 `GENARRATIVE_PROCESS_ROLE=api`，外部生成任务由独立 `GENARRATIVE_PROCESS_ROLE=external-generation-worker` 进程消费；生产与容器扩缩容验证保持 `queue`。当前进入持久队列的外部生成动作包括：拼图 `compile_puzzle_draft` / `generate_puzzle_images` / `generate_puzzle_ui_background`，跳一跳 `compile-draft` / `regenerate-tiles`，拼消消 `compile-draft` / `regenerate-atlas`，敲木鱼 `compile-draft` / `regenerate-hit-object`，以及图片画布 `editor_image_generation` / `editor_image_edit` / `editor_background_removal` / `editor_icon_spritesheet_generation` / `editor_ui_design_asset_extraction` / `editor_character_animation_generation` / `editor_video_generation` / `editor_sound_effect_generation` / `editor_background_music_generation`。非外部 provider 生成动作继续 inline，不进入队列。显式把本地进程角色设为 `api` 且没有 worker 时，HTTP 只返回 queued/running，不会兜底执行外部 provider。
 
-生产拆分角色时，`external-generation-worker` 和 `external-generation-controller` 的专属 env 示例会把 `GENARRATIVE_SPACETIME_POOL_SIZE` 覆盖为 `1`；非 HTTP 角色只保留 `external_generation_job` 队列窄订阅作为响应式唤醒信号，实际抢占和扩缩容判断仍走 SpacetimeDB procedure，且不再订阅 API 读模型连接池。worker / controller 不执行模型定价 seed，启动时先调用受 runtime writer 鉴权的 queue-stats procedure 做只读预检，身份不匹配时 fail-fast；当前正式 systemd unit 通过共同加载 `/etc/genarrative/api-server.env` 继承同一 `GENARRATIVE_SPACETIME_TOKEN`，专属角色 env 示例不重复配置该 token。`GENARRATIVE_EXTERNAL_GENERATION_WORKER_POLL_INTERVAL_MS` 与 controller poll interval 只作为订阅失效、漏事件和 lease 过期这类时间条件的兜底，不作为正常领取任务的主路径。
+HTTP 角色的 `GENARRATIVE_SPACETIME_POOL_SIZE` 只表示 procedure / reducer 调用池大小；池连接不订阅 read model。HTTP 角色会额外创建 1 条共享缓存读连接，统一保存公开读模型、近期游玩统计、创作入口配置和用户标签等订阅行，因此配置为 `8` 时基础连接拓扑是 8 条调用连接加 1 条缓存读连接。`/readyz` 同时检查调用池与缓存读连接的 required subscriptions，缓存未准备好时不能放量。
+
+生产拆分角色时，`external-generation-worker` 和 `external-generation-controller` 的专属 env 示例会把 `GENARRATIVE_SPACETIME_POOL_SIZE` 覆盖为 `1`；非 HTTP 角色不创建 API 缓存读连接，只保留 `external_generation_job` 队列窄订阅作为响应式唤醒信号，实际抢占和扩缩容判断仍走 SpacetimeDB procedure。worker / controller 不执行模型定价 seed，启动时先调用受 runtime writer 鉴权的 queue-stats procedure 做只读预检，身份不匹配时 fail-fast；当前正式 systemd unit 通过共同加载 `/etc/genarrative/api-server.env` 继承同一 `GENARRATIVE_SPACETIME_TOKEN`，专属角色 env 示例不重复配置该 token。`GENARRATIVE_EXTERNAL_GENERATION_WORKER_POLL_INTERVAL_MS` 与 controller poll interval 只作为订阅失效、漏事件和 lease 过期这类时间条件的兜底，不作为正常领取任务的主路径。
 
 生产 worker 默认 `GENARRATIVE_EXTERNAL_GENERATION_WORKER_LEASE_SECONDS=600`，只覆盖 worker 心跳抖动和短暂断连窗口，不再把 lease 当成完整任务时长；默认 `GENARRATIVE_EXTERNAL_GENERATION_WORKER_JOB_TIMEOUT_SECONDS=900`，角色动画 / 视频类长任务使用 `GENARRATIVE_EXTERNAL_GENERATION_WORKER_LONG_JOB_TIMEOUT_SECONDS=1800`。worker 在单次尝试超过执行预算后会停止当前尝试、写入失败 / 重试状态并释放 worker 槽位；如果 SpacetimeDB 当时不可写，当前租约最多再保留到 lease 过期，之后任务重新变为可领取。生产部署和 provision 脚本会给 `/etc/genarrative/api-server.env` 与 `/etc/genarrative/external-generation-worker.env` 补齐这些变量；已有自定义值不覆盖，只会把历史旧默认 `3600` 迁移为 `600`。
 
@@ -144,7 +146,7 @@ spacetime sql <database> "SELECT * FROM puzzle_gallery_card_view LIMIT 1" --serv
 
 本地 `spacetime` CLI / standalone 版本必须和 `server-rs/Cargo.toml` 里锁定的 `spacetimedb` 版本一致；当前统一版本为 `2.6.0`。若版本错配，procedure 返回值可能在宿主侧触发 `Failed to BSATN deserialize procedure return value`，api-server 最终表现为敲木鱼等创作动作的 `SpacetimeDB procedure 调用超时`。排障时先运行 `spacetime --version`，再对照 `server-rs/Cargo.toml` 的 `spacetimedb = "..."`；遇到版本不匹配时不要继续深挖业务超时，直接执行 `spacetime version install <version> && spacetime version use <version>`，或在目标就是最新版本时执行 `spacetime version upgrade`，升级后重启 `npm run dev:spacetime` 再重试。当前 `scripts/dev.mjs` 会在启动和复用本地 SpacetimeDB 前写入并校验 `dev-spacetime-tool-version`，避免把旧 standalone 继续带进新一轮创作。
 
-本地 `.env`、`.env.local` 或 `.env.secrets.local` 修改后必须重启 `api-server` 才会生效；若已经通过 `npm run dev` 启动完整联调，可在该终端输入 `rs api-server`。排查 RPG / 拼图 / 抓大鹅等 VectorEngine 生图链路时，确认 `VECTOR_ENGINE_BASE_URL`、`VECTOR_ENGINE_API_KEY` 和 `VECTOR_ENGINE_IMAGE_REQUEST_TIMEOUT_MS` 只在本地或服务器密钥文件中配置，不能写入 Git。VectorEngine `gpt-image-2` 图片协议、URL / base64 响应解析、远端图片下载和 provider 侧结构化日志在 `server-rs/crates/platform-image`；`api-server` 只做配置、玩法编排、OSS / asset 持久化、计费和失败审计落库。开局 CG 故事板、首图、背景和图集都属于长耗时图片请求；后端默认会把 `VECTOR_ENGINE_IMAGE_REQUEST_TIMEOUT_MS` 下限收口到 `1000000`，旧进程仍可能沿用重启前的短超时。若 VectorEngine 在 `send()` 阶段失败且日志显示 `SendRequest`，先看同一 `request_id` 的 provider 日志字段 `source`、`source_chain`、`source_chain_depth`，再查 `external_api_call_failure.metadata_json.errorSource`；当前 multipart `/v1/images/edits` 单独强制 HTTP/1.1。拼图关卡资产按 `level_scene -> ui_spritesheet -> level_background` 顺序生成，日志会带 `slot`、`asset_kind` 和 `elapsed_ms`。
+本地 `.env`、`.env.local` 或 `.env.secrets.local` 修改后必须重启 `api-server` 才会生效；若已经通过 `npm run dev` 启动完整联调，可在该终端输入 `rs api-server`。排查 RPG / 拼图 / 抓大鹅等 VectorEngine 生图链路时，确认 `VECTOR_ENGINE_BASE_URL`、`VECTOR_ENGINE_API_KEY` 和 `VECTOR_ENGINE_IMAGE_REQUEST_TIMEOUT_MS` 只在本地或服务器密钥文件中配置，不能写入 Git。VectorEngine `gpt-image-2` 图片协议、URL / base64 响应解析、远端图片下载和 provider 侧结构化日志在 `server-rs/crates/platform-image`；`api-server` 只做配置、玩法编排、OSS / asset 持久化、计费和失败审计落库。`platform-image` 会在 JSON 生成和 multipart 编辑请求发送前，按原比例尽量收敛 `gpt-image-2` 的显式像素尺寸：最大边长不超过 `3840`、宽高均为 `16` 的倍数、长短边比不超过 `3:1`，总像素范围为 `655360` 至 `8294400`。无法满足全部条件时回退为 `1024x1024`；其他模型保留其传入尺寸。开局 CG 故事板、首图、背景和图集都属于长耗时图片请求；后端默认会把 `VECTOR_ENGINE_IMAGE_REQUEST_TIMEOUT_MS` 下限收口到 `1000000`，旧进程仍可能沿用重启前的短超时。若 VectorEngine 在 `send()` 阶段失败且日志显示 `SendRequest`，先看同一 `request_id` 的 provider 日志字段 `source`、`source_chain`、`source_chain_depth`，再查 `external_api_call_failure.metadata_json.errorSource`；当前 multipart `/v1/images/edits` 单独强制 HTTP/1.1。拼图关卡资产按 `level_scene -> ui_spritesheet -> level_background` 顺序生成，日志会带 `slot`、`asset_kind` 和 `elapsed_ms`。
 
 VectorEngine 图片生成 / 编辑在 `request_send` 阶段出现 `timeout`、`connect`、libcurl 35 SSL connect reset、libcurl 56 receive error / `unexpected eof while reading`、recv failure 等临时传输错误，或在 `upstream_status` 阶段收到 408 / 429 / 5xx（例如 Nginx HTML `502 Bad Gateway`）时，`platform-image` 会对同一请求最多发送 5 次；multipart 图片编辑每次重试都会重新构造 form，避免复用已消费的 body。日志中 `VectorEngine 图片请求发送失败，准备重试` 或 `VectorEngine 图片上游状态可重试，准备重试` 表示本次失败已进入下一次尝试；最终仍失败时才会写入 `external_api_call_failure` 并返回 504 / 502。排查生产失败时应同时统计 retry 前的尝试日志和最终 audit，避免把一次用户请求内的多次发送误判成多个用户请求。
 
@@ -202,6 +204,12 @@ SpacetimeDB bindings：
 npm run spacetime:generate
 ```
 
+后台账号 procedure 的 identity、唯一索引和版本事务使用隔离 smoke 验证；脚本会在随机本机端口启动临时 SpacetimeDB 2.6、发布当前 module，结束后自动关闭并清理临时数据：
+
+```bash
+npm run check:admin-account-procedures
+```
+
 ## CodeGraph 本地代码索引
 
 项目已安装 `@colbymchenry/codegraph` 作为开发期依赖，用于在本地生成语义代码索引，辅助 AI / IDE 做符号搜索、调用关系和影响范围分析。索引目录为 `.codegraph/`，其中 `config.json` 可提交，数据库、缓存和日志由 `.codegraph/.gitignore` 保持本机私有。
@@ -225,7 +233,7 @@ npm run codegraph:index
 
 Codex 项目级 hook 已放在 `.codex/config.toml` 与 `.codex/hooks/`：
 
-- `PreToolUse` hook 会在 Codex 准备执行 `git commit` 前运行 `node .codex/hooks/pre-submit-compile-check.mjs`，依次执行 `npm run typecheck`、`npm run admin-web:typecheck`、`cargo check -p api-server --manifest-path server-rs/Cargo.toml`，发现编译错误会阻止本次提交。
+- `PreToolUse` hook 会在 Codex 准备执行 `git commit` 前运行 `node .codex/hooks/pre-submit-compile-check.mjs`，依次执行 `npm run check:rustfmt`、`npm run typecheck`、`npm run admin-web:typecheck`、`cargo check -p api-server --manifest-path server-rs/Cargo.toml`，发现格式或编译错误会阻止本次提交。
 - `PostToolUse` hook 会在 Codex 工具修改文件后运行 `node .codex/hooks/post-edit-codegraph-sync.mjs`，执行 `npm run codegraph:sync` 刷新本地语义索引。
 - 如果某个 Codex 客户端版本尚未自动加载项目级 hook，可先手动运行 `node .codex/hooks/pre-submit-compile-check.mjs` 与 `node .codex/hooks/post-edit-codegraph-sync.mjs`；个人模型、token、MCP server 仍放在个人 `~/.codex/config.toml`，不要提交。
 
@@ -235,6 +243,7 @@ Codex 项目级 hook 已放在 `.codex/config.toml` 与 `.codex/hooks/`：
 
 后端代码修改后，按变更范围选择：
 
+- `npm run check:rustfmt`
 - `cargo test -p <crate> --manifest-path server-rs/Cargo.toml`
 - `cargo test -p platform-image --manifest-path server-rs/Cargo.toml`
 - `cargo check -p api-server --manifest-path server-rs/Cargo.toml`
@@ -257,6 +266,12 @@ npm run spacetime:generate
 npm run check:spacetime-schema
 ```
 
+仓库根目录的 `rust-toolchain.toml` 固定 Rust `1.96.0` 并要求 `rustfmt` 组件，
+`rustfmt.toml` 固定 Edition 2024 的格式化口径。Rust 源码统一使用
+`cargo fmt --all --manifest-path server-rs/Cargo.toml` 格式化，并用
+`npm run check:rustfmt` 做只读校验；Codex 提交前门禁、API 生产构建和
+SpacetimeDB module 生产构建都会执行同一检查，避免不同开发机或构建节点反复产生格式差异。
+
 ## 前端改动验收
 
 前端修改后，根据范围选择：
@@ -460,9 +475,9 @@ Nginx 与 Pingora 在维护 marker 存在时对内网来源绕过整站维护闸
 
 版本化默认维护页固定为 `public/maintenance.html`，使用 `public/branding/taonier-maintenance-page.png` 作为品牌视觉，只允许保存无日期、无具体时段的通用文案；正常 Web 构建由 Vite 复制到发布包根目录的 `web/maintenance.html`，并由 `check-maintenance-page.mjs` 在打包前拒绝“今天 / 今晚”、具体日期或 `HH:MM` 等临时公告。计划内停服的临时公告必须放在 release 外文件中，通过 `/opt/genarrative/current/scripts/deploy/maintenance-on.sh --page-file <公告HTML> <维护原因>` 原子安装到 `/var/lib/genarrative/maintenance/page.html`。Nginx 与 Pingora 在该文件存在时优先返回它，缺失时回退当前 Web 制品的默认维护页；同一维护窗口内 Stdb / API 的后续 `maintenance-on.sh` 调用保留已安装公告，`maintenance-off.sh` 同时删除 marker 和运行态公告，避免下次维护复活旧内容。公告启用后同时用 `genarrative.world` 与 `www.genarrative.world` 的真实 HTTPS 响应校验 `503` 和公告正文。
 
-生产 Jenkins 的 `Pipeline script from SCM` 由 Jenkins controller 读取 Jenkinsfile。`Genarrative-Server-Provision` 是服务器初始化流水线，Job 配置里的 SCM URL 必须使用 controller 本机可访问的仓库路径或内网 Gitea 地址，不能使用 `https://git.genarrative.world/...`；否则日志一开始的 `Checking out git ... to read jenkins/Jenkinsfile.production-server-provision` 就会先从公网拉 Jenkinsfile。构建类流水线和 `Genarrative-Server-Provision` 的 Jenkinsfile 内部源码准备阶段统一使用 `ssh://git@192.168.35.82:2222/GenarrativeAI/Genarrative.git`，并显式传入 Jenkins SSH 凭据 `genarrative-local-gitea-ssh`；不再配置 `https://git.genarrative.world/...` 公网 fallback，也不再默认使用 `http://genarrative-station/git/GenarrativeAI/Genarrative.git`。所有 `GitSCM checkout` 都必须保留单分支 refspec、`shallow=true`、`depth=1`、`noTags=true` 与 `honorRefspec=true`。API / Web / Stdb 发布类流水线不在目标机器 checkout Git，统一执行上游构建归档里的部署脚本，避免产物 commit 与部署脚本 commit 漂移；Server-Provision 也不在目标 dev / release agent checkout Git，而是由 Jenkins 构建节点先准备 provision 脚本与配置并上传给目标 agent。
+生产 Jenkins 的 `Pipeline script from SCM` 由 Jenkins controller 读取 Jenkinsfile。所有生产 Job 的 SCM URL，以及 Jenkinsfile 内部在 Jenkins Built-In Node 执行的源码准备，统一使用 `ssh://git@127.0.0.1:2222/GenarrativeAI/Genarrative.git`，并显式传入 Jenkins SSH 凭据 `genarrative-local-gitea-ssh`；不再配置局域网 IP、`https://git.genarrative.world/...` 公网 fallback 或 `http://genarrative-station/git/GenarrativeAI/Genarrative.git`。所有 `GitSCM checkout` 都必须保留单分支 refspec、`shallow=true`、`depth=1`、`noTags=true` 与 `honorRefspec=true`。API / Web / Stdb 发布类流水线不在目标机器 checkout Git，统一执行上游构建归档里的部署脚本；Server-Provision 和数据库导入导出也由带 `linux && genarrative-build` 标签的 Jenkins Built-In Node 先 checkout 并 stash 所需脚本，再交给目标 dev / release agent，避免目标机把 `127.0.0.1` 误解为远端 Gitea 或让产物 commit 与执行脚本漂移。
 
-当前 Jenkins / 本机内网 Git 入口固定为 `ssh://git@192.168.35.82:2222/GenarrativeAI/Genarrative.git`，用于 controller、构建节点和本机 Agent 直接拉取仓库，避免绕公网 `git.genarrative.world`。验证时在具备对应 SSH key 和 known_hosts 的环境执行 `git ls-remote ssh://git@192.168.35.82:2222/GenarrativeAI/Genarrative.git HEAD`，应能返回 HEAD。若机器仍保留旧的 `http://genarrative-station/git/GenarrativeAI/Genarrative.git` 或 `http://10.2.0.10/GenarrativeAI/Genarrative.git` 内网入口，只作为历史兼容和排障参考，新流水线不再默认使用。
+当前 Jenkins / 本机 Git 入口固定为 `ssh://git@127.0.0.1:2222/GenarrativeAI/Genarrative.git`。验证时在具备 Jenkins SSH key 和 `[127.0.0.1]:2222` known_hosts 的环境执行 `git ls-remote ssh://git@127.0.0.1:2222/GenarrativeAI/Genarrative.git HEAD`，应能返回 HEAD；同时扫描 live Job `config.xml` 和仓库 Jenkinsfile，确认没有残留局域网 IP 或公网 Git 地址。旧的局域网、公网和 HTTP 内网入口只作为历史兼容与排障参考，新流水线不再默认使用。
 
 `scripts/jenkins-checkout-source.sh` 是生产 Jenkinsfile 内部二次确认源码的统一入口。构建流水线由 Jenkins `GitSCM checkout` 先用凭据完成浅克隆，再以 `GENARRATIVE_JENKINS_REUSE_EXISTING_CHECKOUT=true` 调用脚本复用当前 checkout；只有显式 `COMMIT_HASH` 不在这次浅克隆里时，脚本才通过传入的 SSH 远端继续 fetch 并逐步加深。构建流水线和服务器初始化流水线传入 `COMMIT_HASH` 时，脚本必须先保持 `depth=1` 浅拉，若上游 commit 已在浅历史内则直接校验并 checkout；只有浅历史无法证明 commit 属于目标分支时，才按 `GENARRATIVE_JENKINS_CHECKOUT_DEEPEN_STEPS`（默认 `50 200 1000 5000`）逐步加深，最后才尝试展开完整历史。`Genarrative-Api-Deploy`、`Genarrative-Web-Deploy` 和 `Genarrative-Stdb-Module-Publish` 仍保留上游构建传入的 `COMMIT_HASH` 作为通知和追溯字段，但不再用它在目标机器重新 checkout 部署脚本。
 
diff --git a/docs/【玩法创作】创作主页与项目入口改版计划-2026-06-18.md b/docs/【玩法创作】创作主页与项目入口改版计划-2026-06-18.md
index b909b56d4..2a1a3d336 100644
--- a/docs/【玩法创作】创作主页与项目入口改版计划-2026-06-18.md
+++ b/docs/【玩法创作】创作主页与项目入口改版计划-2026-06-18.md
@@ -75,7 +75,7 @@
 
 `陶泥儿精选` 是页面底部的全站公开画布生成素材瀑布流，不承载玩法入口列表。瀑布流卡片按真实素材宽高设置预览比例，同一行允许出现不同高度卡片，不使用固定等高网格。创作入口配置仍继续来自 `/api/creation-entry/config`，供旧创作入口和具体 `/creation/<play>` 工作台使用，但不作为本页精选区内容。
 
-精选内容只使用用户从账号级素材库主动提交、后台审核通过且展示状态开启的 `editor_showcase_asset` 快照。新生成素材不会默认公开，审核通过后也不会自动展示；运营可在后台按前台具体 Tab 设置分类（角色、UI、音乐、美宣）并开启展示，未设置分类的素材不会隐藏，会进入前台“全部”。旧 `editor_project_resource.public_showcase_enabled` 只保留历史兼容，不再作为 `/creation` 精选事实源。账号级 `editor_asset` 仍是素材库私有事实；只有 `sourceType="generated"`、有媒体内容、提交审核并通过的素材才可进入精选，上传素材、公开作品图片和 `mock_generated` 资源都不进入精选。审核通过时按生成成本返还 50% 泥点，返还流水使用确定性 `editor-showcase-refund:{showcaseId}` 保证幂等。公开 BFF 必须返回作者公开展示字段：优先 `authorDisplayName` / `display_name`，没有展示名时兜底 `authorPublicUserCode` / 陶泥号；前端展示绝不能兜底到内部 `ownerUserId` / `user_id`。若现有数据缺少提示词、作者公开标识或成本字段，v1 显示保守占位，不伪造内容。
+精选内容只使用用户从账号级素材库主动提交、后台审核通过且展示状态开启的 `editor_showcase_asset` 快照。新生成素材不会默认公开，审核通过后也不会自动展示；运营可在后台按前台具体 Tab 设置分类（角色、UI、音乐、美宣）并开启展示，未设置分类的素材不会隐藏，会进入前台“全部”。旧 `editor_project_resource.public_showcase_enabled` 只保留历史兼容，不再作为 `/creation` 精选事实源。账号级 `editor_asset` 仍是素材库私有事实；只有 `sourceType="generated"`、有媒体内容、提交审核并通过的素材才可进入精选，上传素材、公开作品图片和 `mock_generated` 资源都不进入精选。审核通过时按生成成本返还 50% 泥点，返还流水使用确定性 `editor-showcase-refund:{showcaseId}` 保证幂等；批准状态、钱包返还流水和 `refund_completed_at` 必须在同一个 SpacetimeDB 事务中完成，任一步失败都保持待审核，历史已通过但未返还记录重复批准时按同一流水补齐且不得重复入账。已通过、已开启展示且返还完成的精选快照必须按同 owner 的精确 `assetObjectId` 或 `objectKey` 派生匿名读取授权，不能放开整个 `generated-*` 前缀。公开 BFF 必须返回作者公开展示字段：优先 `authorDisplayName` / `display_name`，没有展示名时兜底 `authorPublicUserCode` / 陶泥号；前端展示绝不能兜底到内部 `ownerUserId` / `user_id`。若现有数据缺少提示词、作者公开标识或成本字段，v1 显示保守占位，不伪造内容。
 
 瀑布流通过 `GET /api/editor/showcase/resources` 按通过审核时间 / `showcaseId` 倒序 cursor 分页读取，每页最多 36 条；响应有 `nextCursor` 时，页面滚动到底部继续请求 `?cursor=...` 并追加到现有瀑布流，而不是固定只展示首屏数量。响应可以额外携带后台配置的固定活动卡，用于在列表首位展示运营精选。
 
diff --git a/docs/【玩法创作】平台入口与玩法链路-2026-05-15.md b/docs/【玩法创作】平台入口与玩法链路-2026-05-15.md
index 3e19ec162..6ba04093b 100644
--- a/docs/【玩法创作】平台入口与玩法链路-2026-05-15.md
+++ b/docs/【玩法创作】平台入口与玩法链路-2026-05-15.md
@@ -12,7 +12,7 @@
 
 旧库或旧迁移包没有 `event_banners_json` 时，后端读取层必须把 `eventBanners` 归一到 `module-runtime` 默认公告数组，不能把旧结构化 `eventBanner` 当成前端优先数组下发。默认公告引用的背景图必须指向 `public/` 下真实存在的站内静态资源，当前默认使用 `/creation-type-references/puzzle.webp`，避免创作入口顶部 banner 出现失效图片。
 
-创作页和草稿页顶栏右上角统一复用公共泥点资产入口，不再把余额区本身作为直接充值按钮。余额区展开后只展示不限时泥点、每日免费泥点及重置口径；会员周期限时泥点仅由后端保留用于存量兼容和结算，当前版本不在前台展示。独立“充值”按钮进入“购买更多泥点”弹窗，“使用详情”进入泥点账单。主站各位置必须保持同一组件、数据口径和交互语义，头像 / 设置等账号入口继续保留各自语义。
+创作页和草稿页顶栏右上角统一复用公共泥点资产入口，不再把余额区本身作为直接充值按钮。顶部总余额优先展示会随扣费、退回和到账刷新的 `profileDashboard.walletBalance`，充值中心的 `mudPointBalance` 只承接展开面板中的不限时 / 每日免费泥点明细，不得用已缓存的明细总数覆盖已刷新的顶部余额。余额区展开后只展示不限时泥点、每日免费泥点及重置口径；会员周期限时泥点仅由后端保留用于存量兼容和结算，当前版本不在前台展示。独立“充值”按钮进入“购买更多泥点”弹窗，“使用详情”进入泥点账单。主站各位置必须保持同一组件、数据口径和交互语义，头像 / 设置等账号入口继续保留各自语义。
 
 创作恢复参数只保留 `sessionId`、`profileId`、`draftId`、`workId` 这四个私有 query。它们只允许在同一条创作链路的结果页、生成页、工作台之间保留；切到首页、公开作品详情、runtime 或另一条玩法链路时必须清掉。平台入口刷新直达时，路径到玩法恢复目标、四个 query 归一化、生成页标记、大鱼吃小鱼 workId 兜底、作品 / 草稿身份匹配和跳一跳 / 敲木鱼恢复阶段落点统一由 `platformCreationUrlStateModel.ts` 解析，壳层只执行读取作品、恢复草稿和切换阶段等副作用。生成页等待时间统一以生成状态里的 `startedAtMs` 为准；创建该状态时优先使用后端 session 下发的时间戳，作品摘要里的 `updatedAt` 仍只用于排序与摘要展示，不作为前端自行推导业务状态的真相。
 
diff --git a/docs/【编辑器】宣发素材工具演示入口设计-2026-06-17.md b/docs/【编辑器】宣发素材工具演示入口设计-2026-06-17.md
index 4f2aa5d21..6a29a90b2 100644
--- a/docs/【编辑器】宣发素材工具演示入口设计-2026-06-17.md
+++ b/docs/【编辑器】宣发素材工具演示入口设计-2026-06-17.md
@@ -54,7 +54,7 @@ Prompt 输入摘要与 Prompt 约束只作为内部生成契约维护，不在 U
 - 前端生成请求统一通过 `/api/editor/images/generations`。
 - 宣发素材请求携带 `kind: publication-material`，前端提交和后端 handler 都固定归一为 `gpt-image-2`；即使旧前端或外部请求传入 `nanobanana2`，后端也按 `gpt-image-2` 生成和计费，但价格仍来自运行时模型定价配置，不写死数值。
 - `publication-detail-gallery` 不再携带 `candidateCount: 5`；后端仍兼容多候选请求，但当前宣发素材入口不主动批量生成。
-- 尺寸请求必须使用明确像素值：游戏首图 `720x540`、详情图 `720x1280`、运营海报 `1280x720`。VectorEngine 适配层对明确像素值保持原样透传；只有 `16:9`、`9:16`、`2k` 等比例 / 档位别名才走 provider 预设映射。
+- 尺寸请求和成品交付规格必须使用明确像素值：游戏首图 `720x540`、详情图 `720x1280`、运营海报 `1280x720`。这些值是画布图层与成品的业务规格；由于三种规格并非都满足 `gpt-image-2` 的上游尺寸约束，VectorEngine 适配层会在发送前等比归一到合法请求尺寸（最大边 `3840`、两边为 `16` 的倍数、长短边比不超过 `3:1`、总像素 `655360..8294400`），不能将上游归一后的尺寸当作宣发成品规格。只有 `16:9`、`9:16`、`2k` 等比例 / 档位别名才走 provider 预设映射。
 - 参考图在提交 `/api/editor/images/generations` 前由前端压缩成适合生成理解的图片 Data URL，避免原图 Data URL 撑爆 JSON 请求体；后端该路由保留 `12MB` body limit 作为兼容兜底。
 - 扣费通过现有钱包资产操作封装执行；上游生成失败或未返回图片时按现有补偿逻辑退款。
 - 生成成功后，成品作为图片画布生成图层加入画布，并保留游戏输入和参考图摘要供图层信息使用。
diff --git a/docs/【编辑器】生成类面板Lovart统一改造方案-2026-06-17.md b/docs/【编辑器】生成类面板Lovart统一改造方案-2026-06-17.md
index 00d6c6e7d..e8d8a3677 100644
--- a/docs/【编辑器】生成类面板Lovart统一改造方案-2026-06-17.md
+++ b/docs/【编辑器】生成类面板Lovart统一改造方案-2026-06-17.md
@@ -119,7 +119,7 @@
 - 一次生成任务产生多个可复用产物时，全部产物都必须由后端登记为项目资源并随同一次完成快照加入画布，不能只保留最终产物或由前端临时追加。角色形象、图标 spritesheet 和 UI 素材提取至少同时回填纯色背景原图与透明后处理结果；UI 素材提取继续一并回填拆分素材。`generatedLayerId` 仍锚定透明后处理主结果，附属产物从主结果右侧开始错开放置。
 - 多产物任务的可恢复中间产物还必须进入账号素材库，未传 `assetFolderId` 时落默认“项目”文件夹，并在抠图、尺寸恢复、抽帧或拆分前完成登记。图片修改保存模型对齐尺寸的原始输出；角色动作把绿幕预览视频保存为一个素材，逐帧绿幕源图只保留在同一任务 OSS 路径，避免素材库一次新增 32 至 48 张帧图。普通图片、去背景和音频等没有独立上游中间产物的任务不重复复制最终结果。
 - 图标和 UI 图集自动拆分属于非阻断附加动作；识别或切片持久化失败时整张透明图集仍完成并回填，前端通过 warning toast 提示用户可手动重试。inline 响应、worker 队列终态和刷新后的任务列表必须使用同一 warning 语义，不能把已完成图集标记为失败。
-- 普通图片、图片修改、规范、角色、图标、UI 设计、宣发素材、视频、音效、背景音乐和角色动作生成面板统一提供“资源名称”输入，状态字段沿用请求契约 `assetLabel`。输入最多 80 个字符，提交时 trim；留空继续使用现有“类型 + 编号”名称。最终解析出的同一个名称必须同时写入画布图层、`editor_project_resource`、`editor_asset` 和 `canvasCompletion.title`。中间原图在主名称后追加“（原图）/（原始输出）”，拆分图标仍使用各自素材描述。
+- 普通图片、图片修改、规范、角色、图标、UI 设计、宣发素材、视频、音效、背景音乐和角色动作生成面板不展示“资源名称”输入，默认继续使用现有“类型 + 编号”名称；提示词输入保持统一可见边框。状态与请求契约仍兼容可选 `assetLabel`，内部调用或历史状态携带名称时最多 80 个字符并在提交时 trim，最终解析出的同一个名称必须同时写入画布图层、`editor_project_resource`、`editor_asset` 和 `canvasCompletion.title`。中间原图在主名称后追加“（原图）/（原始输出）”，拆分图标仍使用各自素材描述。
 - 图片、视频和音频生成结果都要写入账号级素材库；视频 / 音频结果由后端持久化到 OSS 并回传 `objectKey` / `assetObjectId`，前端保存素材库时一并记录，后续预览和再次加入画布走统一换签链路。
 - 刷新项目后，画布需要同时恢复图层、生成器快照和生成输入框跟随关系。
 
diff --git a/docs/【项目基线】当前产品与工程约束-2026-05-15.md b/docs/【项目基线】当前产品与工程约束-2026-05-15.md
index 36ff0a5d0..fdd615560 100644
--- a/docs/【项目基线】当前产品与工程约束-2026-05-15.md
+++ b/docs/【项目基线】当前产品与工程约束-2026-05-15.md
@@ -81,7 +81,7 @@ server-rs + Axum + SpacetimeDB
 - `spacetime-client`：后端访问 SpacetimeDB 的 typed facade。
 - `module-*`：纯领域模型、命令、应用规则、领域事件和领域错误。
 - `platform-*`：OSS、LLM、认证、语音等外部平台能力。
-- `shared-contracts` / `packages/shared`：前后端 DTO 和公开契约。
+- `shared-contracts` / `packages/shared`：前后端 DTO、公开契约和跨页面复用的无业务真相 TypeScript 代码；`packages/shared` 可承载共享 UI 组件与纯工具，但不承载领域规则、后端副作用或正式状态。
 - 前端：表现、交互、临时 UI 状态和后端结果渲染。
 
 明确废弃：
diff --git a/jenkins/Jenkinsfile.production-api-build b/jenkins/Jenkinsfile.production-api-build
index ea9496ae6..a2de704af 100644
--- a/jenkins/Jenkinsfile.production-api-build
+++ b/jenkins/Jenkinsfile.production-api-build
@@ -10,7 +10,7 @@ pipeline {
   }
 
   environment {
-    GIT_REMOTE_URL = 'ssh://git@192.168.35.82:2222/GenarrativeAI/Genarrative.git'
+    GIT_REMOTE_URL = 'ssh://git@127.0.0.1:2222/GenarrativeAI/Genarrative.git'
     GIT_REMOTE_CREDENTIAL_ID = 'genarrative-local-gitea-ssh'
     GIT_REMOTE_FALLBACK_URL = ''
     GIT_REMOTE_FALLBACK_CREDENTIAL_ID = ''
@@ -125,6 +125,7 @@ pipeline {
               echo "[api-build] 未找到 sccache，改用 rustc 直接构建。"
               unset RUSTC_WRAPPER
             fi
+            npm run check:rustfmt
             pingora_args=()
             if [[ "${INCLUDE_PINGORA_GATEWAY:-false}" == "true" ]]; then
               pingora_args+=(--include-pingora-gateway)
diff --git a/jenkins/Jenkinsfile.production-database-export b/jenkins/Jenkinsfile.production-database-export
index 550f4c2cd..cf2574bd6 100644
--- a/jenkins/Jenkinsfile.production-database-export
+++ b/jenkins/Jenkinsfile.production-database-export
@@ -8,7 +8,7 @@ pipeline {
   }
 
   environment {
-    GIT_REMOTE_URL = 'ssh://git@192.168.35.82:2222/GenarrativeAI/Genarrative.git'
+    GIT_REMOTE_URL = 'ssh://git@127.0.0.1:2222/GenarrativeAI/Genarrative.git'
     GIT_REMOTE_CREDENTIAL_ID = 'genarrative-local-gitea-ssh'
     GIT_REMOTE_FALLBACK_URL = ''
     GIT_REMOTE_FALLBACK_CREDENTIAL_ID = ''
@@ -77,14 +77,6 @@ pipeline {
           env.EFFECTIVE_SPACETIME_ROOT_DIR = spacetimeRootDir
           env.EFFECTIVE_SERVER_BACKUP_DIRECTORY = serverBackupDirectory ?: ''
         }
-      }
-    }
-
-    stage('Export Database') {
-      agent {
-        label "${params.DEPLOY_TARGET == 'development' ? 'linux && genarrative-build' : 'linux && genarrative-release-deploy'}"
-      }
-      steps {
         script {
           def checkoutFromRemote = { String remoteUrl, String credentialsId ->
             def remoteConfig = [url: remoteUrl, refspec: "+refs/heads/${params.SOURCE_BRANCH}:refs/remotes/origin/${params.SOURCE_BRANCH}"]
@@ -132,6 +124,22 @@ pipeline {
             '
           '''
         }
+        script {
+          env.SOURCE_COMMIT = readFile('.jenkins-source-commit').trim()
+        }
+        stash name: 'database-export-source',
+          includes: '.jenkins-source-commit,scripts/jenkins-prepare-toolchain-env.sh,scripts/deploy/maintenance-on.sh,scripts/deploy/maintenance-off.sh,scripts/spacetime-export-migration-json.mjs,scripts/spacetime-migration-common.mjs',
+          allowEmpty: false
+      }
+    }
+
+    stage('Export Database') {
+      agent {
+        label "${params.DEPLOY_TARGET == 'development' ? 'linux && genarrative-build' : 'linux && genarrative-release-deploy'}"
+      }
+      steps {
+        deleteDir()
+        unstash 'database-export-source'
         script {
           def credentialBindings = []
           if (params.TOKEN_CREDENTIAL_ID?.trim()) {
diff --git a/jenkins/Jenkinsfile.production-database-import b/jenkins/Jenkinsfile.production-database-import
index c2511e2d2..cdb8f7d9a 100644
--- a/jenkins/Jenkinsfile.production-database-import
+++ b/jenkins/Jenkinsfile.production-database-import
@@ -8,7 +8,7 @@ pipeline {
   }
 
   environment {
-    GIT_REMOTE_URL = 'ssh://git@192.168.35.82:2222/GenarrativeAI/Genarrative.git'
+    GIT_REMOTE_URL = 'ssh://git@127.0.0.1:2222/GenarrativeAI/Genarrative.git'
     GIT_REMOTE_CREDENTIAL_ID = 'genarrative-local-gitea-ssh'
     GIT_REMOTE_FALLBACK_URL = ''
     GIT_REMOTE_FALLBACK_CREDENTIAL_ID = ''
@@ -135,14 +135,6 @@ pipeline {
           env.PRE_IMPORT_BACKUP_DIRECTORY = backupDirectory
           env.EFFECTIVE_PRE_IMPORT_BACKUP_NAME = "pre-import-${env.BUILD_NUMBER}.json"
         }
-      }
-    }
-
-    stage('Import Database') {
-      agent {
-        label "${params.DEPLOY_TARGET == 'development' ? 'linux && genarrative-build' : 'linux && genarrative-release-deploy'}"
-      }
-      steps {
         script {
           def checkoutFromRemote = { String remoteUrl, String credentialsId ->
             def remoteConfig = [url: remoteUrl, refspec: "+refs/heads/${params.SOURCE_BRANCH}:refs/remotes/origin/${params.SOURCE_BRANCH}"]
@@ -190,6 +182,22 @@ pipeline {
             '
           '''
         }
+        script {
+          env.SOURCE_COMMIT = readFile('.jenkins-source-commit').trim()
+        }
+        stash name: 'database-import-source',
+          includes: '.jenkins-source-commit,scripts/jenkins-prepare-toolchain-env.sh,scripts/deploy/maintenance-on.sh,scripts/deploy/maintenance-off.sh,scripts/spacetime-export-migration-json.mjs,scripts/spacetime-import-migration-json.mjs,scripts/spacetime-migration-common.mjs',
+          allowEmpty: false
+      }
+    }
+
+    stage('Import Database') {
+      agent {
+        label "${params.DEPLOY_TARGET == 'development' ? 'linux && genarrative-build' : 'linux && genarrative-release-deploy'}"
+      }
+      steps {
+        deleteDir()
+        unstash 'database-import-source'
         script {
           if (params.INPUT_SOURCE == 'pipeline_archive') {
             echo "[database-import] 使用归档数据源: job=${params.EXPORT_JOB_NAME}, build=${params.EXPORT_BUILD_NUMBER_TO_IMPORT}, file=${env.EFFECTIVE_PIPELINE_ARCHIVE_INPUT_FILE}"
diff --git a/jenkins/Jenkinsfile.production-full-build-and-deploy b/jenkins/Jenkinsfile.production-full-build-and-deploy
index a3883d7b9..28724d731 100644
--- a/jenkins/Jenkinsfile.production-full-build-and-deploy
+++ b/jenkins/Jenkinsfile.production-full-build-and-deploy
@@ -12,7 +12,7 @@ pipeline {
   }
 
   environment {
-    GIT_REMOTE_URL = 'ssh://git@192.168.35.82:2222/GenarrativeAI/Genarrative.git'
+    GIT_REMOTE_URL = 'ssh://git@127.0.0.1:2222/GenarrativeAI/Genarrative.git'
     GIT_REMOTE_CREDENTIAL_ID = 'genarrative-local-gitea-ssh'
     GIT_REMOTE_FALLBACK_URL = ''
     GIT_REMOTE_FALLBACK_CREDENTIAL_ID = ''
diff --git a/jenkins/Jenkinsfile.production-server-provision b/jenkins/Jenkinsfile.production-server-provision
index e4d3976b9..e59a82fa9 100644
--- a/jenkins/Jenkinsfile.production-server-provision
+++ b/jenkins/Jenkinsfile.production-server-provision
@@ -8,7 +8,7 @@ pipeline {
   }
 
   environment {
-    GIT_REMOTE_URL = 'ssh://git@192.168.35.82:2222/GenarrativeAI/Genarrative.git'
+    GIT_REMOTE_URL = 'ssh://git@127.0.0.1:2222/GenarrativeAI/Genarrative.git'
     GIT_REMOTE_CREDENTIAL_ID = 'genarrative-local-gitea-ssh'
   }
 
diff --git a/jenkins/Jenkinsfile.production-stdb-module-build b/jenkins/Jenkinsfile.production-stdb-module-build
index 7eb6971c7..2383e2420 100644
--- a/jenkins/Jenkinsfile.production-stdb-module-build
+++ b/jenkins/Jenkinsfile.production-stdb-module-build
@@ -10,7 +10,7 @@ pipeline {
   }
 
   environment {
-    GIT_REMOTE_URL = 'ssh://git@192.168.35.82:2222/GenarrativeAI/Genarrative.git'
+    GIT_REMOTE_URL = 'ssh://git@127.0.0.1:2222/GenarrativeAI/Genarrative.git'
     GIT_REMOTE_CREDENTIAL_ID = 'genarrative-local-gitea-ssh'
     GIT_REMOTE_FALLBACK_URL = ''
     GIT_REMOTE_FALLBACK_CREDENTIAL_ID = ''
@@ -129,6 +129,7 @@ pipeline {
                   echo "[stdb-build] 未找到可用 sccache，改用 rustc 直接构建。"
                   unset RUSTC_WRAPPER
                 fi
+                npm run check:rustfmt
                 SOURCE_BRANCH="${SOURCE_BRANCH}" SOURCE_COMMIT="${SOURCE_COMMIT}" \
                 npm run build:production-release -- --component spacetime-module --name "${EFFECTIVE_BUILD_VERSION}"
               '
diff --git a/jenkins/Jenkinsfile.production-web-build b/jenkins/Jenkinsfile.production-web-build
index 63dced22f..b53b13b9f 100644
--- a/jenkins/Jenkinsfile.production-web-build
+++ b/jenkins/Jenkinsfile.production-web-build
@@ -10,7 +10,7 @@ pipeline {
   }
 
   environment {
-    GIT_REMOTE_URL = 'ssh://git@192.168.35.82:2222/GenarrativeAI/Genarrative.git'
+    GIT_REMOTE_URL = 'ssh://git@127.0.0.1:2222/GenarrativeAI/Genarrative.git'
     GIT_REMOTE_CREDENTIAL_ID = 'genarrative-local-gitea-ssh'
     GIT_REMOTE_FALLBACK_URL = ''
     GIT_REMOTE_FALLBACK_CREDENTIAL_ID = ''
diff --git a/package.json b/package.json
index 22a1cceaa..046d71138 100644
--- a/package.json
+++ b/package.json
@@ -21,6 +21,7 @@
     "spacetime:wechat-virtual-payment:reconcile": "node scripts/reconcile-wechat-virtual-payment-order.mjs",
     "check:wechat-virtual-payment-reconcile": "node scripts/check-wechat-virtual-payment-reconcile.mjs",
     "check:api-server-env": "node scripts/check-api-server-env.mjs",
+    "check:admin-account-procedures": "node scripts/check-admin-account-procedures.mjs",
     "check:spacetime-runtime-access": "node scripts/check-spacetime-runtime-access.mjs",
     "deploy:rust:remote": "node scripts/run-bash-script.mjs scripts/deploy-rust-remote.sh",
     "build:production-release": "node scripts/run-bash-script.mjs scripts/build-production-release.sh",
@@ -30,6 +31,7 @@
     "preview": "node scripts/vite-cli.mjs preview",
     "clean": "node -e \"require('fs').rmSync('dist', { recursive: true, force: true })\"",
     "check:encoding": "node scripts/check-encoding.mjs",
+    "check:rustfmt": "cargo fmt --all --manifest-path server-rs/Cargo.toml -- --check",
     "check:spacetime-schema": "node scripts/check-spacetime-schema-guard.mjs",
     "check:production-ops": "node scripts/check-production-ops-guardrails.mjs",
     "check:maintenance-page": "node scripts/check-maintenance-page.mjs",
@@ -83,7 +85,7 @@
     "lint:guardrails": "npm run lint:eslint",
     "typecheck": "tsc -p tsconfig.typecheck-guardrails.json --noEmit",
     "typecheck:guardrails": "npm run typecheck",
-    "lint": "npm run check:encoding && npm run check:spacetime-schema && npm run check:production-ops && npm run check:maintenance-page && npm run lint:eslint && npm run typecheck",
+    "lint": "npm run check:encoding && npm run check:rustfmt && npm run check:spacetime-schema && npm run check:production-ops && npm run check:maintenance-page && npm run lint:eslint && npm run typecheck",
     "lint:fix": "eslint . --ext .ts,.tsx,.js,.mjs,.cjs --fix && prettier --write .",
     "format": "prettier --write .",
     "format:check": "prettier --check .",
diff --git a/src/components/common/PlatformMudPointWalletEntry.test.tsx b/packages/shared/src/components/PlatformMudPointWalletEntry.test.tsx
similarity index 83%
rename from src/components/common/PlatformMudPointWalletEntry.test.tsx
rename to packages/shared/src/components/PlatformMudPointWalletEntry.test.tsx
index 1156a20d4..dbace6b73 100644
--- a/src/components/common/PlatformMudPointWalletEntry.test.tsx
+++ b/packages/shared/src/components/PlatformMudPointWalletEntry.test.tsx
@@ -1,11 +1,17 @@
 /* @vitest-environment jsdom */
 
-import { act, fireEvent, render, screen, within } from '@testing-library/react';
+import {
+  act,
+  fireEvent,
+  render,
+  screen,
+  within,
+} from '@testing-library/react';
 import userEvent from '@testing-library/user-event';
 import { expect, test, vi } from 'vitest';
 
-import { PlatformMudPointWalletEntry } from './PlatformMudPointWalletEntry';
-import { formatMudPointCount } from './platformMudPointWalletModel';
+import { formatMudPointCount } from '../utils/format';
+import { PlatformMudPointWalletEntry } from './PlatformMudPointWalletEntry.tsx';
 
 const breakdown = {
   totalPoints: 207,
@@ -30,7 +36,7 @@ test('shows only permanent and daily free points in the shared wallet panel', as
 
   render(
     <PlatformMudPointWalletEntry
-      balance={999}
+      balance={207}
       breakdown={breakdown}
       onRequestDetails={onRequestDetails}
       onRecharge={onRecharge}
@@ -60,6 +66,25 @@ test('shows only permanent and daily free points in the shared wallet panel', as
   expect(onRecharge).toHaveBeenCalledTimes(1);
 });
 
+test('keeps the chip on the live balance when cached details are stale', () => {
+  const props = {
+    breakdown,
+    onRequestDetails: vi.fn(),
+    onRecharge: vi.fn(),
+    onOpenLedger: vi.fn(),
+  };
+  const { rerender } = render(
+    <PlatformMudPointWalletEntry balance={207} {...props} />,
+  );
+
+  expect(screen.getByRole('button', { name: '泥点 207' })).toBeTruthy();
+
+  rerender(<PlatformMudPointWalletEntry balance={195} {...props} />);
+
+  expect(screen.getByRole('button', { name: '泥点 195' })).toBeTruthy();
+  expect(screen.queryByRole('button', { name: '泥点 207' })).toBeNull();
+});
+
 test('keeps the desktop panel open while moving across the gap without click pinning', () => {
   vi.useFakeTimers();
 
diff --git a/src/components/common/PlatformMudPointWalletEntry.tsx b/packages/shared/src/components/PlatformMudPointWalletEntry.tsx
similarity index 96%
rename from src/components/common/PlatformMudPointWalletEntry.tsx
rename to packages/shared/src/components/PlatformMudPointWalletEntry.tsx
index 6f2b0f218..57190b210 100644
--- a/src/components/common/PlatformMudPointWalletEntry.tsx
+++ b/packages/shared/src/components/PlatformMudPointWalletEntry.tsx
@@ -8,10 +8,9 @@ import {
   useState,
 } from 'react';
 
-import type { ProfileMudPointBalance } from '../../../packages/shared/src/contracts/runtime';
-import { formatMudPointCount } from './platformMudPointWalletModel';
-
-const MUD_POINT_ICON_SRC = '/creation-home/topbar-wallet.png';
+import type { ProfileMudPointBalance } from '../contracts/runtime';
+import MUD_POINT_ICON_SRC from '../icons/topbar-wallet.png';
+import { formatMudPointCount } from '../utils/format';
 
 export type PlatformMudPointWalletEntryProps = {
   balance: number | null;
@@ -68,7 +67,7 @@ export function PlatformMudPointWalletEntry({
   const closeTimerRef = useRef<number | null>(null);
   const [isOpen, setIsOpen] = useState(false);
   const isCompact = variant === 'mobile';
-  const displayedBalance = breakdown?.totalPoints ?? balance;
+  const displayedBalance = balance ?? breakdown?.totalPoints ?? null;
   const balanceLabel =
     displayedBalance === null
       ? '--'
diff --git a/packages/shared/src/icons/topbar-wallet.png b/packages/shared/src/icons/topbar-wallet.png
new file mode 100644
index 000000000..37043028d
Binary files /dev/null and b/packages/shared/src/icons/topbar-wallet.png differ
diff --git a/src/components/common/platformMudPointWalletModel.ts b/packages/shared/src/utils/format.ts
similarity index 100%
rename from src/components/common/platformMudPointWalletModel.ts
rename to packages/shared/src/utils/format.ts
diff --git a/rust-toolchain.toml b/rust-toolchain.toml
new file mode 100644
index 000000000..ecfb7c606
--- /dev/null
+++ b/rust-toolchain.toml
@@ -0,0 +1,4 @@
+[toolchain]
+channel = "1.96.0"
+profile = "minimal"
+components = ["rustfmt"]
diff --git a/rustfmt.toml b/rustfmt.toml
new file mode 100644
index 000000000..c0c5cfb55
--- /dev/null
+++ b/rustfmt.toml
@@ -0,0 +1,4 @@
+edition = "2024"
+max_width = 100
+newline_style = "Unix"
+use_small_heuristics = "Default"
diff --git a/scripts/check-admin-account-procedures.mjs b/scripts/check-admin-account-procedures.mjs
new file mode 100644
index 000000000..9c8440615
--- /dev/null
+++ b/scripts/check-admin-account-procedures.mjs
@@ -0,0 +1,581 @@
+#!/usr/bin/env node
+
+import { spawn } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { once } from 'node:events';
+import { mkdtemp, readFile, rm } from 'node:fs/promises';
+import net from 'node:net';
+import os from 'node:os';
+import path from 'node:path';
+import { setTimeout as delay } from 'node:timers/promises';
+import { fileURLToPath } from 'node:url';
+
+import {
+  createSpacetimeWebIdentity,
+  encodeSpacetimeCliOption,
+} from './spacetime-migration-common.mjs';
+
+const repoRoot = path.resolve(
+  path.dirname(fileURLToPath(import.meta.url)),
+  '..',
+);
+const database = 'admin-account-smoke';
+const expectedSpacetimeVersion = '2.6.0';
+const commandTimeoutMs = 5 * 60 * 1000;
+
+function assert(condition, message) {
+  if (!condition) {
+    throw new Error(message);
+  }
+}
+
+function appendOutput(current, chunk) {
+  const next = `${current}${chunk}`;
+  return next.length <= 24_000 ? next : next.slice(-24_000);
+}
+
+function runCommand(command, args, options = {}) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, args, {
+      cwd: options.cwd ?? repoRoot,
+      env: options.env ?? process.env,
+      shell: false,
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    let output = '';
+    const timeout = setTimeout(() => {
+      child.kill('SIGKILL');
+      reject(new Error(`${command} timed out after ${commandTimeoutMs}ms`));
+    }, options.timeoutMs ?? commandTimeoutMs);
+
+    child.stdout.on('data', (chunk) => {
+      output = appendOutput(output, chunk.toString());
+    });
+    child.stderr.on('data', (chunk) => {
+      output = appendOutput(output, chunk.toString());
+    });
+    child.on('error', (error) => {
+      clearTimeout(timeout);
+      reject(error);
+    });
+    child.on('exit', (code, signal) => {
+      clearTimeout(timeout);
+      if (signal) {
+        reject(new Error(`${command} exited via ${signal}: ${output.trim()}`));
+      } else if (code !== 0) {
+        reject(new Error(`${command} exited with ${code}: ${output.trim()}`));
+      } else {
+        resolve(output);
+      }
+    });
+  });
+}
+
+async function reservePort() {
+  const server = net.createServer();
+  await new Promise((resolve, reject) => {
+    server.once('error', reject);
+    server.listen(0, '127.0.0.1', resolve);
+  });
+  const address = server.address();
+  assert(
+    address && typeof address === 'object',
+    'Failed to reserve a local port.',
+  );
+  const port = address.port;
+  await new Promise((resolve, reject) =>
+    server.close((error) => (error ? reject(error) : resolve())),
+  );
+  return port;
+}
+
+function startStandalone(dataDir, port) {
+  const child = spawn(
+    'spacetime',
+    [
+      'start',
+      '--data-dir',
+      dataDir,
+      '--listen-addr',
+      `127.0.0.1:${port}`,
+      '--non-interactive',
+    ],
+    {
+      cwd: repoRoot,
+      env: process.env,
+      shell: false,
+      stdio: ['ignore', 'pipe', 'pipe'],
+    },
+  );
+  let output = '';
+  child.stdout.on('data', (chunk) => {
+    output = appendOutput(output, chunk.toString());
+  });
+  child.stderr.on('data', (chunk) => {
+    output = appendOutput(output, chunk.toString());
+  });
+  return { child, output: () => output };
+}
+
+async function waitForStandalone(serverUrl, processState) {
+  const deadline = Date.now() + 30_000;
+  while (Date.now() < deadline) {
+    if (processState.child.exitCode !== null) {
+      throw new Error(
+        `SpacetimeDB exited during startup: ${processState.output().trim()}`,
+      );
+    }
+    try {
+      const response = await fetch(`${serverUrl}/v1/ping`);
+      if (response.ok) {
+        return;
+      }
+    } catch {
+      // Startup is still in progress.
+    }
+    await delay(200);
+  }
+  throw new Error(
+    `Timed out waiting for SpacetimeDB: ${processState.output().trim()}`,
+  );
+}
+
+async function stopStandalone(child) {
+  if (child.exitCode !== null) {
+    return;
+  }
+  child.kill('SIGTERM');
+  const exited = await Promise.race([
+    once(child, 'exit').then(() => true),
+    delay(5_000).then(() => false),
+  ]);
+  if (!exited && child.exitCode === null) {
+    child.kill('SIGKILL');
+    await once(child, 'exit');
+  }
+}
+
+async function callProcedure(serverUrl, token, procedureName, input) {
+  const response = await fetch(
+    `${serverUrl}/v1/database/${database}/call/${procedureName}`,
+    {
+      method: 'POST',
+      headers: {
+        Accept: 'application/json',
+        Authorization: `Bearer ${token}`,
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify(input === undefined ? [] : [input]),
+    },
+  );
+  const text = await response.text();
+  if (!response.ok) {
+    throw new Error(
+      `${procedureName} returned HTTP ${response.status}: ${text}`,
+    );
+  }
+  return JSON.parse(text);
+}
+
+function decodeOption(value) {
+  if (value === null || value === undefined) {
+    return null;
+  }
+  if (Array.isArray(value) && value[0] === 0) {
+    return value[1];
+  }
+  if (Array.isArray(value) && value[0] === 1) {
+    return null;
+  }
+  throw new Error(`Unexpected SATS option: ${JSON.stringify(value)}`);
+}
+
+function mapAccountSnapshot(value) {
+  if (value && typeof value === 'object' && !Array.isArray(value)) {
+    return value;
+  }
+  assert(
+    Array.isArray(value) && value.length === 10,
+    'Invalid admin account snapshot.',
+  );
+  return {
+    account_id: value[0],
+    username: value[1],
+    display_name: value[2],
+    tab_permissions_json: value[3],
+    enabled: value[4],
+    token_version: value[5],
+    created_by: value[6],
+    updated_by: value[7],
+    created_at_micros: value[8],
+    updated_at_micros: value[9],
+  };
+}
+
+function parseAccountResult(value) {
+  if (value && typeof value === 'object' && !Array.isArray(value)) {
+    return value;
+  }
+  assert(
+    Array.isArray(value) && value.length === 4,
+    'Invalid admin account result.',
+  );
+  const account = decodeOption(value[1]);
+  return {
+    ok: value[0],
+    account: account === null ? null : mapAccountSnapshot(account),
+    accounts: value[2].map(mapAccountSnapshot),
+    error_message: decodeOption(value[3]),
+  };
+}
+
+function parseCredentialResult(value) {
+  if (value && typeof value === 'object' && !Array.isArray(value)) {
+    return value;
+  }
+  assert(
+    Array.isArray(value) && value.length === 3,
+    'Invalid admin credential result.',
+  );
+  const credential = decodeOption(value[1]);
+  return {
+    ok: value[0],
+    account:
+      credential === null
+        ? null
+        : {
+            account: mapAccountSnapshot(credential[0]),
+            password_hash: credential[1],
+          },
+    error_message: decodeOption(value[2]),
+  };
+}
+
+function parsePricingResult(value) {
+  if (value && typeof value === 'object' && !Array.isArray(value)) {
+    return value;
+  }
+  assert(Array.isArray(value) && value.length === 3, 'Invalid pricing result.');
+  return {
+    ok: value[0],
+    record: decodeOption(value[1]),
+    error_message: decodeOption(value[2]),
+  };
+}
+
+function assertDenied(result, procedureName) {
+  assert(
+    !result.ok,
+    `${procedureName} unexpectedly allowed an ordinary identity.`,
+  );
+  assert(
+    result.error_message === '当前 identity 无权调用模型生成运行时服务',
+    `${procedureName} returned an unexpected denial: ${result.error_message}`,
+  );
+}
+
+async function loadPricingModels() {
+  const filePath = path.join(
+    repoRoot,
+    'server-rs/crates/api-server/config/editor-generation-pricing.default.json',
+  );
+  const config = JSON.parse(await readFile(filePath, 'utf8'));
+  return Object.entries(config.models).map(([model, pricing]) => ({
+    model,
+    unit: pricing.unit,
+    price: encodeSpacetimeCliOption(pricing.price),
+    prices: Object.entries(pricing.prices ?? {}).map(([key, price]) => ({
+      key,
+      price,
+    })),
+  }));
+}
+
+async function runSmoke(serverUrl, bootstrapSecret) {
+  const identityOptions = { database, serverUrl };
+  const runtime = await createSpacetimeWebIdentity(identityOptions);
+  const ordinary = await createSpacetimeWebIdentity(identityOptions);
+  const models = await loadPricingModels();
+  const pricing = parsePricingResult(
+    await callProcedure(
+      serverUrl,
+      runtime.token,
+      'initialize_editor_generation_pricing_config_if_missing_and_return',
+      {
+        admin_user_id: 'admin-account-smoke',
+        models,
+        updated_at_micros: 1,
+        bootstrap_secret: bootstrapSecret,
+      },
+    ),
+  );
+  assert(
+    pricing.ok,
+    `Failed to initialize runtime identity: ${pricing.error_message}`,
+  );
+
+  const createInput = {
+    account_id: 'member-1',
+    username: 'operator',
+    display_name: 'Operator',
+    password_hash: '$argon2id$admin-account-smoke',
+    tab_permissions_json: '["dashboard"]',
+    enabled: true,
+    created_by: 'admin-account-smoke',
+  };
+  const updateInput = {
+    account_id: 'member-1',
+    display_name: 'Operator Updated',
+    password_hash: null,
+    tab_permissions_json: '["dashboard","tracking"]',
+    enabled: false,
+    updated_by: 'admin-account-smoke',
+  };
+
+  assertDenied(
+    parseCredentialResult(
+      await callProcedure(
+        serverUrl,
+        ordinary.token,
+        'get_admin_account_by_username_and_return',
+        {
+          username: 'operator',
+        },
+      ),
+    ),
+    'get_admin_account_by_username_and_return',
+  );
+  assertDenied(
+    parseAccountResult(
+      await callProcedure(
+        serverUrl,
+        ordinary.token,
+        'get_admin_account_by_id_and_return',
+        {
+          account_id: 'member-1',
+        },
+      ),
+    ),
+    'get_admin_account_by_id_and_return',
+  );
+  assertDenied(
+    parseAccountResult(
+      await callProcedure(
+        serverUrl,
+        ordinary.token,
+        'list_admin_accounts_and_return',
+      ),
+    ),
+    'list_admin_accounts_and_return',
+  );
+  assertDenied(
+    parseAccountResult(
+      await callProcedure(
+        serverUrl,
+        ordinary.token,
+        'create_admin_account_and_return',
+        createInput,
+      ),
+    ),
+    'create_admin_account_and_return',
+  );
+  assertDenied(
+    parseAccountResult(
+      await callProcedure(
+        serverUrl,
+        ordinary.token,
+        'update_admin_account_and_return',
+        updateInput,
+      ),
+    ),
+    'update_admin_account_and_return',
+  );
+
+  const created = parseAccountResult(
+    await callProcedure(
+      serverUrl,
+      runtime.token,
+      'create_admin_account_and_return',
+      createInput,
+    ),
+  );
+  assert(
+    created.ok && created.account?.token_version === 1,
+    'Runtime create failed.',
+  );
+
+  const duplicate = parseAccountResult(
+    await callProcedure(
+      serverUrl,
+      runtime.token,
+      'create_admin_account_and_return',
+      {
+        ...createInput,
+        account_id: 'member-duplicate',
+        username: ' Operator ',
+      },
+    ),
+  );
+  assert(
+    !duplicate.ok,
+    'Duplicate normalized username unexpectedly succeeded.',
+  );
+  assert(
+    duplicate.error_message === '后台账号用户名已存在',
+    `Duplicate username error changed: ${duplicate.error_message}`,
+  );
+
+  const credential = parseCredentialResult(
+    await callProcedure(
+      serverUrl,
+      runtime.token,
+      'get_admin_account_by_username_and_return',
+      {
+        username: ' OPERATOR ',
+      },
+    ),
+  );
+  assert(
+    credential.ok,
+    `Runtime credential lookup failed: ${credential.error_message}`,
+  );
+  assert(
+    credential.account?.password_hash === createInput.password_hash,
+    'Credential lookup lost the password hash.',
+  );
+
+  const byId = parseAccountResult(
+    await callProcedure(
+      serverUrl,
+      runtime.token,
+      'get_admin_account_by_id_and_return',
+      {
+        account_id: 'member-1',
+      },
+    ),
+  );
+  assert(
+    byId.ok && byId.account?.username === 'operator',
+    'Runtime ID lookup failed.',
+  );
+  assert(
+    !('password_hash' in byId.account),
+    'Public account snapshot exposed password_hash.',
+  );
+
+  const updated = parseAccountResult(
+    await callProcedure(
+      serverUrl,
+      runtime.token,
+      'update_admin_account_and_return',
+      updateInput,
+    ),
+  );
+  assert(
+    updated.ok && updated.account?.token_version === 2,
+    'State update did not increment once.',
+  );
+
+  const displayOnly = parseAccountResult(
+    await callProcedure(
+      serverUrl,
+      runtime.token,
+      'update_admin_account_and_return',
+      {
+        ...updateInput,
+        display_name: 'Operator Display Only',
+      },
+    ),
+  );
+  assert(
+    displayOnly.ok && displayOnly.account?.token_version === 2,
+    'Display-only update changed token_version.',
+  );
+
+  const listed = parseAccountResult(
+    await callProcedure(
+      serverUrl,
+      runtime.token,
+      'list_admin_accounts_and_return',
+    ),
+  );
+  assert(
+    listed.ok && listed.accounts.length === 1,
+    'Failed create mutated the account table.',
+  );
+  assert(
+    listed.accounts[0].account_id === 'member-1',
+    'Unexpected account survived the smoke.',
+  );
+}
+
+let tempDir;
+let standalone;
+try {
+  const versionOutput = await runCommand('spacetime', ['--version'], {
+    timeoutMs: 30_000,
+  });
+  assert(
+    versionOutput.includes(
+      `spacetimedb tool version ${expectedSpacetimeVersion}`,
+    ),
+    `Expected SpacetimeDB ${expectedSpacetimeVersion}, got: ${versionOutput.trim()}`,
+  );
+
+  tempDir = await mkdtemp(
+    path.join(os.tmpdir(), 'genarrative-admin-account-smoke-'),
+  );
+  const port = await reservePort();
+  const serverUrl = `http://127.0.0.1:${port}`;
+  standalone = startStandalone(path.join(tempDir, 'data'), port);
+  await waitForStandalone(serverUrl, standalone);
+
+  const bootstrapSecret = createHash('sha256')
+    .update('genarrative-admin-account-procedure-smoke')
+    .digest('hex');
+  const bootstrapSecretHash = createHash('sha256')
+    .update(bootstrapSecret)
+    .digest('hex');
+  await runCommand(
+    'spacetime',
+    [
+      'publish',
+      database,
+      '--server',
+      serverUrl,
+      '--module-path',
+      'server-rs/crates/spacetime-module',
+      '--anonymous',
+      '--yes=all',
+      '--no-config',
+    ],
+    {
+      env: {
+        ...process.env,
+        GENARRATIVE_SPACETIME_MIGRATION_BOOTSTRAP_SECRET_SHA256:
+          bootstrapSecretHash,
+      },
+    },
+  );
+
+  await runSmoke(serverUrl, bootstrapSecret);
+  console.log(
+    '[admin-account-procedure-smoke] Passed identity guards, credential isolation, uniqueness, and token-version transactions.',
+  );
+} catch (error) {
+  const standaloneOutput = standalone?.output().trim();
+  console.error(
+    `[admin-account-procedure-smoke] Failed: ${error instanceof Error ? error.message : String(error)}`,
+  );
+  if (standaloneOutput) {
+    console.error(standaloneOutput);
+  }
+  process.exitCode = 1;
+} finally {
+  if (standalone) {
+    await stopStandalone(standalone.child);
+  }
+  if (tempDir) {
+    await rm(tempDir, { recursive: true, force: true });
+  }
+}
diff --git a/scripts/check-production-ops-guardrails.mjs b/scripts/check-production-ops-guardrails.mjs
index d5160c5a3..d46621969 100644
--- a/scripts/check-production-ops-guardrails.mjs
+++ b/scripts/check-production-ops-guardrails.mjs
@@ -3,6 +3,21 @@
 import { readFileSync } from 'node:fs';
 
 const checks = [
+  {
+    file: 'package.json',
+    includes: '"check:rustfmt": "cargo fmt --all --manifest-path server-rs/Cargo.toml -- --check"',
+    reason: '仓库必须保留统一、只读的 Rust workspace 格式检查入口。',
+  },
+  {
+    file: 'jenkins/Jenkinsfile.production-api-build',
+    includes: 'npm run check:rustfmt',
+    reason: 'API 生产构建必须在编译前执行 Rust 格式检查。',
+  },
+  {
+    file: 'jenkins/Jenkinsfile.production-stdb-module-build',
+    includes: 'npm run check:rustfmt',
+    reason: 'Stdb module 生产构建必须在编译前执行 Rust 格式检查。',
+  },
   {
     file: 'server-rs/crates/spacetime-module/src/migration.rs',
     includes:
@@ -6827,6 +6842,32 @@ const nodeEnvFileCommandFiles = [
   'scripts/deploy/pingora-direct-rollback.sh',
 ];
 
+const jenkinsSourceCheckoutFiles = [
+  'jenkins/Jenkinsfile.production-api-build',
+  'jenkins/Jenkinsfile.production-web-build',
+  'jenkins/Jenkinsfile.production-stdb-module-build',
+  'jenkins/Jenkinsfile.production-full-build-and-deploy',
+  'jenkins/Jenkinsfile.production-database-export',
+  'jenkins/Jenkinsfile.production-database-import',
+  'jenkins/Jenkinsfile.production-server-provision',
+];
+
+const jenkinsLoopbackGitRemote =
+  "GIT_REMOTE_URL = 'ssh://git@127.0.0.1:2222/GenarrativeAI/Genarrative.git'";
+
+const databaseTargetSourceStashes = [
+  {
+    file: 'jenkins/Jenkinsfile.production-database-export',
+    targetStage: "stage('Export Database')",
+    stashName: 'database-export-source',
+  },
+  {
+    file: 'jenkins/Jenkinsfile.production-database-import',
+    targetStage: "stage('Import Database')",
+    stashName: 'database-import-source',
+  },
+];
+
 let failed = false;
 
 for (const check of checks) {
@@ -6845,6 +6886,72 @@ for (const check of checks) {
   }
 }
 
+for (const file of jenkinsSourceCheckoutFiles) {
+  const content = readFileSync(file, 'utf8');
+  if (!content.includes(jenkinsLoopbackGitRemote)) {
+    failed = true;
+    console.error(
+      `[check:production-ops] ${file} 的 Git checkout 必须固定使用本机 127.0.0.1:2222。`,
+    );
+  }
+  if (
+    !content.includes(
+      "GIT_REMOTE_CREDENTIAL_ID = 'genarrative-local-gitea-ssh'",
+    )
+  ) {
+    failed = true;
+    console.error(
+      `[check:production-ops] ${file} 必须继续显式使用 Jenkins Gitea SSH 凭据。`,
+    );
+  }
+  if (
+    content.includes('192.168.35.82') ||
+    content.includes('git.genarrative.world') ||
+    content.includes('genarrative-station/git')
+  ) {
+    failed = true;
+    console.error(
+      `[check:production-ops] ${file} 不得保留局域网 IP、HTTP 内网别名或公网 Git 地址。`,
+    );
+  }
+}
+
+for (const { file, targetStage, stashName } of databaseTargetSourceStashes) {
+  const content = readFileSync(file, 'utf8');
+  const targetStageOffset = content.indexOf(targetStage);
+  const prepareStageContent =
+    targetStageOffset >= 0 ? content.slice(0, targetStageOffset) : '';
+  const targetStageContent =
+    targetStageOffset >= 0 ? content.slice(targetStageOffset) : '';
+  if (
+    !prepareStageContent.includes("label 'linux && genarrative-build'") ||
+    !prepareStageContent.includes("$class: 'GitSCM'")
+  ) {
+    failed = true;
+    console.error(
+      `[check:production-ops] ${file} 必须只在 Jenkins Built-In Node 的 Prepare 阶段 checkout Git。`,
+    );
+  }
+  if (
+    !content.includes(`stash name: '${stashName}'`) ||
+    !targetStageContent.includes(`unstash '${stashName}'`)
+  ) {
+    failed = true;
+    console.error(
+      `[check:production-ops] ${file} 必须由本机 build 节点 stash 源码脚本，再交给数据库目标阶段。`,
+    );
+  }
+  if (
+    targetStageContent.includes("$class: 'GitSCM'") ||
+    targetStageContent.includes('sshUserPrivateKey(')
+  ) {
+    failed = true;
+    console.error(
+      `[check:production-ops] ${file} 的数据库目标阶段不得再次 checkout Git 或挂载 Git SSH 凭据。`,
+    );
+  }
+}
+
 const fullPipelineContent = readFileSync(
   'jenkins/Jenkinsfile.production-full-build-and-deploy',
   'utf8',
diff --git a/server-rs/crates/api-server/src/admin.rs b/server-rs/crates/api-server/src/admin.rs
index 70c9125b3..0af3200a9 100644
--- a/server-rs/crates/api-server/src/admin.rs
+++ b/server-rs/crates/api-server/src/admin.rs
@@ -16,16 +16,19 @@ use axum::{
     middleware::Next,
     response::Response,
 };
+use platform_auth::{hash_password, verify_password};
 use reqwest::Client;
 use serde::Deserialize;
 use serde_json::{Map, Value};
 use shared_contracts::admin::{
+    ADMIN_TAB_PERMISSIONS, AdminAccountRole,
     AdminCreateEditorShowcaseCampaignImageUploadTicketRequest,
     AdminCreateEditorShowcaseCampaignImageUploadTicketResponse, AdminCreationEntryConfigResponse,
     AdminCreationEntryTypeConfigPayload, AdminDashboardBreakdownRowPayload,
     AdminDashboardChartBucketPayload, AdminDashboardChartPayload, AdminDashboardMetricsPayload,
-    AdminDashboardOperationMetricPayload, AdminDashboardOperationsPayload, AdminDashboardQuery,
-    AdminDashboardRangePayload, AdminDashboardResponse, AdminDatabaseOverviewPayload,
+    AdminDashboardOperationMetricPayload, AdminDashboardOperationsPayload,
+    AdminDashboardPaymentConversionPayload, AdminDashboardQuery, AdminDashboardRangePayload,
+    AdminDashboardResponse, AdminDashboardRetentionPayload, AdminDatabaseOverviewPayload,
     AdminDatabaseTableListResponse, AdminDatabaseTableRowPayload, AdminDatabaseTableRowsQuery,
     AdminDatabaseTableRowsResponse, AdminDatabaseTableStatPayload, AdminDebugHeaderInput,
     AdminDebugHttpRequest, AdminDebugHttpResponse, AdminDirectUploadTicketPayload,
@@ -50,15 +53,18 @@ use shared_contracts::creation_entry_config::{
     encode_unified_creation_spec_response, validate_unified_creation_spec_for_play,
 };
 use spacetime_client::{
-    AdminEditorAssetListRecordInput, AdminEditorAssetRecord,
-    EditorShowcaseAssetAdminListRecordInput, EditorShowcaseAssetAdminReviewRecordInput,
-    EditorShowcaseAssetDisplayUpdateRecordInput, EditorShowcaseAssetRecord,
-    EditorShowcaseAssetRefundMarkRecordInput, EditorShowcaseCampaignConfigGetRecordInput,
+    AdminDashboardStatsRecord, AdminDashboardStatsRecordInput, AdminEditorAssetListRecordInput,
+    AdminEditorAssetRecord, EditorShowcaseAssetAdminListRecordInput,
+    EditorShowcaseAssetAdminReviewRecordInput, EditorShowcaseAssetDisplayUpdateRecordInput,
+    EditorShowcaseAssetRecord, EditorShowcaseCampaignConfigGetRecordInput,
     EditorShowcaseCampaignConfigRecord, EditorShowcaseCampaignConfigUpsertRecordInput,
+    SpacetimeClientError,
 };
 use time::{OffsetDateTime, format_description::well_known::Rfc3339};
+use tokio::sync::{OnceCell, Semaphore};
 
 use crate::{
+    admin_accounts::normalize_admin_account_username,
     api_response::json_success_body,
     assets::{
         AssetReadAuthorization, create_direct_upload_ticket_for_owner,
@@ -75,6 +81,10 @@ use crate::{
 
 // 首版调试台只允许有限大小的请求体，避免把后台当作通用代理大包转发器。
 const MAX_DEBUG_BODY_BYTES: usize = 128 * 1024;
+const ADMIN_PASSWORD_MAX_CONCURRENT_OPERATIONS: usize = 4;
+static ADMIN_PASSWORD_OPERATION_LIMITER: Semaphore =
+    Semaphore::const_new(ADMIN_PASSWORD_MAX_CONCURRENT_OPERATIONS);
+static ADMIN_DUMMY_PASSWORD_HASH: OnceCell<String> = OnceCell::const_new();
 const BLOCKED_DEBUG_HEADERS: &[&str] = &[
     "host",
     "content-length",
@@ -98,7 +108,6 @@ const ADMIN_DASHBOARD_ROW_LIMIT: u32 = 50_000;
 const ADMIN_DASHBOARD_MAX_PERIOD_DAYS: i64 = 366;
 const ADMIN_EDITOR_ASSET_DEFAULT_LIMIT: u32 = 80;
 const ADMIN_EDITOR_ASSET_MAX_LIMIT: u32 = 200;
-const ADMIN_DASHBOARD_ACTIVE_WINDOW_MICROS: i64 = 5 * 60 * 1_000_000;
 const ADMIN_EDITOR_SHOWCASE_CAMPAIGN_IMAGE_MAX_BYTES: u64 = 20 * 1024 * 1024;
 
 #[derive(Clone, Debug)]
@@ -106,6 +115,11 @@ pub struct AuthenticatedAdmin {
     session: AdminSessionPayload,
 }
 
+#[derive(Clone, Debug, Default)]
+pub struct AdminDisplayNameDirectory {
+    display_names: BTreeMap<String, String>,
+}
+
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
 struct SpacetimeDatabaseInfoResponse {
@@ -134,6 +148,44 @@ impl AuthenticatedAdmin {
     }
 }
 
+impl AdminDisplayNameDirectory {
+    fn insert(&mut self, subject: &str, display_name: &str) {
+        let subject = subject.trim();
+        let display_name = display_name.trim();
+        if subject.is_empty() || display_name.is_empty() {
+            return;
+        }
+        self.display_names
+            .insert(subject.to_string(), display_name.to_string());
+        self.display_names
+            .insert(subject.to_ascii_lowercase(), display_name.to_string());
+    }
+
+    pub fn resolve(&self, subject: &str) -> String {
+        let subject = subject.trim();
+        self.display_names
+            .get(subject)
+            .or_else(|| self.display_names.get(&subject.to_ascii_lowercase()))
+            .cloned()
+            .unwrap_or_else(|| "已停用管理员".to_string())
+    }
+}
+
+pub async fn load_admin_display_name_directory(
+    state: &AppState,
+) -> Result<AdminDisplayNameDirectory, spacetime_client::SpacetimeClientError> {
+    let mut directory = AdminDisplayNameDirectory::default();
+    if let Some(runtime) = state.admin_runtime() {
+        directory.insert(runtime.subject(), runtime.display_name());
+        directory.insert(runtime.username(), runtime.display_name());
+    }
+    for account in state.spacetime_client().list_admin_accounts().await? {
+        directory.insert(&account.account_id, &account.display_name);
+        directory.insert(&account.username, &account.display_name);
+    }
+    Ok(directory)
+}
+
 pub async fn admin_login(
     State(state): State<AppState>,
     Extension(request_context): Extension<RequestContext>,
@@ -145,33 +197,103 @@ pub async fn admin_login(
 
     let expected_username = runtime.username().trim();
     let expected_password = runtime.password().trim();
-    let submitted_username = payload.username.trim();
-    let submitted_password = payload.password.trim();
+    let submitted_username = payload.username.trim().to_ascii_lowercase();
+    let submitted_password = payload.password.as_str();
     if expected_username.is_empty() || expected_password.is_empty() {
         return Err(
             AppError::from_status(StatusCode::SERVICE_UNAVAILABLE).with_message("后台管理未启用")
         );
     }
 
-    if submitted_username != expected_username || submitted_password != expected_password {
-        return Err(
-            AppError::from_status(StatusCode::UNAUTHORIZED).with_message("管理员用户名或密码错误")
-        );
-    }
-
     let now = OffsetDateTime::now_utc();
-    let claims = runtime.build_claims(now).map_err(|error| {
-        AppError::from_status(StatusCode::INTERNAL_SERVER_ERROR).with_message(error)
-    })?;
+    let (claims, tab_permissions) = if submitted_username == expected_username.to_ascii_lowercase()
+    {
+        if submitted_password.trim() != expected_password {
+            verify_admin_password(admin_dummy_password_hash().await?, submitted_password)
+                .await
+                .ok();
+            return Err(admin_login_rejected());
+        }
+        (
+            runtime.build_claims(now).map_err(internal_admin_error)?,
+            ADMIN_TAB_PERMISSIONS
+                .iter()
+                .map(|permission| (*permission).to_string())
+                .collect(),
+        )
+    } else {
+        let submitted_username = match normalize_admin_account_username(&submitted_username) {
+            Ok(username) => username,
+            Err(_) => {
+                verify_admin_password(admin_dummy_password_hash().await?, submitted_password)
+                    .await
+                    .ok();
+                return Err(admin_login_rejected());
+            }
+        };
+        let account = match state
+            .spacetime_client()
+            .get_admin_account_by_username(submitted_username)
+            .await
+        {
+            Ok(account) => Some(account),
+            Err(error) if is_admin_account_not_found(&error) => None,
+            Err(_) => {
+                return Err(AppError::from_status(StatusCode::SERVICE_UNAVAILABLE)
+                    .with_message("后台账号服务暂不可用"));
+            }
+        };
+        let password_hash = match account.as_ref().filter(|account| account.account.enabled) {
+            Some(account) => account.password_hash.as_str(),
+            None => admin_dummy_password_hash().await?,
+        };
+        let password_matches = verify_admin_password(password_hash, submitted_password)
+            .await
+            .unwrap_or(false);
+        let Some(account) = account.filter(|account| account.account.enabled && password_matches)
+        else {
+            return Err(admin_login_rejected());
+        };
+        let account = account.account;
+        let tab_permissions = account.tab_permissions.clone();
+        (
+            runtime
+                .build_account_claims(
+                    account.account_id,
+                    account.username,
+                    account.display_name,
+                    vec!["admin".to_string(), "member".to_string()],
+                    account.token_version,
+                    now,
+                )
+                .map_err(internal_admin_error)?,
+            tab_permissions,
+        )
+    };
     let token = runtime.sign_token(&claims).map_err(|error| {
         AppError::from_status(StatusCode::INTERNAL_SERVER_ERROR).with_message(error)
     })?;
+    let token_claims = runtime.verify_token(&token).map_err(internal_admin_error)?;
+    let session = if claims.roles.iter().any(|role| role == "owner") {
+        runtime.build_session(&claims)
+    } else {
+        runtime
+            .validate_account_claims(
+                &token_claims,
+                &claims.subject,
+                claims.token_version,
+                claims.username.clone(),
+                claims.display_name.clone(),
+                tab_permissions,
+            )
+            .map_err(internal_admin_error)?
+    };
 
     Ok(json_success_body(
         Some(&request_context),
         AdminLoginResponse {
             token,
-            admin: build_admin_session_payload(runtime.build_session(&claims)),
+            admin: build_admin_session_payload(session),
         },
     ))
 }
@@ -505,33 +627,46 @@ pub async fn admin_list_editor_assets(
         .clamp(1, ADMIN_EDITOR_ASSET_MAX_LIMIT);
     let date_range = resolve_admin_editor_asset_date_range(&query)
         .map_err(|error| AppError::from_status(StatusCode::BAD_REQUEST).with_message(error))?;
-    let mut records = state
+    let cursor = normalize_admin_optional(query.cursor);
+    validate_admin_editor_asset_cursor(cursor.as_deref())
+        .map_err(|error| AppError::from_status(StatusCode::BAD_REQUEST).with_message(error))?;
+    let Some((owner_user_id, keyword)) = resolve_admin_editor_asset_filters(
+        &state,
+        normalize_admin_optional(query.owner_user_id),
+        normalize_admin_optional(query.keyword),
+    )?
+    else {
+        return Ok(json_success_body(
+            Some(&request_context),
+            AdminEditorAssetListResponse {
+                entries: Vec::new(),
+                next_cursor: None,
+            },
+        ));
+    };
+    let records = state
         .spacetime_client()
         .admin_list_editor_assets(AdminEditorAssetListRecordInput {
             limit: page_size + 1,
-            cursor: normalize_admin_optional(query.cursor),
-            owner_user_id: normalize_admin_optional(query.owner_user_id),
-            keyword: normalize_admin_optional(query.keyword),
+            cursor,
+            owner_user_id,
+            keyword,
             created_after_micros: date_range.created_after_micros,
             created_before_micros: date_range.created_before_micros,
         })
         .await
         .map_err(map_admin_spacetime_error)?;
 
-    let next_cursor = if records.len() > page_size as usize {
-        records
-            .get(page_size.saturating_sub(1) as usize)
-            .and_then(admin_editor_asset_cursor)
-    } else {
-        None
-    };
-    records.truncate(page_size as usize);
+    let (groups, next_cursor) = paginate_admin_editor_asset_records(records, page_size as usize)
+        .map_err(|error| {
+            AppError::from_status(StatusCode::INTERNAL_SERVER_ERROR).with_message(error)
+        })?;
     Ok(json_success_body(
         Some(&request_context),
         AdminEditorAssetListResponse {
-            entries: records
+            entries: groups
                 .into_iter()
-                .map(|record| admin_editor_asset_payload_from_record(&state, record))
+                .filter_map(|records| admin_editor_asset_group_payload(&state, records))
                 .collect(),
             next_cursor,
         },
@@ -601,7 +736,6 @@ pub async fn admin_review_editor_showcase_asset(
         })
         .await
         .map_err(map_admin_spacetime_error)?;
-    let record = refund_approved_editor_showcase_asset_if_needed(&state, record).await?;
     Ok(json_success_body(
         Some(&request_context),
         AdminEditorShowcaseAssetResponse {
@@ -820,47 +954,6 @@ fn map_admin_feature_gate_config(
     }
 }
 
-async fn refund_approved_editor_showcase_asset_if_needed(
-    state: &AppState,
-    record: EditorShowcaseAssetRecord,
-) -> Result<EditorShowcaseAssetRecord, AppError> {
-    if record.review_status != "approved"
-        || record.refund_mud_points == 0
-        || record.refund_completed_at.is_some()
-    {
-        return Ok(record);
-    }
-    let Some(ledger_id) = record.refund_ledger_id.clone() else {
-        return Ok(record);
-    };
-    state
-        .spacetime_client()
-        .refund_profile_wallet_points_with_metadata(
-            record.owner_user_id.clone(),
-            record.refund_mud_points,
-            ledger_id.clone(),
-            current_utc_micros(),
-            serde_json::json!({
-                "source": "editor_showcase_approval",
-                "showcaseId": record.showcase_id,
-                "assetId": record.asset_id,
-                "generationCostMudPoints": record.generation_cost_mud_points,
-            })
-            .to_string(),
-        )
-        .await
-        .map_err(map_admin_spacetime_error)?;
-    state
-        .spacetime_client()
-        .mark_editor_showcase_asset_refunded(EditorShowcaseAssetRefundMarkRecordInput {
-            showcase_id: record.showcase_id,
-            refund_ledger_id: ledger_id,
-            updated_at_micros: current_utc_micros(),
-        })
-        .await
-        .map_err(map_admin_spacetime_error)
-}
-
 fn admin_editor_showcase_asset_payload_from_record(
     state: &AppState,
     record: EditorShowcaseAssetRecord,
@@ -1001,6 +1094,7 @@ fn admin_editor_asset_payload_from_record(
     record: AdminEditorAssetRecord,
 ) -> AdminEditorAssetPayload {
     let author = resolve_work_author_by_user_id(state, &record.owner_user_id, None, None);
+    let generator = resolve_admin_editor_asset_generator(&record);
     AdminEditorAssetPayload {
         asset_id: record.asset_id,
         owner_user_id: record.owner_user_id,
@@ -1019,6 +1113,7 @@ fn admin_editor_asset_payload_from_record(
         model: record.model,
         provider: record.provider,
         task_id: record.task_id,
+        group_task_id: record.group_task_id,
         asset_kind: record.asset_kind,
         generation_inputs: record.generation_inputs,
         source_resource_id: record.source_resource_id,
@@ -1026,52 +1121,261 @@ fn admin_editor_asset_payload_from_record(
         generation_cost_mud_points: record.generation_cost_mud_points,
         created_at: record.created_at,
         updated_at: record.updated_at,
+        task_generator: generator.clone(),
+        task_cost_mud_points: record.generation_cost_mud_points,
+        generator,
+        children: Vec::new(),
     }
 }
 
-fn admin_editor_asset_cursor(record: &AdminEditorAssetRecord) -> Option<String> {
-    let created_at_micros = parse_timestamp_text_to_micros(record.created_at.as_str())?;
-    Some(format!("{created_at_micros}:{}", record.asset_id))
+fn group_admin_editor_asset_records(
+    records: Vec<AdminEditorAssetRecord>,
+) -> Vec<Vec<AdminEditorAssetRecord>> {
+    let mut groups = Vec::<Vec<AdminEditorAssetRecord>>::new();
+    let mut indexes = BTreeMap::<String, usize>::new();
+    for record in records {
+        let key = record
+            .group_task_id
+            .as_deref()
+            .or(record.task_id.as_deref())
+            .map(str::trim)
+            .filter(|value| !value.is_empty())
+            .map(|value| format!("owner:{}:task:{value}", record.owner_user_id))
+            .unwrap_or_else(|| format!("asset:{}", record.asset_id));
+        let index = if let Some(index) = indexes.get(&key).copied() {
+            index
+        } else {
+            let index = groups.len();
+            groups.push(Vec::new());
+            indexes.insert(key, index);
+            index
+        };
+        groups[index].push(record);
+    }
+    groups
 }
 
-#[cfg(test)]
-fn matches_admin_editor_asset_keyword(
-    payload: &AdminEditorAssetPayload,
-    keyword: Option<&str>,
-) -> bool {
-    let Some(keyword) = keyword else {
-        return true;
+fn paginate_admin_editor_asset_records(
+    records: Vec<AdminEditorAssetRecord>,
+    page_size: usize,
+) -> Result<(Vec<Vec<AdminEditorAssetRecord>>, Option<String>), String> {
+    let mut groups = group_admin_editor_asset_records(records);
+    let next_cursor = if groups.len() > page_size {
+        let cursor_record = groups
+            .get(page_size.saturating_sub(1))
+            .and_then(|group| group.first())
+            .ok_or_else(|| "生成素材分页游标失败：分页末项不存在".to_string())?;
+        Some(admin_editor_asset_cursor(cursor_record)?)
+    } else {
+        None
     };
-    let haystack = [
-        payload.asset_id.as_str(),
-        payload.owner_user_id.as_str(),
-        payload.author_display_name.as_deref().unwrap_or_default(),
-        payload
-            .author_public_user_code
-            .as_deref()
-            .unwrap_or_default(),
-        payload.folder_id.as_str(),
-        payload.label.as_str(),
-        payload.asset_object_id.as_deref().unwrap_or_default(),
-        payload.image_src.as_str(),
-        payload.object_key.as_deref().unwrap_or_default(),
-        payload.source_type.as_str(),
-        payload.prompt.as_deref().unwrap_or_default(),
-        payload.actual_prompt.as_deref().unwrap_or_default(),
-        payload.model.as_deref().unwrap_or_default(),
-        payload.provider.as_deref().unwrap_or_default(),
-        payload.task_id.as_deref().unwrap_or_default(),
-        payload.asset_kind.as_deref().unwrap_or_default(),
-        payload.source_resource_id.as_deref().unwrap_or_default(),
-        payload.thumbnail_src.as_deref().unwrap_or_default(),
-    ]
-    .join(" ")
-    .to_lowercase();
-    haystack.contains(keyword)
-        || payload
-            .generation_inputs
+    groups.truncate(page_size);
+    Ok((groups, next_cursor))
+}
+
+fn admin_editor_asset_group_payload(
+    state: &AppState,
+    mut records: Vec<AdminEditorAssetRecord>,
+) -> Option<AdminEditorAssetPayload> {
+    if records.is_empty() {
+        return None;
+    }
+    let task_generator = resolve_admin_editor_asset_task_generator(records.as_slice());
+    let task_cost_mud_points = records
+        .iter()
+        .map(|record| record.generation_cost_mud_points)
+        .max()
+        .unwrap_or_default();
+    let primary = records.remove(0);
+    let mut payload = admin_editor_asset_payload_from_record(state, primary);
+    payload.task_generator = task_generator;
+    payload.task_cost_mud_points = task_cost_mud_points;
+    payload.children = records
+        .into_iter()
+        .map(|record| admin_editor_asset_payload_from_record(state, record))
+        .collect();
+    Some(payload)
+}
+
+fn resolve_admin_editor_asset_task_generator(records: &[AdminEditorAssetRecord]) -> String {
+    let paths = records
+        .iter()
+        .filter_map(|record| record.object_key.as_deref())
+        .map(str::to_ascii_lowercase)
+        .collect::<Vec<_>>();
+    if paths.iter().any(|path| path.contains("/character-images/")) {
+        return "角色生成".to_string();
+    }
+    if paths.iter().any(|path| {
+        path.contains("/ui-design-spritesheets/") || path.contains("/ui-design-assets/")
+    }) {
+        return "UI素材提取".to_string();
+    }
+    if paths.iter().any(|path| {
+        path.contains("/icon-spritesheets/") || path.contains("/icon-spritesheet-assets/")
+    }) {
+        return "图标图集生成".to_string();
+    }
+    records
+        .first()
+        .map(resolve_admin_editor_asset_generator)
+        .unwrap_or_else(|| "未知生成器".to_string())
+}
+
+fn resolve_admin_editor_asset_generator(record: &AdminEditorAssetRecord) -> String {
+    let object_key = record
+        .object_key
+        .as_deref()
+        .unwrap_or_default()
+        .to_ascii_lowercase();
+    let provider_source = object_key.contains("green-screen-source")
+        || object_key.contains("provider-source")
+        || object_key.contains("/animation/editor-character-animation/");
+    if object_key.contains("/animation/editor-character-animation/") {
+        return "角色动作视频生成".to_string();
+    }
+    if object_key.contains("/character-images/") {
+        return if provider_source {
+            "角色生图"
+        } else {
+            "角色抠图"
+        }
+        .to_string();
+    }
+    if object_key.contains("/ui-design-assets/") || object_key.contains("/icon-spritesheet-assets/")
+    {
+        return "图集拆分".to_string();
+    }
+    if object_key.contains("/ui-design-spritesheets/") {
+        return if provider_source {
+            "UI素材生成"
+        } else {
+            "UI图集抠图"
+        }
+        .to_string();
+    }
+    if object_key.contains("/icon-spritesheets/") {
+        return if provider_source {
+            "图标图集生成"
+        } else {
+            "图标图集抠图"
+        }
+        .to_string();
+    }
+    if object_key.contains("/edit-images/") {
+        return "快速编辑".to_string();
+    }
+    if object_key.contains("/spec-images/") {
+        return "规范生成".to_string();
+    }
+    if object_key.contains("/publication-materials/") {
+        return "宣发素材生成".to_string();
+    }
+    if object_key.contains("/generated-images/") {
+        return "图片生成".to_string();
+    }
+    match record.asset_kind.as_deref() {
+        Some("character-animation") => {
+            if provider_source {
+                "角色动作视频生成"
+            } else {
+                "角色动作逐帧处理"
+            }
+        }
+        Some("sound-effect") => "音效生成",
+        Some("background-music") => "背景音乐生成",
+        Some("video") => "视频生成",
+        Some("icon") => "图集拆分",
+        Some("icon-spritesheet") => "图标图集生成",
+        Some("character") => "角色生成",
+        Some("ui-design") => "UI设计生成",
+        _ => "未知生成器",
+    }
+    .to_string()
+}
+
+fn admin_editor_asset_cursor(record: &AdminEditorAssetRecord) -> Result<String, String> {
+    let created_at_micros = parse_timestamp_text_to_micros(record.created_at.as_str())
+        .ok_or_else(|| format!("素材 {} 的创建时间格式非法", record.asset_id))?;
+    Ok(format!("{created_at_micros}:{}", record.asset_id))
+}
+
+fn validate_admin_editor_asset_cursor(cursor: Option<&str>) -> Result<(), String> {
+    let Some(cursor) = cursor else {
+        return Ok(());
+    };
+    let Some((created_at_micros, asset_id)) = cursor.split_once(':') else {
+        return Err("cursor 格式非法".to_string());
+    };
+    if created_at_micros.parse::<i64>().is_err() || asset_id.trim().is_empty() {
+        return Err("cursor 格式非法".to_string());
+    }
+    Ok(())
+}
+
+fn resolve_admin_editor_asset_filters(
+    state: &AppState,
+    mut owner_user_id: Option<String>,
+    mut keyword: Option<String>,
+) -> Result<Option<(Option<String>, Option<String>)>, AppError> {
+    if let Some(public_user_code) = owner_user_id
+        .as_deref()
+        .and_then(normalize_admin_public_user_code_candidate)
+    {
+        owner_user_id = resolve_admin_editor_asset_public_user_id(state, &public_user_code)?;
+        if owner_user_id.is_none() {
+            return Ok(None);
+        }
+    }
+
+    if let Some(public_user_code) = keyword
+        .as_deref()
+        .and_then(normalize_admin_public_user_code_candidate)
+    {
+        let Some(keyword_owner_user_id) =
+            resolve_admin_editor_asset_public_user_id(state, &public_user_code)?
+        else {
+            return Ok(None);
+        };
+        if owner_user_id
             .as_ref()
-            .is_some_and(|value| value.to_string().to_lowercase().contains(keyword))
+            .is_some_and(|owner_user_id| owner_user_id != &keyword_owner_user_id)
+        {
+            return Ok(None);
+        }
+        owner_user_id = Some(keyword_owner_user_id);
+        keyword = None;
+    }
+
+    Ok(Some((owner_user_id, keyword)))
+}
+
+fn normalize_admin_public_user_code_candidate(value: &str) -> Option<String> {
+    let compact = value
+        .trim()
+        .chars()
+        .filter(|character| character.is_ascii_alphanumeric())
+        .collect::<String>()
+        .to_ascii_uppercase();
+    let digits = compact.strip_prefix("SY")?;
+    if digits.is_empty() || !digits.chars().all(|character| character.is_ascii_digit()) {
+        return None;
+    }
+    module_auth::normalize_public_user_code(value).ok()
+}
+
+fn resolve_admin_editor_asset_public_user_id(
+    state: &AppState,
+    public_user_code: &str,
+) -> Result<Option<String>, AppError> {
+    state
+        .auth_user_service()
+        .get_user_by_public_user_code(public_user_code)
+        .map(|user| user.map(|user| user.id))
+        .map_err(|error| {
+            AppError::from_status(StatusCode::BAD_GATEWAY)
+                .with_message(format!("读取素材作者认证信息失败：{error}"))
+        })
 }
 
 fn normalize_admin_optional(value: Option<String>) -> Option<String> {
@@ -1185,7 +1489,7 @@ pub async fn require_admin_auth(
     mut request: Request,
     next: Next,
 ) -> Result<Response, AppError> {
-    // 后台鉴权必须同时满足：令牌验签通过、主体匹配当前管理员、roles 含 admin。
+    // member 的启停、版本和权限以当前数据库记录为准，JWT 不承载授权真相。
     let runtime = state.admin_runtime().ok_or_else(|| {
         AppError::from_status(StatusCode::SERVICE_UNAVAILABLE).with_message("后台管理未启用")
     })?;
@@ -1193,10 +1497,49 @@ pub async fn require_admin_auth(
     let claims = runtime
         .verify_token(&bearer_token)
         .map_err(|error| AppError::from_status(StatusCode::UNAUTHORIZED).with_message(error))?;
+    if !claims.roles.iter().any(|role| role == "admin") {
+        return Err(
+            AppError::from_status(StatusCode::FORBIDDEN).with_message("当前令牌不是管理员令牌")
+        );
+    }
 
-    let admin_session = runtime
-        .validate_claims(&claims)
-        .map_err(|error| AppError::from_status(StatusCode::FORBIDDEN).with_message(error))?;
+    let admin_session = if runtime.is_owner_subject(claims.user_id()) {
+        runtime.validate_claims(&claims)
+    } else {
+        let account = state
+            .spacetime_client()
+            .get_admin_account_by_id(claims.user_id().to_string())
+            .await
+            .map_err(|error| {
+                if is_admin_account_not_found(&error) {
+                    AppError::from_status(StatusCode::UNAUTHORIZED)
+                        .with_message("后台登录状态已失效")
+                } else {
+                    AppError::from_status(StatusCode::SERVICE_UNAVAILABLE)
+                        .with_message("后台账号服务暂不可用")
+                }
+            })?;
+        if !account.enabled {
+            return Err(
+                AppError::from_status(StatusCode::UNAUTHORIZED).with_message("后台登录状态已失效")
+            );
+        }
+        runtime.validate_account_claims(
+            &claims,
+            &account.account_id,
+            account.token_version,
+            account.username,
+            account.display_name,
+            account.tab_permissions,
+        )
+    }
+    .map_err(|error| AppError::from_status(StatusCode::UNAUTHORIZED).with_message(error))?;
+    enforce_admin_request_permission(
+        &admin_session.account_role,
+        &admin_session.tab_permissions,
+        request.method(),
+        request.uri().path(),
+    )?;
 
     request
         .extensions_mut()
@@ -1206,6 +1549,137 @@ pub async fn require_admin_auth(
     Ok(next.run(request).await)
 }
 
+fn admin_login_rejected() -> AppError {
+    AppError::from_status(StatusCode::UNAUTHORIZED).with_message("管理员用户名或密码错误")
+}
+
+fn internal_admin_error(error: String) -> AppError {
+    AppError::from_status(StatusCode::INTERNAL_SERVER_ERROR).with_message(error)
+}
+
+pub(crate) async fn hash_admin_password(password: &str) -> Result<String, AppError> {
+    let _permit = ADMIN_PASSWORD_OPERATION_LIMITER
+        .acquire()
+        .await
+        .map_err(|_| {
+            AppError::from_status(StatusCode::SERVICE_UNAVAILABLE)
+                .with_message("后台密码服务暂不可用")
+        })?;
+    hash_password(password).await.map_err(|error| {
+        AppError::from_status(StatusCode::INTERNAL_SERVER_ERROR).with_message(error.to_string())
+    })
+}
+
+async fn verify_admin_password(password_hash: &str, password: &str) -> Result<bool, AppError> {
+    let _permit = ADMIN_PASSWORD_OPERATION_LIMITER
+        .acquire()
+        .await
+        .map_err(|_| {
+            AppError::from_status(StatusCode::SERVICE_UNAVAILABLE)
+                .with_message("后台密码服务暂不可用")
+        })?;
+    verify_password(password_hash, password)
+        .await
+        .map_err(|error| {
+            AppError::from_status(StatusCode::INTERNAL_SERVER_ERROR).with_message(error.to_string())
+        })
+}
+
+async fn admin_dummy_password_hash() -> Result<&'static str, AppError> {
+    ADMIN_DUMMY_PASSWORD_HASH
+        .get_or_try_init(|| async { hash_admin_password("genarrative-admin-dummy-password").await })
+        .await
+        .map(String::as_str)
+}
+
+fn is_admin_account_not_found(error: &SpacetimeClientError) -> bool {
+    matches!(
+        error,
+        SpacetimeClientError::Procedure(message) if message == "后台账号不存在"
+    )
+}
+
+enum AdminPermissionRequirement {
+    Authenticated,
+    AnyOf(&'static [&'static str]),
+    OwnerOnly,
+}
+
+fn enforce_admin_request_permission(
+    account_role: &str,
+    tab_permissions: &[String],
+    method: &Method,
+    path: &str,
+) -> Result<(), AppError> {
+    if account_role == "owner" {
+        return Ok(());
+    }
+    let requirement = admin_permission_requirement(method, path);
+    let allowed = match requirement {
+        AdminPermissionRequirement::Authenticated => true,
+        AdminPermissionRequirement::OwnerOnly => false,
+        AdminPermissionRequirement::AnyOf(required) => required
+            .iter()
+            .any(|permission| tab_permissions.iter().any(|owned| owned == permission)),
+    };
+    if allowed {
+        Ok(())
+    } else {
+        Err(AppError::from_status(StatusCode::FORBIDDEN).with_message("当前后台账号无权访问该 Tab"))
+    }
+}
+
+fn admin_permission_requirement(method: &Method, path: &str) -> AdminPermissionRequirement {
+    use AdminPermissionRequirement::{AnyOf, Authenticated, OwnerOnly};
+
+    match path {
+        "/admin/api/me" => Authenticated,
+        "/admin/api/dashboard" => AnyOf(&["dashboard"]),
+        "/admin/api/overview" => AnyOf(&["overview"]),
+        "/admin/api/debug/http" => AnyOf(&["debug"]),
+        "/admin/api/tracking/events" => AnyOf(&["tracking"]),
+        "/admin/api/tracking/event-keys" => AnyOf(&["tracking", "tasks"]),
+        "/admin/api/feature-gates" => AnyOf(&["gray-release"]),
+        "/admin/api/editor-generation-pricing" => AnyOf(&["editor-generation-pricing"]),
+        "/admin/api/editor-assets" => AnyOf(&["editor-assets"]),
+        "/admin/api/assets/read-url" => AnyOf(&["editor-assets", "editor-showcase"]),
+        path if path.starts_with("/admin/api/editor-showcase/") => AnyOf(&["editor-showcase"]),
+        "/admin/api/works/visibility" => AnyOf(&["work-visibility"]),
+        "/admin/api/profile/redeem-codes" | "/admin/api/profile/redeem-codes/disable" => {
+            AnyOf(&["redeem"])
+        }
+        "/admin/api/profile/invite-codes" => AnyOf(&["invite"]),
+        "/admin/api/profile/tasks" | "/admin/api/profile/tasks/disable" => AnyOf(&["tasks"]),
+        "/admin/api/profile/wallet-config" => AnyOf(&["profile-wallet"]),
+        "/admin/api/profile/recharge-products" => AnyOf(&["recharge-products"]),
+        path if path.starts_with("/admin/api/profile/recharge-") => AnyOf(&["recharge-orders"]),
+        "/admin/api/profile/wallet-restriction" => AnyOf(&["recharge-orders"]),
+        "/admin/api/profile/users/detail" => AnyOf(&[
+            "tables",
+            "tracking",
+            "recharge-orders",
+            "editor-showcase",
+            "editor-assets",
+            "work-visibility",
+        ]),
+        "/admin/api/creation-entry/config/banners" => AnyOf(&["creation-announcement"]),
+        "/admin/api/creation-entry/config/interactions" => AnyOf(&["creation-entry"]),
+        "/admin/api/creation-entry/config" if method == Method::GET => {
+            AnyOf(&["gray-release", "creation-announcement", "creation-entry"])
+        }
+        "/admin/api/creation-entry/config" => AnyOf(&["creation-entry"]),
+        path if path == "/admin/api/database/tables"
+            || path.starts_with("/admin/api/database/tables/") =>
+        {
+            AnyOf(&["tables"])
+        }
+        path if path == "/admin/api/accounts" || path.starts_with("/admin/api/accounts/") => {
+            OwnerOnly
+        }
+        _ => OwnerOnly,
+    }
+}
+
 fn extract_bearer_token(headers: &HeaderMap) -> Result<String, AppError> {
     let authorization = headers
         .get(AUTHORIZATION)
@@ -1354,67 +1828,53 @@ struct AdminDashboardWalletStats {
 }
 
 #[derive(Default)]
-struct AdminDashboardRegistrationStats {
+struct AdminDashboardUserStats {
+    total_registered_users: u64,
     new_registered_users: AdminDashboardSeries,
-    warnings: Vec<String>,
-}
-
-#[derive(Default)]
-struct AdminDashboardTrackingStats {
+    day1_retention: AdminDashboardRetentionPayload,
+    day7_retention: AdminDashboardRetentionPayload,
     visit_count: AdminDashboardSeries,
+    visit_users_by_day: AdminDashboardSeries,
     visit_users: u64,
     total_visit_count: u64,
     total_visit_users: u64,
     current_users: u64,
     module_visit_breakdown: BTreeMap<String, u64>,
-    warnings: Vec<String>,
+    new_user_payment_conversion: AdminDashboardPaymentConversionPayload,
 }
 
 async fn build_admin_dashboard(
     state: &AppState,
     query: AdminDashboardQuery,
 ) -> Result<AdminDashboardResponse, AppError> {
-    let range = resolve_admin_dashboard_range(query)?;
+    let now_micros = current_admin_dashboard_utc_micros();
+    let range = resolve_admin_dashboard_range_at(query, now_micros)?;
     let mut warnings = Vec::new();
 
-    let total_registered_users = match fetch_admin_dashboard_count(
-        state,
-        "SELECT COUNT(*) AS row_count FROM profile_dashboard_state",
-    )
-    .await
-    {
-        Ok(value) => value,
-        Err(message) => {
-            warnings.push(format!("注册用户总数读取失败：{message}"));
-            0
-        }
-    };
-
     let asset_stats = fetch_admin_dashboard_asset_stats(state, &range).await;
     warnings.extend(asset_stats.warnings.iter().cloned());
 
     let wallet_stats = fetch_admin_dashboard_wallet_stats(state, &range).await;
     warnings.extend(wallet_stats.warnings.iter().cloned());
 
-    let registration_stats = fetch_admin_dashboard_registration_stats(state, &range).await;
-    warnings.extend(registration_stats.warnings.iter().cloned());
-
-    let tracking_stats = fetch_admin_dashboard_tracking_stats(state, &range).await;
-    warnings.extend(tracking_stats.warnings.iter().cloned());
+    let user_stats = fetch_admin_dashboard_user_stats(state, &range, now_micros).await?;
 
     let generated_assets = asset_stats.generated_assets.total();
     let consumed_mud_points = wallet_stats.consumed_mud_points.total();
-    let new_registered_users = registration_stats.new_registered_users.total();
+    let new_registered_users = user_stats.new_registered_users.total();
     let metrics = AdminDashboardMetricsPayload {
         generated_assets,
         consumed_mud_points,
-        total_registered_users,
+        total_registered_users: user_stats.total_registered_users,
         new_registered_users,
-        visit_users: tracking_stats.visit_users,
-        total_visit_users: tracking_stats.total_visit_users,
-        visit_count: tracking_stats.visit_count.total(),
-        total_visit_count: tracking_stats.total_visit_count,
-        current_users: tracking_stats.current_users,
+        day1_retention: user_stats.day1_retention.clone(),
+        day7_retention: user_stats.day7_retention.clone(),
+        visit_users: user_stats.visit_users,
+        total_visit_users: user_stats.total_visit_users,
+        visit_count: user_stats.visit_count.total(),
+        total_visit_count: user_stats.total_visit_count,
+        current_users: user_stats.current_users,
+        new_user_payment_conversion: user_stats.new_user_payment_conversion.clone(),
     };
 
     let charts = vec![
@@ -1423,6 +1883,7 @@ async fn build_admin_dashboard(
             "生产素材",
             "个",
             &asset_stats.generated_assets,
+            asset_stats.generated_assets.total(),
             &range,
         ),
         build_admin_dashboard_chart(
@@ -1430,20 +1891,23 @@ async fn build_admin_dashboard(
             "消耗泥点",
             "泥点",
             &wallet_stats.consumed_mud_points,
+            wallet_stats.consumed_mud_points.total(),
             &range,
         ),
         build_admin_dashboard_chart(
             "visit-users",
-            "访问人数",
+            "每日访问人数",
             "人",
-            &AdminDashboardSeries::single_total(&range, tracking_stats.visit_users),
+            &user_stats.visit_users_by_day,
+            user_stats.visit_users,
             &range,
         ),
         build_admin_dashboard_chart(
             "visit-count",
             "访问次数",
             "次",
-            &tracking_stats.visit_count,
+            &user_stats.visit_count,
+            user_stats.visit_count.total(),
             &range,
         ),
     ];
@@ -1456,16 +1920,25 @@ async fn build_admin_dashboard(
             &metrics,
             wallet_stats.recharged_mud_points,
             asset_stats.asset_kind_breakdown,
-            tracking_stats.module_visit_breakdown,
+            user_stats.module_visit_breakdown,
         ),
         warnings,
-        generated_at: module_runtime::format_utc_micros(current_admin_dashboard_utc_micros()),
+        generated_at: module_runtime::format_utc_micros(now_micros),
     })
 }
 
+#[cfg(test)]
 fn resolve_admin_dashboard_range(
     query: AdminDashboardQuery,
 ) -> Result<AdminDashboardRangeResolved, AppError> {
+    resolve_admin_dashboard_range_at(query, current_admin_dashboard_utc_micros())
+}
+
+fn resolve_admin_dashboard_range_at(
+    query: AdminDashboardQuery,
+    now_micros: i64,
+) -> Result<AdminDashboardRangeResolved, AppError> {
+    let today_date_key = module_runtime::runtime_profile_beijing_day_key(now_micros);
     let granularity = match query
         .granularity
         .as_deref()
@@ -1485,7 +1958,7 @@ fn resolve_admin_dashboard_range(
         }
     };
     if matches!(granularity, AdminDashboardGranularity::Period) {
-        return resolve_admin_dashboard_period_range(query);
+        return resolve_admin_dashboard_period_range(query, today_date_key);
     }
 
     let anchor_date_key = match query
@@ -1500,12 +1973,14 @@ fn resolve_admin_dashboard_range(
                     .with_message("dashboard anchor 必须是合法 YYYY-MM-DD 日期")
             })?
         }
-        None => {
-            module_runtime::runtime_profile_beijing_day_key(current_admin_dashboard_utc_micros())
-        }
+        None => today_date_key,
     };
+    if anchor_date_key > today_date_key {
+        return Err(AppError::from_status(StatusCode::BAD_REQUEST)
+            .with_message("dashboard anchor 不能晚于今天"));
+    }
     let dimension = module_runtime::build_analytics_date_dimension_from_date_key(anchor_date_key);
-    let (start_date_key, end_date_key) = match granularity {
+    let (start_date_key, natural_end_date_key) = match granularity {
         AdminDashboardGranularity::Day => (anchor_date_key, anchor_date_key),
         AdminDashboardGranularity::Week => {
             (dimension.week_start_date_key, dimension.week_end_date_key)
@@ -1515,6 +1990,7 @@ fn resolve_admin_dashboard_range(
         }
         AdminDashboardGranularity::Period => unreachable!("period range is resolved above"),
     };
+    let end_date_key = natural_end_date_key.min(today_date_key);
     Ok(AdminDashboardRangeResolved {
         granularity,
         anchor_date_key,
@@ -1525,6 +2001,7 @@ fn resolve_admin_dashboard_range(
 
 fn resolve_admin_dashboard_period_range(
     query: AdminDashboardQuery,
+    today_date_key: i64,
 ) -> Result<AdminDashboardRangeResolved, AppError> {
     let start_date_key = parse_admin_dashboard_date_param(
         query.start_date.as_deref(),
@@ -1546,6 +2023,11 @@ fn resolve_admin_dashboard_period_range(
             )),
         );
     }
+    if start_date_key > today_date_key {
+        return Err(AppError::from_status(StatusCode::BAD_REQUEST)
+            .with_message("dashboard startDate 不能晚于今天"));
+    }
+    let end_date_key = end_date_key.min(today_date_key);
     Ok(AdminDashboardRangeResolved {
         granularity: AdminDashboardGranularity::Period,
         anchor_date_key: end_date_key,
@@ -1688,181 +2170,75 @@ async fn fetch_admin_dashboard_wallet_stats(
     stats
 }
 
-async fn fetch_admin_dashboard_registration_stats(
+async fn fetch_admin_dashboard_user_stats(
     state: &AppState,
     range: &AdminDashboardRangeResolved,
-) -> AdminDashboardRegistrationStats {
-    let mut stats = AdminDashboardRegistrationStats::default();
-    let sql = format!(
-        "SELECT created_at FROM profile_dashboard_state LIMIT {}",
-        ADMIN_DASHBOARD_ROW_LIMIT
-    );
-    let rows = match fetch_admin_dashboard_rows(state, &sql).await {
-        Ok(rows) => rows,
-        Err(message) => {
-            stats
-                .warnings
-                .push(format!("新增用户统计读取失败：{message}"));
-            return stats;
-        }
+    now_micros: i64,
+) -> Result<AdminDashboardUserStats, AppError> {
+    let input = AdminDashboardStatsRecordInput {
+        start_day_key: range.start_date_key,
+        end_day_key: range.end_date_key,
+        now_micros,
     };
-    warn_if_dashboard_rows_may_be_truncated(&mut stats.warnings, "新增用户", rows.len());
-    apply_admin_dashboard_registration_rows(&mut stats, range, rows.iter());
+    admin_dashboard_user_stats_from_result(
+        state
+            .spacetime_client()
+            .get_admin_dashboard_stats(input)
+            .await,
+    )
+}
+
+fn admin_dashboard_user_stats_from_result(
+    result: Result<AdminDashboardStatsRecord, SpacetimeClientError>,
+) -> Result<AdminDashboardUserStats, AppError> {
+    result
+        .map(admin_dashboard_user_stats_from_record)
+        .map_err(map_admin_spacetime_error)
+}
+
+fn admin_dashboard_user_stats_from_record(
+    record: AdminDashboardStatsRecord,
+) -> AdminDashboardUserStats {
+    let mut stats = AdminDashboardUserStats {
+        total_registered_users: record.total_registered_users,
+        day1_retention: AdminDashboardRetentionPayload {
+            eligible_users: record.day1_retention.eligible_users,
+            retained_users: record.day1_retention.retained_users,
+            rate_basis_points: record.day1_retention.rate_basis_points,
+        },
+        day7_retention: AdminDashboardRetentionPayload {
+            eligible_users: record.day7_retention.eligible_users,
+            retained_users: record.day7_retention.retained_users,
+            rate_basis_points: record.day7_retention.rate_basis_points,
+        },
+        visit_users: record.visit_users,
+        total_visit_count: record.total_visit_count,
+        total_visit_users: record.total_visit_users,
+        current_users: record.current_users,
+        module_visit_breakdown: record
+            .module_visit_breakdown
+            .into_iter()
+            .map(|entry| (entry.key, entry.count))
+            .collect(),
+        new_user_payment_conversion: AdminDashboardPaymentConversionPayload {
+            paid_users: record.new_user_payment_conversion.paid_users,
+            new_registered_users: record.new_user_payment_conversion.new_registered_users,
+            rate_basis_points: record.new_user_payment_conversion.rate_basis_points,
+        },
+        ..Default::default()
+    };
+    for entry in record.new_registered_users {
+        stats.new_registered_users.add(entry.day_key, entry.count);
+    }
+    for entry in record.visit_count {
+        stats.visit_count.add(entry.day_key, entry.count);
+    }
+    for entry in record.visit_users_by_day {
+        stats.visit_users_by_day.add(entry.day_key, entry.count);
+    }
     stats
 }
 
-fn apply_admin_dashboard_registration_rows<'a, I>(
-    stats: &mut AdminDashboardRegistrationStats,
-    range: &AdminDashboardRangeResolved,
-    rows: I,
-) where
-    I: IntoIterator<Item = &'a Value>,
-{
-    for row in rows {
-        let Some(columns) = row.as_array() else {
-            continue;
-        };
-        let Some(created_at_micros) = columns.first().and_then(timestamp_value_to_micros) else {
-            continue;
-        };
-        let day_key = module_runtime::runtime_profile_beijing_day_key(created_at_micros);
-        if range.contains_day_key(day_key) {
-            stats.new_registered_users.add(day_key, 1);
-        }
-    }
-}
-
-async fn fetch_admin_dashboard_tracking_stats(
-    state: &AppState,
-    range: &AdminDashboardRangeResolved,
-) -> AdminDashboardTrackingStats {
-    let mut stats = AdminDashboardTrackingStats::default();
-    let daily_sql = format!(
-        "SELECT event_key, scope_kind, scope_id, day_key, count FROM tracking_daily_stat LIMIT {}",
-        ADMIN_DASHBOARD_ROW_LIMIT
-    );
-    let daily_rows = match fetch_admin_dashboard_rows(state, &daily_sql).await {
-        Ok(rows) => rows,
-        Err(message) => {
-            stats
-                .warnings
-                .push(format!("访问聚合统计读取失败：{message}"));
-            Vec::new()
-        }
-    };
-    warn_if_dashboard_rows_may_be_truncated(&mut stats.warnings, "访问聚合", daily_rows.len());
-    let mut period_users = BTreeSet::new();
-    let mut total_users = BTreeSet::new();
-    for row in daily_rows {
-        let Some(columns) = row.as_array() else {
-            continue;
-        };
-        let scope_kind = columns
-            .get(1)
-            .and_then(tracking_scope_kind_to_string)
-            .unwrap_or_default();
-        let scope_id = columns.get(2).and_then(value_to_string).unwrap_or_default();
-        let day_key = columns.get(3).and_then(value_to_i64).unwrap_or_default();
-        let count = columns.get(4).and_then(value_to_u64).unwrap_or_default();
-        if scope_kind == "site" {
-            stats.total_visit_count = stats.total_visit_count.saturating_add(count);
-        }
-        if scope_kind == "user" && !scope_id.trim().is_empty() && scope_id != "anonymous" {
-            total_users.insert(scope_id.clone());
-        }
-        if range.contains_day_key(day_key) {
-            if scope_kind == "site" {
-                stats.visit_count.add(day_key, count);
-            }
-            if scope_kind == "user" && !scope_id.trim().is_empty() && scope_id != "anonymous" {
-                period_users.insert(scope_id);
-            }
-        }
-    }
-    stats.visit_users = period_users.len() as u64;
-    stats.total_visit_users = total_users.len() as u64;
-
-    let event_sql = format!(
-        "SELECT user_id, module_key, day_key, occurred_at FROM tracking_event WHERE day_key >= {} AND day_key <= {} LIMIT {}",
-        range.start_date_key, range.end_date_key, ADMIN_DASHBOARD_ROW_LIMIT
-    );
-    let event_rows = match fetch_admin_dashboard_rows(state, &event_sql).await {
-        Ok(rows) => rows,
-        Err(message) => {
-            stats
-                .warnings
-                .push(format!("访问明细统计读取失败：{message}"));
-            Vec::new()
-        }
-    };
-    warn_if_dashboard_rows_may_be_truncated(&mut stats.warnings, "访问明细", event_rows.len());
-    for row in event_rows {
-        let Some(columns) = row.as_array() else {
-            continue;
-        };
-        let module_key = columns
-            .get(1)
-            .and_then(value_to_string)
-            .map(|value| value.trim().to_string())
-            .filter(|value| !value.is_empty())
-            .unwrap_or_else(|| "unknown".to_string());
-        *stats.module_visit_breakdown.entry(module_key).or_insert(0) += 1;
-    }
-
-    let active_since_micros =
-        current_admin_dashboard_utc_micros().saturating_sub(ADMIN_DASHBOARD_ACTIVE_WINDOW_MICROS);
-    let active_start_day_key = module_runtime::runtime_profile_beijing_day_key(active_since_micros);
-    let active_end_day_key =
-        module_runtime::runtime_profile_beijing_day_key(current_admin_dashboard_utc_micros());
-    let current_sql = format!(
-        "SELECT user_id, occurred_at FROM tracking_event WHERE day_key >= {} AND day_key <= {} LIMIT {}",
-        active_start_day_key, active_end_day_key, ADMIN_DASHBOARD_ROW_LIMIT
-    );
-    let current_rows = match fetch_admin_dashboard_rows(state, &current_sql).await {
-        Ok(rows) => rows,
-        Err(message) => {
-            stats
-                .warnings
-                .push(format!("当前使用人数读取失败：{message}"));
-            Vec::new()
-        }
-    };
-    warn_if_dashboard_rows_may_be_truncated(
-        &mut stats.warnings,
-        "当前使用人数",
-        current_rows.len(),
-    );
-    let mut current_users = BTreeSet::new();
-    for row in current_rows {
-        let Some(columns) = row.as_array() else {
-            continue;
-        };
-        let Some(occurred_at_micros) = columns.get(1).and_then(timestamp_value_to_micros) else {
-            continue;
-        };
-        if occurred_at_micros >= active_since_micros {
-            if let Some(user_id) = columns
-                .first()
-                .and_then(value_to_string)
-                .map(|value| value.trim().to_string())
-                .filter(|value| !value.is_empty() && value != "anonymous")
-            {
-                current_users.insert(user_id);
-            }
-        }
-    }
-    stats.current_users = current_users.len() as u64;
-    stats
-}
-
-async fn fetch_admin_dashboard_count(state: &AppState, sql: &str) -> Result<u64, String> {
-    let client = Client::new();
-    let server_root = state.config.spacetime_server_url.trim_end_matches('/');
-    let database = state.config.spacetime_database.trim();
-    let token = resolve_admin_spacetime_sql_token(state);
-    fetch_spacetime_sql_count(&client, server_root, database, token.as_deref(), sql).await
-}
-
 async fn fetch_admin_dashboard_rows(state: &AppState, sql: &str) -> Result<Vec<Value>, String> {
     let client = Client::new();
     let server_root = state.config.spacetime_server_url.trim_end_matches('/');
@@ -1878,13 +2254,14 @@ fn build_admin_dashboard_chart(
     title: &str,
     unit: &str,
     series: &AdminDashboardSeries,
+    total: u64,
     range: &AdminDashboardRangeResolved,
 ) -> AdminDashboardChartPayload {
     AdminDashboardChartPayload {
         id: id.to_string(),
         title: title.to_string(),
         unit: unit.to_string(),
-        total: series.total(),
+        total,
         buckets: range
             .day_keys()
             .into_iter()
@@ -2043,12 +2420,6 @@ impl AdminDashboardSeries {
     fn total(&self) -> u64 {
         self.buckets.values().copied().sum()
     }
-
-    fn single_total(range: &AdminDashboardRangeResolved, value: u64) -> Self {
-        let mut series = Self::default();
-        series.add(range.anchor_date_key, value);
-        series
-    }
 }
 
 fn build_spacetime_schema_url(server_root: &str, database: &str) -> String {
@@ -3193,26 +3564,6 @@ fn value_to_i64(value: &Value) -> Option<i64> {
     }
 }
 
-fn value_to_u64(value: &Value) -> Option<u64> {
-    match value {
-        Value::Number(number) => number
-            .as_u64()
-            .or_else(|| number.as_i64().and_then(|value| u64::try_from(value).ok())),
-        Value::String(text) => text.trim().parse::<u64>().ok(),
-        Value::Object(object) => object.get("some").and_then(value_to_u64),
-        Value::Array(items) if items.len() == 1 => items.first().and_then(value_to_u64),
-        Value::Array(items) if items.len() == 2 => {
-            let tag = items.first().and_then(Value::as_u64)?;
-            if tag == 0 {
-                items.get(1).and_then(value_to_u64)
-            } else {
-                None
-            }
-        }
-        _ => None,
-    }
-}
-
 fn timestamp_value_to_micros(value: &Value) -> Option<i64> {
     value_to_i64(value).or_else(|| {
         let text = value_to_string(value)?;
@@ -3228,6 +3579,22 @@ fn parse_timestamp_text_to_micros(text: &str) -> Option<i64> {
     if let Ok(value) = trimmed.parse::<i64>() {
         return Some(value);
     }
+    if let Some((seconds, micros)) = trimmed
+        .strip_suffix('Z')
+        .and_then(|value| value.split_once('.'))
+    {
+        if let Ok(seconds) = seconds.parse::<i64>()
+            && !micros.is_empty()
+            && micros.len() <= 6
+            && micros.chars().all(|character| character.is_ascii_digit())
+        {
+            let micros = format!("{micros:0<6}").parse::<i128>().ok()?;
+            let value = i128::from(seconds)
+                .checked_mul(1_000_000)?
+                .checked_add(micros)?;
+            return i64::try_from(value).ok();
+        }
+    }
     OffsetDateTime::parse(trimmed, &Rfc3339)
         .ok()
         .and_then(|timestamp| i64::try_from(timestamp.unix_timestamp_nanos() / 1_000).ok())
@@ -3528,11 +3895,26 @@ fn trim_preview(text: &str) -> String {
 }
 
 fn build_admin_session_payload(session: crate::state::AdminSession) -> AdminSessionPayload {
+    let account_role = if session.account_role == "owner" {
+        AdminAccountRole::Owner
+    } else {
+        AdminAccountRole::Member
+    };
+    let tab_permissions = if account_role == AdminAccountRole::Owner {
+        ADMIN_TAB_PERMISSIONS
+            .iter()
+            .map(|permission| (*permission).to_string())
+            .collect()
+    } else {
+        session.tab_permissions
+    };
     AdminSessionPayload {
         subject: session.subject,
         username: session.username,
         display_name: session.display_name,
         roles: session.roles,
+        account_role,
+        tab_permissions,
         issued_at: session
             .issued_at
             .format(&Rfc3339)
@@ -3547,28 +3929,41 @@ fn build_admin_session_payload(session: crate::state::AdminSession) -> AdminSess
 #[cfg(test)]
 mod tests {
     use super::{
-        AdminDashboardGranularity, AdminDashboardRegistrationStats, AdminDashboardSeries,
-        EditorShowcaseAssetRecord, admin_editor_showcase_asset_payload_from_record,
-        append_spacetime_sql_response_chunk, apply_admin_dashboard_registration_rows,
-        apply_admin_database_table_filters, build_admin_asset_read_url_audit,
+        AdminDashboardGranularity, AdminDisplayNameDirectory, EditorShowcaseAssetRecord,
+        admin_dashboard_user_stats_from_record, admin_dashboard_user_stats_from_result,
+        admin_editor_asset_group_payload, admin_editor_showcase_asset_payload_from_record,
+        append_spacetime_sql_response_chunk, apply_admin_database_table_filters,
+        build_admin_asset_read_url_audit, build_admin_dashboard_chart,
         build_admin_database_table_row, build_admin_tracking_event_keys_sql,
         build_admin_tracking_events_sql, build_body_preview, build_debug_base_url,
         build_spacetime_schema_url, clamp_admin_database_table_limit,
-        clamp_admin_tracking_event_limit, finalize_admin_database_table_rows_response,
-        is_safe_spacetime_table_name, matches_admin_editor_asset_keyword, normalize_debug_path,
-        normalize_table_count_error, parse_admin_database_table_rows_sql_response,
-        parse_admin_tracking_event_keys_sql_response, parse_admin_tracking_events_sql_response,
-        parse_spacetime_sql_count_response, resolve_admin_dashboard_range,
-        resolve_admin_database_table_sql_limit, timestamp_value_to_micros, trim_preview,
+        clamp_admin_tracking_event_limit, enforce_admin_request_permission,
+        finalize_admin_database_table_rows_response, group_admin_editor_asset_records,
+        hash_admin_password, is_admin_account_not_found, is_safe_spacetime_table_name,
+        normalize_debug_path, normalize_table_count_error, paginate_admin_editor_asset_records,
+        parse_admin_database_table_rows_sql_response, parse_admin_tracking_event_keys_sql_response,
+        parse_admin_tracking_events_sql_response, parse_spacetime_sql_count_response,
+        parse_timestamp_text_to_micros, resolve_admin_dashboard_range,
+        resolve_admin_dashboard_range_at, resolve_admin_database_table_sql_limit,
+        resolve_admin_editor_asset_filters, timestamp_value_to_micros, trim_preview,
+        validate_admin_editor_asset_cursor, verify_admin_password,
         wallet_ledger_source_type_to_string,
     };
-    use axum::{http::StatusCode, response::IntoResponse};
+    use axum::{
+        http::{Method, StatusCode},
+        response::IntoResponse,
+    };
     use serde_json::json;
     use shared_contracts::admin::{
-        AdminDashboardQuery, AdminDatabaseTableRowsQuery, AdminEditorAssetPayload,
-        AdminTrackingEventListQuery,
+        AdminDashboardQuery, AdminDatabaseTableRowsQuery, AdminTrackingEventListQuery,
     };
     use shared_contracts::assets::GetReadUrlQuery;
+    use spacetime_client::{
+        AdminDashboardBreakdownRecord, AdminDashboardDailyCountRecord,
+        AdminDashboardPaymentConversionRecord, AdminDashboardRetentionRecord,
+        AdminDashboardStatsRecord, AdminEditorAssetRecord, SpacetimeClientError,
+        SpacetimeClientStage,
+    };
 
     use crate::{config::AppConfig, state::AppState};
 
@@ -3612,6 +4007,40 @@ mod tests {
         }
     }
 
+    fn test_admin_editor_asset_record(
+        asset_id: &str,
+        task_id: &str,
+        label: &str,
+        object_key: &str,
+        generation_cost_mud_points: u64,
+    ) -> AdminEditorAssetRecord {
+        AdminEditorAssetRecord {
+            asset_id: asset_id.to_string(),
+            owner_user_id: "user-1".to_string(),
+            folder_id: "project".to_string(),
+            label: label.to_string(),
+            asset_object_id: Some(format!("object-{asset_id}")),
+            image_src: format!("/{object_key}"),
+            object_key: Some(object_key.to_string()),
+            width: 512,
+            height: 512,
+            source_type: "generated".to_string(),
+            prompt: Some(label.to_string()),
+            actual_prompt: None,
+            model: Some("gpt-image-2".to_string()),
+            provider: Some("VectorEngine".to_string()),
+            task_id: Some(task_id.to_string()),
+            group_task_id: None,
+            asset_kind: Some("character".to_string()),
+            generation_inputs: None,
+            source_resource_id: None,
+            thumbnail_src: None,
+            generation_cost_mud_points,
+            created_at: "2026-07-04T10:00:00Z".to_string(),
+            updated_at: "2026-07-04T10:00:00Z".to_string(),
+        }
+    }
+
     #[test]
     fn admin_asset_read_url_audit_keeps_actor_and_target_without_signed_url() {
         let draft = build_admin_asset_read_url_audit(
@@ -3657,44 +4086,214 @@ mod tests {
     }
 
     #[test]
-    fn admin_editor_asset_keyword_matches_public_author_prompt_and_generation_inputs() {
-        let payload = AdminEditorAssetPayload {
-            asset_id: "asset-1".to_string(),
-            owner_user_id: "user-1".to_string(),
-            author_display_name: Some("作者昵称".to_string()),
-            author_public_user_code: Some("SY-00000042".to_string()),
-            folder_id: "folder-1".to_string(),
-            label: "角色形象".to_string(),
-            asset_object_id: Some("asset-object-1".to_string()),
-            image_src: "/generated-character-drafts/editor/spec.png".to_string(),
-            object_key: Some("generated-character-drafts/editor/spec.png".to_string()),
-            width: 1024,
-            height: 1024,
-            source_type: "generated".to_string(),
-            prompt: Some("完整提示词内容".to_string()),
-            actual_prompt: None,
-            model: Some("gpt-image-2".to_string()),
-            provider: Some("character".to_string()),
-            task_id: Some("task-1".to_string()),
-            asset_kind: Some("character".to_string()),
-            generation_inputs: Some(json!({"style": "clay"})),
-            source_resource_id: Some("resource-1".to_string()),
-            thumbnail_src: None,
-            generation_cost_mud_points: 12,
-            created_at: "2026-07-04T10:00:00Z".to_string(),
-            updated_at: "2026-07-04T10:00:00Z".to_string(),
-        };
+    fn admin_editor_asset_group_nests_each_intermediate_output_under_final_asset() {
+        let final_output = test_admin_editor_asset_record(
+            "asset-final",
+            "task-1",
+            "角色抠图结果",
+            "generated-character-drafts/editor/character-images/character-task-1.png",
+            0,
+        );
+        let provider_source = test_admin_editor_asset_record(
+            "asset-source",
+            "task-1",
+            "角色生成原图",
+            "generated-character-drafts/editor/character-images/character-provider-source-task-1.png",
+            9,
+        );
+        let mut other_task = test_admin_editor_asset_record(
+            "asset-other",
+            "task-1",
+            "其他素材",
+            "generated-images/editor/image-task-1.png",
+            3,
+        );
+        other_task.owner_user_id = "user-2".to_string();
 
-        assert!(matches_admin_editor_asset_keyword(
-            &payload,
-            Some("sy-00000042")
-        ));
-        assert!(matches_admin_editor_asset_keyword(&payload, Some("提示词")));
-        assert!(matches_admin_editor_asset_keyword(&payload, Some("clay")));
-        assert!(!matches_admin_editor_asset_keyword(
-            &payload,
-            Some("不存在的素材")
-        ));
+        let mut groups =
+            group_admin_editor_asset_records(vec![final_output, provider_source, other_task]);
+        assert_eq!(groups.len(), 2);
+        assert_eq!(groups[0].len(), 2);
+
+        let state = AppState::new(AppConfig::default()).expect("state should build");
+        let payload = admin_editor_asset_group_payload(&state, groups.remove(0))
+            .expect("group payload should exist");
+
+        assert_eq!(payload.asset_id, "asset-final");
+        assert_eq!(payload.task_generator, "角色生成");
+        assert_eq!(payload.task_cost_mud_points, 9);
+        assert_eq!(payload.generation_cost_mud_points, 0);
+        assert_eq!(payload.children.len(), 1);
+        assert_eq!(payload.children[0].asset_id, "asset-source");
+        assert_eq!(payload.children[0].asset_kind.as_deref(), Some("character"));
+        assert_eq!(payload.children[0].generator, "角色生图");
+        assert_eq!(payload.children[0].generation_cost_mud_points, 9);
+    }
+
+    #[test]
+    fn admin_editor_asset_group_uses_group_task_id_without_hiding_operation_task_id() {
+        let final_output = test_admin_editor_asset_record(
+            "asset-final",
+            "vector-engine-source-task-1",
+            "图标素材图集",
+            "generated-icon-spritesheets/editor/spritesheet-task-1.png",
+            9,
+        );
+        let mut manual_slice = test_admin_editor_asset_record(
+            "asset-slice",
+            "editor-atlas-split-operation-1",
+            "素材 1",
+            "generated-icon-spritesheet-assets/editor/slice-1.png",
+            0,
+        );
+        manual_slice.group_task_id = Some("vector-engine-source-task-1".to_string());
+
+        let mut groups = group_admin_editor_asset_records(vec![final_output, manual_slice]);
+        assert_eq!(groups.len(), 1);
+
+        let state = AppState::new(AppConfig::default()).expect("state should build");
+        let payload = admin_editor_asset_group_payload(&state, groups.remove(0))
+            .expect("group payload should exist");
+
+        assert_eq!(
+            payload.task_id.as_deref(),
+            Some("vector-engine-source-task-1")
+        );
+        assert_eq!(payload.children.len(), 1);
+        assert_eq!(
+            payload.children[0].task_id.as_deref(),
+            Some("editor-atlas-split-operation-1")
+        );
+        assert_eq!(
+            payload.children[0].group_task_id.as_deref(),
+            Some("vector-engine-source-task-1")
+        );
+    }
+
+    #[test]
+    fn admin_editor_asset_filters_resolve_public_user_code_before_querying_assets() {
+        let state = AppState::new(AppConfig::default()).expect("state should build");
+        state
+            .auth_user_service()
+            .ensure_orphan_work_owner_user("user-author-42", "author-42", "作者昵称", "SY-00000042")
+            .expect("author should be inserted");
+        state
+            .auth_user_service()
+            .ensure_orphan_work_owner_user("user-author-43", "author-43", "另一作者", "SY-00000043")
+            .expect("second author should be inserted");
+
+        let owner_filter = resolve_admin_editor_asset_filters(
+            &state,
+            Some("SY-00000042".to_string()),
+            Some("角色".to_string()),
+        )
+        .expect("owner filter should resolve")
+        .expect("owner should exist");
+        assert_eq!(owner_filter.0.as_deref(), Some("user-author-42"));
+        assert_eq!(owner_filter.1.as_deref(), Some("角色"));
+
+        let keyword_filter =
+            resolve_admin_editor_asset_filters(&state, None, Some("sy00000042".to_string()))
+                .expect("keyword filter should resolve")
+                .expect("owner should exist");
+        assert_eq!(keyword_filter.0.as_deref(), Some("user-author-42"));
+        assert_eq!(keyword_filter.1, None);
+
+        let matching_filters = resolve_admin_editor_asset_filters(
+            &state,
+            Some("user-author-42".to_string()),
+            Some("SY-00000042".to_string()),
+        )
+        .expect("matching filters should resolve")
+        .expect("matching author should exist");
+        assert_eq!(matching_filters.0.as_deref(), Some("user-author-42"));
+        assert_eq!(matching_filters.1, None);
+
+        assert_eq!(
+            resolve_admin_editor_asset_filters(
+                &state,
+                Some("user-author-42".to_string()),
+                Some("SY-00000043".to_string()),
+            )
+            .expect("conflicting filters should resolve to an empty query"),
+            None
+        );
+
+        assert_eq!(
+            resolve_admin_editor_asset_filters(&state, None, Some("SY-00009999".to_string()),)
+                .expect("missing author should produce an empty query"),
+            None
+        );
+        assert_eq!(
+            resolve_admin_editor_asset_filters(&state, Some("SY-00009999".to_string()), None,)
+                .expect("missing owner should produce an empty query"),
+            None
+        );
+    }
+
+    #[test]
+    fn admin_editor_asset_cursor_accepts_shared_seconds_micros_timestamp() {
+        let mut record = test_admin_editor_asset_record(
+            "asset-page-end",
+            "task-page-end",
+            "分页末项",
+            "generated-images/editor/page-end.png",
+            3,
+        );
+        record.created_at = "1784087532.408003Z".to_string();
+
+        assert_eq!(
+            super::admin_editor_asset_cursor(&record).expect("cursor should build"),
+            "1784087532408003:asset-page-end"
+        );
+        assert_eq!(
+            parse_timestamp_text_to_micros("2026-07-15T11:52:12+08:00"),
+            Some(1_784_087_532_000_000)
+        );
+        assert_eq!(
+            parse_timestamp_text_to_micros("-9223372036855.224192Z"),
+            Some(i64::MIN)
+        );
+
+        record.created_at = "invalid-timestamp".to_string();
+        assert!(super::admin_editor_asset_cursor(&record).is_err());
+    }
+
+    #[test]
+    fn admin_editor_asset_cursor_rejects_malformed_input_instead_of_repeating_first_page() {
+        assert!(validate_admin_editor_asset_cursor(None).is_ok());
+        assert!(validate_admin_editor_asset_cursor(Some("123:asset-1")).is_ok());
+        assert!(validate_admin_editor_asset_cursor(Some("invalid")).is_err());
+        assert!(validate_admin_editor_asset_cursor(Some("abc:asset-1")).is_err());
+        assert!(validate_admin_editor_asset_cursor(Some("123: ")).is_err());
+    }
+
+    #[test]
+    fn admin_editor_asset_page_returns_cursor_for_eighty_first_task() {
+        let mut records = (0..81)
+            .map(|index| {
+                test_admin_editor_asset_record(
+                    format!("asset-{index}").as_str(),
+                    format!("task-{index}").as_str(),
+                    format!("素材 {index}").as_str(),
+                    format!("generated-images/editor/{index}.png").as_str(),
+                    3,
+                )
+            })
+            .collect::<Vec<_>>();
+        records[79].created_at = "1784087532.408003Z".to_string();
+
+        let (groups, next_cursor) =
+            paginate_admin_editor_asset_records(records, 80).expect("page should build");
+
+        assert_eq!(groups.len(), 80);
+        assert_eq!(next_cursor.as_deref(), Some("1784087532408003:asset-79"));
+        assert!(
+            groups
+                .iter()
+                .flatten()
+                .all(|record| record.asset_id != "asset-80")
+        );
     }
 
     #[test]
@@ -3927,29 +4526,131 @@ mod tests {
     }
 
     #[test]
-    fn apply_admin_dashboard_registration_rows_counts_created_accounts_in_range() {
-        let range = resolve_admin_dashboard_range(AdminDashboardQuery {
-            granularity: Some("period".to_string()),
-            start_date: Some("2026-06-10".to_string()),
-            end_date: Some("2026-06-18".to_string()),
-            ..Default::default()
-        })
-        .expect("period range should resolve");
-        let rows = vec![
-            json!(["2026-06-09T15:59:59Z"]),
-            json!(["2026-06-10T00:30:00Z"]),
-            json!(["2026-06-18T15:59:59Z"]),
-            json!(["2026-06-18T16:00:00Z"]),
-            json!(["bad-timestamp"]),
-        ];
-        let mut stats = AdminDashboardRegistrationStats {
-            new_registered_users: AdminDashboardSeries::default(),
-            warnings: Vec::new(),
+    fn dashboard_user_stats_maps_authoritative_projection() {
+        let stats = admin_dashboard_user_stats_from_record(AdminDashboardStatsRecord {
+            total_registered_users: 591,
+            new_registered_users: vec![AdminDashboardDailyCountRecord {
+                day_key: 100,
+                count: 3,
+            }],
+            visit_count: vec![AdminDashboardDailyCountRecord {
+                day_key: 100,
+                count: 50_001,
+            }],
+            visit_users_by_day: vec![AdminDashboardDailyCountRecord {
+                day_key: 100,
+                count: 335,
+            }],
+            visit_users: 335,
+            total_visit_count: 70_005,
+            total_visit_users: 410,
+            current_users: 2,
+            day1_retention: AdminDashboardRetentionRecord {
+                eligible_users: 100,
+                retained_users: 37,
+                rate_basis_points: 3_700,
+            },
+            day7_retention: AdminDashboardRetentionRecord {
+                eligible_users: 80,
+                retained_users: 16,
+                rate_basis_points: 2_000,
+            },
+            module_visit_breakdown: vec![AdminDashboardBreakdownRecord {
+                key: "profile".to_string(),
+                count: 50_001,
+            }],
+            new_user_payment_conversion: AdminDashboardPaymentConversionRecord {
+                paid_users: 12,
+                new_registered_users: 30,
+                rate_basis_points: 4_000,
+            },
+        });
+
+        assert_eq!(stats.total_registered_users, 591);
+        assert_eq!(stats.visit_count.total(), 50_001);
+        assert_eq!(stats.total_visit_count, 70_005);
+        assert_eq!(stats.total_visit_users, 410);
+        assert_eq!(stats.day1_retention.rate_basis_points, 3_700);
+        assert_eq!(stats.module_visit_breakdown["profile"], 50_001);
+        assert_eq!(stats.new_user_payment_conversion.paid_users, 12);
+        assert_eq!(stats.new_user_payment_conversion.new_registered_users, 30);
+        assert_eq!(stats.new_user_payment_conversion.rate_basis_points, 4_000);
+    }
+
+    #[test]
+    fn dashboard_user_stats_failure_is_not_converted_to_zero_values() {
+        let error = match admin_dashboard_user_stats_from_result(Err(
+            SpacetimeClientError::Timeout(SpacetimeClientStage::ProcedureResult),
+        )) {
+            Ok(_) => panic!("failed authoritative stats must fail the dashboard request"),
+            Err(error) => error,
         };
 
-        apply_admin_dashboard_registration_rows(&mut stats, &range, rows.iter());
+        assert_eq!(error.into_response().status(), StatusCode::BAD_GATEWAY);
+    }
 
-        assert_eq!(stats.new_registered_users.total(), 2);
+    #[test]
+    fn dashboard_current_ranges_stop_at_beijing_today() {
+        const DAY_MICROS: i64 = 86_400_000_000;
+        let today = module_runtime::parse_analytics_calendar_date_key("2026-07-14").unwrap();
+        let now_micros = today * DAY_MICROS;
+        let month = resolve_admin_dashboard_range_at(
+            AdminDashboardQuery {
+                granularity: Some("month".to_string()),
+                anchor: Some("2026-07-14".to_string()),
+                ..Default::default()
+            },
+            now_micros,
+        )
+        .expect("current month should resolve");
+        let period = resolve_admin_dashboard_range_at(
+            AdminDashboardQuery {
+                granularity: Some("period".to_string()),
+                start_date: Some("2026-07-01".to_string()),
+                end_date: Some("2026-07-31".to_string()),
+                ..Default::default()
+            },
+            now_micros,
+        )
+        .expect("current period should clamp");
+
+        assert_eq!(month.end_date_key, today);
+        assert_eq!(period.end_date_key, today);
+        assert_eq!(month.day_keys().len(), 14);
+        assert_eq!(period.day_keys().len(), 14);
+    }
+
+    #[test]
+    fn dashboard_daily_visit_chart_keeps_period_unique_total() {
+        let range = resolve_admin_dashboard_range_at(
+            AdminDashboardQuery {
+                granularity: Some("period".to_string()),
+                start_date: Some("2026-07-01".to_string()),
+                end_date: Some("2026-07-02".to_string()),
+                ..Default::default()
+            },
+            module_runtime::parse_analytics_calendar_date_key("2026-07-03").unwrap()
+                * 86_400_000_000,
+        )
+        .expect("period should resolve");
+        let mut daily_users = super::AdminDashboardSeries::default();
+        daily_users.add(range.start_date_key, 3);
+        daily_users.add(range.end_date_key, 2);
+
+        let chart = build_admin_dashboard_chart(
+            "visit-users",
+            "每日访问人数",
+            "人",
+            &daily_users,
+            4,
+            &range,
+        );
+
+        assert_eq!(chart.total, 4);
+        assert_eq!(
+            chart.buckets.iter().map(|bucket| bucket.value).sum::<u64>(),
+            5
+        );
     }
 
     #[test]
@@ -4506,4 +5207,180 @@ mod tests {
 
         assert_eq!(preview, "后台测试");
     }
+
+    #[test]
+    fn admin_display_name_directory_never_exposes_internal_subject() {
+        let mut directory = AdminDisplayNameDirectory::default();
+        directory.insert("admin:owner", "后台负责人");
+        directory.insert("admin-account-member-1", "兑换码运营");
+        directory.insert("operator", "运营一组");
+
+        assert_eq!(directory.resolve("admin:owner"), "后台负责人");
+        assert_eq!(directory.resolve("admin-account-member-1"), "兑换码运营");
+        assert_eq!(directory.resolve(" Operator "), "运营一组");
+        assert_eq!(directory.resolve("admin-account-missing"), "已停用管理员");
+    }
+
+    #[tokio::test]
+    async fn admin_password_helpers_hash_and_verify_off_executor() {
+        let hash = hash_admin_password("member-password")
+            .await
+            .expect("password should hash");
+
+        assert!(
+            verify_admin_password(&hash, "member-password")
+                .await
+                .expect("password should verify")
+        );
+        assert!(
+            !verify_admin_password(&hash, "wrong-password")
+                .await
+                .expect("wrong password should compare")
+        );
+    }
+
+    #[test]
+    fn only_exact_admin_account_absence_invalidates_member_session() {
+        assert!(is_admin_account_not_found(
+            &SpacetimeClientError::Procedure("后台账号不存在".to_string())
+        ));
+        assert!(!is_admin_account_not_found(&SpacetimeClientError::Timeout(
+            SpacetimeClientStage::ProcedureResult
+        )));
+        assert!(!is_admin_account_not_found(
+            &SpacetimeClientError::ConnectDropped
+        ));
+        assert!(!is_admin_account_not_found(
+            &SpacetimeClientError::Procedure("后台账号不存在：依赖异常".to_string())
+        ));
+    }
+
+    #[test]
+    fn admin_tab_permissions_cover_shared_and_sensitive_routes() {
+        assert!(
+            enforce_admin_request_permission(
+                "member",
+                &["tasks".to_string()],
+                &Method::GET,
+                "/admin/api/tracking/event-keys",
+            )
+            .is_ok()
+        );
+        assert!(
+            enforce_admin_request_permission(
+                "member",
+                &["tracking".to_string()],
+                &Method::POST,
+                "/admin/api/profile/wallet-restriction",
+            )
+            .is_err()
+        );
+        assert!(
+            enforce_admin_request_permission(
+                "member",
+                &["creation-announcement".to_string()],
+                &Method::GET,
+                "/admin/api/creation-entry/config",
+            )
+            .is_ok()
+        );
+        assert!(
+            enforce_admin_request_permission(
+                "member",
+                &["creation-announcement".to_string()],
+                &Method::POST,
+                "/admin/api/creation-entry/config",
+            )
+            .is_err()
+        );
+    }
+
+    #[test]
+    fn every_assignable_admin_tab_has_a_backend_route() {
+        let cases = [
+            ("dashboard", Method::GET, "/admin/api/dashboard"),
+            ("overview", Method::GET, "/admin/api/overview"),
+            ("tables", Method::GET, "/admin/api/database/tables"),
+            ("debug", Method::POST, "/admin/api/debug/http"),
+            ("tracking", Method::GET, "/admin/api/tracking/events"),
+            ("gray-release", Method::GET, "/admin/api/feature-gates"),
+            ("redeem", Method::GET, "/admin/api/profile/redeem-codes"),
+            ("invite", Method::GET, "/admin/api/profile/invite-codes"),
+            (
+                "profile-wallet",
+                Method::GET,
+                "/admin/api/profile/wallet-config",
+            ),
+            ("tasks", Method::GET, "/admin/api/profile/tasks"),
+            (
+                "recharge-products",
+                Method::GET,
+                "/admin/api/profile/recharge-products",
+            ),
+            (
+                "recharge-orders",
+                Method::GET,
+                "/admin/api/profile/recharge-orders",
+            ),
+            (
+                "editor-generation-pricing",
+                Method::GET,
+                "/admin/api/editor-generation-pricing",
+            ),
+            (
+                "editor-showcase",
+                Method::GET,
+                "/admin/api/editor-showcase/assets",
+            ),
+            ("editor-assets", Method::GET, "/admin/api/editor-assets"),
+            (
+                "creation-announcement",
+                Method::POST,
+                "/admin/api/creation-entry/config/banners",
+            ),
+            (
+                "creation-entry",
+                Method::POST,
+                "/admin/api/creation-entry/config",
+            ),
+            (
+                "work-visibility",
+                Method::GET,
+                "/admin/api/works/visibility",
+            ),
+        ];
+
+        for (permission, method, path) in cases {
+            assert!(
+                enforce_admin_request_permission(
+                    "member",
+                    &[permission.to_string()],
+                    &method,
+                    path,
+                )
+                .is_ok(),
+                "{permission} should authorize {method} {path}"
+            );
+        }
+    }
+
+    #[test]
+    fn unknown_admin_routes_are_owner_only() {
+        assert!(enforce_admin_request_permission(
+            "owner",
+            &[],
+            &Method::GET,
+            "/admin/api/future-route",
+        )
+        .is_ok());
+        assert!(
+            enforce_admin_request_permission(
+                "member",
+                &["dashboard".to_string()],
+                &Method::GET,
+                "/admin/api/future-route",
+            )
+            .is_err()
+        );
+    }
 }
diff --git a/server-rs/crates/api-server/src/admin_accounts.rs b/server-rs/crates/api-server/src/admin_accounts.rs
new file mode 100644
index 000000000..95bbe864e
--- /dev/null
+++ b/server-rs/crates/api-server/src/admin_accounts.rs
@@ -0,0 +1,283 @@
+use axum::{
+    Json,
+    extract::{Extension, Path, State},
+    http::StatusCode,
+};
+use serde_json::Value;
+use shared_contracts::admin::{
+    ADMIN_TAB_PERMISSIONS, AdminAccountListResponse, AdminAccountPayload, AdminAccountRole,
+    AdminCreateAccountRequest, AdminCreateAccountResponse, AdminUpdateAccountRequest,
+    AdminUpdateAccountResponse,
+};
+use spacetime_client::{
+    AdminAccountCreateRecordInput, AdminAccountRecord, AdminAccountUpdateRecordInput,
+    SpacetimeClientError,
+};
+use uuid::Uuid;
+
+use crate::{
+    admin::{AuthenticatedAdmin, hash_admin_password},
+    api_response::json_success_body,
+    http_error::AppError,
+    request_context::RequestContext,
+    state::AppState,
+};
+
+const ADMIN_USERNAME_MIN_CHARS: usize = 3;
+const ADMIN_USERNAME_MAX_CHARS: usize = 64;
+const ADMIN_DISPLAY_NAME_MAX_CHARS: usize = 64;
+const ADMIN_PASSWORD_MIN_CHARS: usize = 6;
+const ADMIN_PASSWORD_MAX_CHARS: usize = 128;
+
+pub async fn admin_list_accounts(
+    State(state): State<AppState>,
+    Extension(request_context): Extension<RequestContext>,
+) -> Result<Json<Value>, AppError> {
+    let runtime = state.admin_runtime().ok_or_else(|| {
+        AppError::from_status(StatusCode::SERVICE_UNAVAILABLE).with_message("后台管理未启用")
+    })?;
+    let mut accounts = vec![AdminAccountPayload {
+        account_id: runtime.subject().to_string(),
+        username: runtime.username().to_string(),
+        display_name: runtime.display_name().to_string(),
+        account_role: AdminAccountRole::Owner,
+        tab_permissions: ADMIN_TAB_PERMISSIONS
+            .iter()
+            .map(|permission| (*permission).to_string())
+            .collect(),
+        enabled: true,
+        token_version: 1,
+        created_by: "environment".to_string(),
+        updated_by: "environment".to_string(),
+        created_at: String::new(),
+        updated_at: String::new(),
+    }];
+    accounts.extend(
+        state
+            .spacetime_client()
+            .list_admin_accounts()
+            .await
+            .map_err(map_admin_account_error)?
+            .into_iter()
+            .map(admin_account_payload),
+    );
+    Ok(json_success_body(
+        Some(&request_context),
+        AdminAccountListResponse { accounts },
+    ))
+}
+
+pub async fn admin_create_account(
+    State(state): State<AppState>,
+    Extension(request_context): Extension<RequestContext>,
+    Extension(admin): Extension<AuthenticatedAdmin>,
+    Json(payload): Json<AdminCreateAccountRequest>,
+) -> Result<Json<Value>, AppError> {
+    require_owner(&admin)?;
+    let username = normalize_admin_account_username(&payload.username)?;
+    let owner_username = state
+        .admin_runtime()
+        .map(|runtime| runtime.username().trim().to_ascii_lowercase())
+        .unwrap_or_default();
+    if username == owner_username {
+        return Err(AppError::from_status(StatusCode::CONFLICT).with_message("后台用户名已存在"));
+    }
+    let display_name = normalize_display_name(&payload.display_name)?;
+    validate_password(&payload.password)?;
+    let tab_permissions = normalize_tab_permissions(payload.tab_permissions)?;
+    let password_hash = hash_admin_password(&payload.password).await?;
+
+    let account = state
+        .spacetime_client()
+        .create_admin_account(AdminAccountCreateRecordInput {
+            account_id: format!("admin-account-{}", Uuid::new_v4()),
+            username,
+            display_name,
+            password_hash,
+            tab_permissions,
+            enabled: payload.enabled,
+            created_by: admin.session().subject.clone(),
+        })
+        .await
+        .map_err(map_admin_account_error)?;
+
+    Ok(json_success_body(
+        Some(&request_context),
+        AdminCreateAccountResponse {
+            account: admin_account_payload(account),
+        },
+    ))
+}
+
+pub async fn admin_update_account(
+    State(state): State<AppState>,
+    Path(account_id): Path<String>,
+    Extension(request_context): Extension<RequestContext>,
+    Extension(admin): Extension<AuthenticatedAdmin>,
+    Json(payload): Json<AdminUpdateAccountRequest>,
+) -> Result<Json<Value>, AppError> {
+    require_owner(&admin)?;
+    let account_id = account_id.trim().to_string();
+    if account_id.is_empty() {
+        return Err(
+            AppError::from_status(StatusCode::BAD_REQUEST).with_message("后台账号 ID 不能为空")
+        );
+    }
+    if state
+        .admin_runtime()
+        .is_some_and(|runtime| runtime.subject() == account_id.as_str())
+    {
+        return Err(
+            AppError::from_status(StatusCode::FORBIDDEN).with_message("owner 账号不能通过后台修改")
+        );
+    }
+    let display_name = normalize_display_name(&payload.display_name)?;
+    let tab_permissions = normalize_tab_permissions(payload.tab_permissions)?;
+    let password_hash = match payload.password {
+        Some(password) => {
+            validate_password(&password)?;
+            Some(hash_admin_password(&password).await?)
+        }
+        None => None,
+    };
+
+    let account = state
+        .spacetime_client()
+        .update_admin_account(AdminAccountUpdateRecordInput {
+            account_id,
+            display_name,
+            password_hash,
+            tab_permissions,
+            enabled: payload.enabled,
+            updated_by: admin.session().subject.clone(),
+        })
+        .await
+        .map_err(map_admin_account_error)?;
+
+    Ok(json_success_body(
+        Some(&request_context),
+        AdminUpdateAccountResponse {
+            account: admin_account_payload(account),
+        },
+    ))
+}
+
+fn require_owner(admin: &AuthenticatedAdmin) -> Result<(), AppError> {
+    if admin.session().account_role == AdminAccountRole::Owner {
+        return Ok(());
+    }
+    Err(AppError::from_status(StatusCode::FORBIDDEN).with_message("仅 owner 可管理后台账号"))
+}
+
+pub(crate) fn normalize_admin_account_username(raw: &str) -> Result<String, AppError> {
+    let username = raw.trim().to_ascii_lowercase();
+    let char_count = username.chars().count();
+    if !(ADMIN_USERNAME_MIN_CHARS..=ADMIN_USERNAME_MAX_CHARS).contains(&char_count)
+        || !username
+            .bytes()
+            .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'.' | b'_' | b'-'))
+    {
+        return Err(
+            AppError::from_status(StatusCode::BAD_REQUEST).with_message("后台用户名格式无效")
+        );
+    }
+    Ok(username)
+}
+
+fn normalize_display_name(raw: &str) -> Result<String, AppError> {
+    let display_name = raw.trim().to_string();
+    if display_name.is_empty() || display_name.chars().count() > ADMIN_DISPLAY_NAME_MAX_CHARS {
+        return Err(
+            AppError::from_status(StatusCode::BAD_REQUEST).with_message("后台显示名称格式无效")
+        );
+    }
+    Ok(display_name)
+}
+
+fn validate_password(password: &str) -> Result<(), AppError> {
+    let char_count = password.chars().count();
+    if !(ADMIN_PASSWORD_MIN_CHARS..=ADMIN_PASSWORD_MAX_CHARS).contains(&char_count) {
+        return Err(AppError::from_status(StatusCode::BAD_REQUEST)
+            .with_message("后台密码长度必须为 6 至 128 个字符"));
+    }
+    Ok(())
+}
+
+fn normalize_tab_permissions(permissions: Vec<String>) -> Result<Vec<String>, AppError> {
+    let requested = permissions
+        .into_iter()
+        .map(|permission| permission.trim().to_string())
+        .collect::<std::collections::HashSet<_>>();
+    if requested
+        .iter()
+        .any(|permission| !ADMIN_TAB_PERMISSIONS.contains(&permission.as_str()))
+    {
+        return Err(
+            AppError::from_status(StatusCode::BAD_REQUEST).with_message("后台 Tab 权限包含未知值")
+        );
+    }
+    Ok(ADMIN_TAB_PERMISSIONS
+        .iter()
+        .filter(|permission| requested.contains(**permission))
+        .map(|permission| (*permission).to_string())
+        .collect())
+}
+
+fn admin_account_payload(account: AdminAccountRecord) -> AdminAccountPayload {
+    AdminAccountPayload {
+        account_id: account.account_id,
+        username: account.username,
+        display_name: account.display_name,
+        account_role: AdminAccountRole::Member,
+        tab_permissions: account.tab_permissions,
+        enabled: account.enabled,
+        token_version: account.token_version,
+        created_by: account.created_by,
+        updated_by: account.updated_by,
+        created_at: account.created_at,
+        updated_at: account.updated_at,
+    }
+}
+
+fn map_admin_account_error(error: SpacetimeClientError) -> AppError {
+    let message = error.to_string();
+    let status = if message.contains("已存在") {
+        StatusCode::CONFLICT
+    } else if message.contains("不存在") {
+        StatusCode::NOT_FOUND
+    } else if message.contains("不能为空") || message.contains("无效") {
+        StatusCode::BAD_REQUEST
+    } else {
+        StatusCode::BAD_GATEWAY
+    };
+    AppError::from_status(status).with_message(message)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn tab_permissions_are_validated_deduplicated_and_ordered() {
+        assert_eq!(
+            normalize_tab_permissions(vec![
+                "tracking".to_string(),
+                "dashboard".to_string(),
+                "tracking".to_string(),
+            ])
+            .expect("permissions should normalize"),
+            ["dashboard", "tracking"]
+        );
+        assert!(normalize_tab_permissions(vec!["accounts".to_string()]).is_err());
+    }
+
+    #[test]
+    fn usernames_are_ascii_and_lowercase() {
+        assert_eq!(
+            normalize_admin_account_username(" Operator_1 ").unwrap(),
+            "operator_1"
+        );
+        assert!(normalize_admin_account_username("管理员").is_err());
+        assert!(normalize_admin_account_username(&"a".repeat(65)).is_err());
+    }
+}
diff --git a/server-rs/crates/api-server/src/admin_recharge.rs b/server-rs/crates/api-server/src/admin_recharge.rs
index 289510f95..99a386900 100644
--- a/server-rs/crates/api-server/src/admin_recharge.rs
+++ b/server-rs/crates/api-server/src/admin_recharge.rs
@@ -8,8 +8,11 @@ use axum::{
 };
 use module_auth::AuthUser;
 use module_runtime::{
-    RuntimeProfileAdminWalletSnapshot, RuntimeProfileRechargeOrderAdminEntrySnapshot,
-    RuntimeProfileRechargeOrderStatus, RuntimeProfileRechargeRefundHoldSnapshot,
+    PROFILE_RECHARGE_PAYMENT_CHANNEL_WECHAT_H5, PROFILE_RECHARGE_PAYMENT_CHANNEL_WECHAT_JSAPI,
+    PROFILE_RECHARGE_PAYMENT_CHANNEL_WECHAT_MINI_PROGRAM,
+    PROFILE_RECHARGE_PAYMENT_CHANNEL_WECHAT_NATIVE, RuntimeProfileAdminWalletSnapshot,
+    RuntimeProfileRechargeOrderAdminEntrySnapshot, RuntimeProfileRechargeOrderStatus,
+    RuntimeProfileRechargeProductKind, RuntimeProfileRechargeRefundHoldSnapshot,
     RuntimeProfileRechargeRefundHoldStatus, RuntimeProfileRechargeRefundObservationSource,
     RuntimeProfileRechargeRefundRecoveryStatus, RuntimeProfileRechargeRefundSnapshot,
     RuntimeProfileRechargeRefundStatus, build_runtime_profile_admin_wallet_get_input,
@@ -38,7 +41,7 @@ use shared_contracts::admin::{
 use spacetime_client::SpacetimeClientError;
 
 use crate::{
-    admin::AuthenticatedAdmin,
+    admin::{AdminDisplayNameDirectory, AuthenticatedAdmin, load_admin_display_name_directory},
     api_response::json_success_body,
     http_error::AppError,
     request_context::RequestContext,
@@ -141,6 +144,9 @@ pub async fn admin_get_user_detail(
         .await
         .map_err(|error| spacetime_error_response(&request_context, error))?;
     let summary = map_user_summary(&user);
+    let admin_display_names = load_admin_display_name_directory(&state)
+        .await
+        .map_err(|error| spacetime_error_response(&request_context, error))?;
 
     Ok(json_success_body(
         Some(&request_context),
@@ -154,7 +160,7 @@ pub async fn admin_get_user_detail(
             binding_status: user.binding_status.as_str().to_string(),
             phone_bound: user.phone_number_masked.is_some(),
             wechat_bound: user.wechat_bound,
-            wallet: map_wallet(wallet),
+            wallet: map_wallet(wallet, Some(&admin_display_names)),
             recharge_orders: orders
                 .into_iter()
                 .map(|entry| map_order_entry(entry, Some(summary.clone())))
@@ -254,9 +260,18 @@ pub async fn admin_execute_recharge_refund(
         .map_err(|error| error_response(&request_context, error))?;
     let out_refund_no = build_out_refund_no(&payload.order_id, request_id);
     let refund_reason = normalize_refund_reason(payload.reason.as_deref());
+    let admin_user_id = admin.session().subject.clone();
     let mut entry = load_order(&state, &request_context, &payload.order_id).await?;
+    validate_refund_provider_route(&entry)
+        .map_err(|error| error_response(&request_context, error))?;
     let has_matching_hold = entry.active_hold.as_ref().is_some_and(|hold| {
-        hold.out_refund_no == out_refund_no && hold.refund_cents == payload.refund_amount_cents
+        refund_hold_matches_execute_request(
+            hold,
+            &out_refund_no,
+            payload.refund_amount_cents,
+            &admin_user_id,
+            &refund_reason,
+        )
     });
 
     if entry.active_hold.is_some() && !has_matching_hold {
@@ -306,7 +321,7 @@ pub async fn admin_execute_recharge_refund(
             entry.order.order_id.clone(),
             out_refund_no.clone(),
             payload.refund_amount_cents,
-            admin.session().subject.clone(),
+            admin_user_id,
             refund_reason.clone(),
         )
         .map_err(|message| {
@@ -460,6 +475,7 @@ pub async fn admin_resolve_recharge_refund_manual_review(
         payload.out_refund_no,
         admin.session().subject.clone(),
         payload.reason,
+        payload.expected_error_code,
     )
     .map_err(|message| {
         error_response(
@@ -513,16 +529,18 @@ pub async fn admin_update_wallet_restriction(
             AppError::from_status(StatusCode::BAD_REQUEST).with_message(message),
         )
     })?;
+    let admin_display_names = load_admin_display_name_directory(&state)
+        .await
+        .map_err(|error| spacetime_error_response(&request_context, error))?;
     let wallet = state
         .spacetime_client()
         .admin_upsert_profile_wallet_manual_restriction(input)
         .await
         .map_err(|error| spacetime_error_response(&request_context, error))?;
-
     Ok(json_success_body(
         Some(&request_context),
         AdminWalletRestrictionResponse {
-            wallet: map_wallet(wallet),
+            wallet: map_wallet(wallet, Some(&admin_display_names)),
         },
     ))
 }
@@ -540,6 +558,8 @@ async fn reconcile_and_validate_order(
     Response,
 > {
     let mut entry = load_order(state, request_context, &order_id).await?;
+    validate_refund_provider_route(&entry)
+        .map_err(|error| error_response(request_context, error))?;
     let mut payment_check = query_and_validate_payment(state, &entry)
         .await
         .map_err(|error| error_response(request_context, error))?;
@@ -688,10 +708,7 @@ async fn persist_refund_fact(
 ) -> Result<(), SpacetimeClientError> {
     let fingerprint = refund_fact_fingerprint(refund);
     let observation = build_wechat_pay_refund_observation(
-        format!(
-            "admin-refund-observation-{}",
-            short_hash(fingerprint.as_bytes())
-        ),
+        admin_refund_observation_id(source, &fingerprint),
         source,
         None,
         fingerprint,
@@ -728,11 +745,10 @@ fn validate_refund_amount(
 fn order_refund_block_reason(
     entry: &RuntimeProfileRechargeOrderAdminEntrySnapshot,
 ) -> Option<&'static str> {
-    if entry.order.kind.as_str() != "points" {
-        return Some("membership_not_supported");
-    }
-    if !is_ordinary_wechat_v3_channel(&entry.order.payment_channel) {
-        return Some("payment_channel_not_supported");
+    if let Some(reason_code) =
+        refund_provider_route_block_reason(entry.order.kind, &entry.order.payment_channel)
+    {
+        return Some(reason_code);
     }
     if !matches!(
         entry.order.status,
@@ -866,7 +882,7 @@ fn map_order_entry(
             .map(|value| value.unrecovered_points)
             .unwrap_or(0),
         recovery_status: settlement.map(|value| value.recovery_status.as_str().to_string()),
-        wallet: map_wallet(entry.wallet),
+        wallet: map_wallet(entry.wallet, None),
         refunds: entry.refunds.into_iter().map(map_refund).collect(),
         active_hold: entry.active_hold.map(map_hold),
         remaining_refundable_cents,
@@ -875,7 +891,10 @@ fn map_order_entry(
     }
 }
 
-fn map_wallet(wallet: RuntimeProfileAdminWalletSnapshot) -> AdminProfileWalletPayload {
+fn map_wallet(
+    wallet: RuntimeProfileAdminWalletSnapshot,
+    admin_display_names: Option<&AdminDisplayNameDirectory>,
+) -> AdminProfileWalletPayload {
     AdminProfileWalletPayload {
         user_id: wallet.user_id,
         total_balance: wallet.total_balance,
@@ -889,12 +908,20 @@ fn map_wallet(wallet: RuntimeProfileAdminWalletSnapshot) -> AdminProfileWalletPa
         refund_debt_frozen: wallet.refund_debt_frozen,
         wallet_frozen: wallet.wallet_frozen,
         manual_restriction: wallet.manual_restriction.map(|value| {
+            let created_by_admin_display_name = admin_display_names
+                .map(|directory| directory.resolve(&value.created_by_admin_user_id))
+                .unwrap_or_else(|| "已停用管理员".to_string());
+            let updated_by_admin_display_name = admin_display_names
+                .map(|directory| directory.resolve(&value.updated_by_admin_user_id))
+                .unwrap_or_else(|| "已停用管理员".to_string());
             AdminWalletManualRestrictionPayload {
                 frozen: value.frozen,
                 reason: value.reason,
                 created_by_admin_user_id: value.created_by_admin_user_id,
+                created_by_admin_display_name,
                 created_at_micros: value.created_at_micros,
                 updated_by_admin_user_id: value.updated_by_admin_user_id,
+                updated_by_admin_display_name,
                 updated_at_micros: value.updated_at_micros,
             }
         }),
@@ -905,7 +932,9 @@ fn map_refund(refund: RuntimeProfileRechargeRefundSnapshot) -> AdminRechargeRefu
     AdminRechargeRefundPayload {
         out_refund_no: refund.out_refund_no,
         provider_refund_id: refund.provider_refund_id,
+        provider_transaction_id: refund.provider_transaction_id,
         provider_status: refund.provider_status.as_str().to_string(),
+        total_cents: refund.total_cents,
         refund_cents: refund.refund_cents,
         payer_refund_cents: refund.payer_refund_cents,
         success_at_micros: refund.success_at_micros,
@@ -920,6 +949,7 @@ fn map_refund(refund: RuntimeProfileRechargeRefundSnapshot) -> AdminRechargeRefu
         manual_review_resolved_by_admin_user_id: refund.manual_review_resolved_by_admin_user_id,
         manual_review_resolution_reason: refund.manual_review_resolution_reason,
         manual_review_resolved_at_micros: refund.manual_review_resolved_at_micros,
+        manual_review_resolved_error_code: refund.manual_review_resolved_error_code,
     }
 }
 
@@ -1085,6 +1115,19 @@ fn validate_prepared_refund_hold_status(
     Ok(())
 }
 
+fn refund_hold_matches_execute_request(
+    hold: &RuntimeProfileRechargeRefundHoldSnapshot,
+    out_refund_no: &str,
+    refund_cents: u64,
+    admin_user_id: &str,
+    reason: &str,
+) -> bool {
+    hold.out_refund_no == out_refund_no
+        && hold.refund_cents == refund_cents
+        && hold.admin_user_id == admin_user_id
+        && hold.reason == reason
+}
+
 fn build_refund_notify_url(state: &AppState) -> Result<String, AppError> {
     let configured = state
         .config
@@ -1125,13 +1168,53 @@ fn short_hash(value: &[u8]) -> String {
     hex::encode(&Sha256::digest(value)[..8])
 }
 
+fn admin_refund_observation_id(
+    source: RuntimeProfileRechargeRefundObservationSource,
+    fingerprint: &str,
+) -> String {
+    format!(
+        "admin-refund-observation-{}-{}",
+        source.as_str(),
+        short_hash(fingerprint.as_bytes())
+    )
+}
+
 fn is_ordinary_wechat_v3_channel(value: &str) -> bool {
     matches!(
         value,
-        "wechat_mini_program" | "wechat_jsapi" | "wechat_h5" | "wechat_native"
+        PROFILE_RECHARGE_PAYMENT_CHANNEL_WECHAT_MINI_PROGRAM
+            | PROFILE_RECHARGE_PAYMENT_CHANNEL_WECHAT_JSAPI
+            | PROFILE_RECHARGE_PAYMENT_CHANNEL_WECHAT_H5
+            | PROFILE_RECHARGE_PAYMENT_CHANNEL_WECHAT_NATIVE
     )
 }
 
+fn refund_provider_route_block_reason(
+    kind: RuntimeProfileRechargeProductKind,
+    payment_channel: &str,
+) -> Option<&'static str> {
+    if kind != RuntimeProfileRechargeProductKind::Points {
+        return Some("membership_not_supported");
+    }
+    if !is_ordinary_wechat_v3_channel(payment_channel) {
+        return Some("payment_channel_not_supported");
+    }
+    None
+}
+
+fn validate_refund_provider_route(
+    entry: &RuntimeProfileRechargeOrderAdminEntrySnapshot,
+) -> Result<(), AppError> {
+    if let Some(reason_code) =
+        refund_provider_route_block_reason(entry.order.kind, &entry.order.payment_channel)
+    {
+        return Err(AppError::from_status(StatusCode::CONFLICT)
+            .with_message(refund_block_message(reason_code))
+            .with_details(json!({"reasonCode": reason_code})));
+    }
+    Ok(())
+}
+
 fn classify_refund_block_reason(message: &str) -> &'static str {
     if message.contains("永久泥点不足") || message.contains("可用") {
         "insufficient_permanent_points"
@@ -1195,13 +1278,20 @@ mod tests {
         body::Body,
         http::{Request, StatusCode},
     };
-    use module_runtime::RuntimeProfileRechargeRefundHoldStatus;
+    use module_runtime::{
+        RuntimeProfileRechargeProductKind, RuntimeProfileRechargeRefundHoldSnapshot,
+        RuntimeProfileRechargeRefundHoldStatus, RuntimeProfileRechargeRefundObservationSource,
+        RuntimeProfileRechargeRefundRecoveryStatus, RuntimeProfileRechargeRefundSnapshot,
+        RuntimeProfileRechargeRefundStatus,
+    };
     use tower::ServiceExt;
 
     use super::{
-        build_out_refund_no, classify_refund_block_reason, is_likely_wechat_refund_id,
+        admin_refund_observation_id, build_out_refund_no, classify_refund_block_reason,
+        is_likely_wechat_refund_id, is_ordinary_wechat_v3_channel, map_refund,
         normalize_request_id, payment_check_block_reason_code,
         payment_trade_state_allows_additional_refund, refund_block_message,
+        refund_hold_matches_execute_request, refund_provider_route_block_reason,
         validate_prepared_refund_hold_status,
     };
     use crate::{app::build_router, config::AppConfig, state::AppState};
@@ -1229,6 +1319,94 @@ mod tests {
         assert!(!is_likely_wechat_refund_id("refund-1001"));
     }
 
+    #[test]
+    fn admin_refund_observation_ids_are_stable_per_source_and_fact() {
+        let fingerprint = "sha256:refund-fact";
+        let api_request = admin_refund_observation_id(
+            RuntimeProfileRechargeRefundObservationSource::ApiRequest,
+            fingerprint,
+        );
+        let repeated_api_request = admin_refund_observation_id(
+            RuntimeProfileRechargeRefundObservationSource::ApiRequest,
+            fingerprint,
+        );
+        let query = admin_refund_observation_id(
+            RuntimeProfileRechargeRefundObservationSource::Query,
+            fingerprint,
+        );
+
+        assert_eq!(api_request, repeated_api_request);
+        assert_ne!(api_request, query);
+    }
+
+    #[test]
+    fn refund_mapping_preserves_manual_review_evidence_and_audit_code() {
+        let mapped = map_refund(RuntimeProfileRechargeRefundSnapshot {
+            out_refund_no: "refund-1".to_string(),
+            provider_refund_id: "provider-refund-1".to_string(),
+            order_id: "order-1".to_string(),
+            provider_transaction_id: "provider-transaction-1".to_string(),
+            user_id: Some("user-1".to_string()),
+            provider_status: RuntimeProfileRechargeRefundStatus::Success,
+            total_cents: 600,
+            refund_cents: 300,
+            payer_total_cents: 600,
+            payer_refund_cents: 300,
+            success_at_micros: Some(2),
+            first_observed_at_micros: 1,
+            updated_at_micros: 2,
+            last_observation_source: RuntimeProfileRechargeRefundObservationSource::Query,
+            last_observation_id: "observation-1".to_string(),
+            order_settled_at_micros: Some(2),
+            target_recovery_points: 30,
+            recovered_points: 30,
+            unrecovered_points: 0,
+            recovery_status: RuntimeProfileRechargeRefundRecoveryStatus::Applied,
+            last_recovery_ledger_id: Some("ledger-1".to_string()),
+            last_error_code: None,
+            manual_review_resolved_by_admin_user_id: Some("admin-1".to_string()),
+            manual_review_resolution_reason: Some("已核对商户平台".to_string()),
+            manual_review_resolved_at_micros: Some(2),
+            manual_review_resolved_error_code: Some("provider_transaction_id_mismatch".to_string()),
+        });
+
+        assert_eq!(mapped.provider_transaction_id, "provider-transaction-1");
+        assert_eq!(mapped.total_cents, 600);
+        assert_eq!(
+            mapped.manual_review_resolved_error_code.as_deref(),
+            Some("provider_transaction_id_mismatch")
+        );
+    }
+
+    #[test]
+    fn refund_provider_route_uses_canonical_payment_channels() {
+        assert!(is_ordinary_wechat_v3_channel("wechat_mp"));
+        assert!(is_ordinary_wechat_v3_channel("wechat_jsapi"));
+        assert!(!is_ordinary_wechat_v3_channel("wechat_mini_program"));
+        assert!(!is_ordinary_wechat_v3_channel("wechat_mp_virtual"));
+        assert_eq!(
+            refund_provider_route_block_reason(
+                RuntimeProfileRechargeProductKind::Points,
+                "wechat_mp"
+            ),
+            None
+        );
+        assert_eq!(
+            refund_provider_route_block_reason(
+                RuntimeProfileRechargeProductKind::Points,
+                "wechat_mp_virtual"
+            ),
+            Some("payment_channel_not_supported")
+        );
+        assert_eq!(
+            refund_provider_route_block_reason(
+                RuntimeProfileRechargeProductKind::Membership,
+                "wechat_native"
+            ),
+            Some("membership_not_supported")
+        );
+    }
+
     #[test]
     fn reconciled_partial_refund_keeps_the_remaining_amount_refundable() {
         assert!(payment_trade_state_allows_additional_refund(
@@ -1282,6 +1460,48 @@ mod tests {
         );
     }
 
+    #[test]
+    fn active_refund_hold_retry_requires_the_original_admin_and_reason() {
+        let hold = RuntimeProfileRechargeRefundHoldSnapshot {
+            out_refund_no: "refund-1".to_string(),
+            order_id: "order-1".to_string(),
+            user_id: "user-1".to_string(),
+            refund_cents: 300,
+            held_points: 30,
+            status: RuntimeProfileRechargeRefundHoldStatus::Active,
+            admin_user_id: "admin-1".to_string(),
+            reason: "用户申请".to_string(),
+            created_at_micros: 1,
+            updated_at_micros: 1,
+            settled_at_micros: None,
+            released_at_micros: None,
+            released_by_admin_user_id: None,
+            release_reason: None,
+        };
+
+        assert!(refund_hold_matches_execute_request(
+            &hold,
+            "refund-1",
+            300,
+            "admin-1",
+            "用户申请",
+        ));
+        assert!(!refund_hold_matches_execute_request(
+            &hold,
+            "refund-1",
+            300,
+            "admin-2",
+            "用户申请",
+        ));
+        assert!(!refund_hold_matches_execute_request(
+            &hold,
+            "refund-1",
+            300,
+            "admin-1",
+            "其他原因",
+        ));
+    }
+
     #[tokio::test]
     async fn recharge_management_routes_require_admin_authentication() {
         let app = build_router(
diff --git a/server-rs/crates/api-server/src/aliyun_matting.rs b/server-rs/crates/api-server/src/aliyun_matting.rs
index d3c684d57..60f5a9921 100644
--- a/server-rs/crates/api-server/src/aliyun_matting.rs
+++ b/server-rs/crates/api-server/src/aliyun_matting.rs
@@ -118,22 +118,36 @@ mod tests {
                 error.message()
             );
             let details = mapped.details().expect("details present");
-            assert_eq!(details.get("transport").and_then(|v| v.as_bool()), Some(false));
-            assert_eq!(details.get("timeout").and_then(|v| v.as_bool()), Some(false));
+            assert_eq!(
+                details.get("transport").and_then(|v| v.as_bool()),
+                Some(false)
+            );
+            assert_eq!(
+                details.get("timeout").and_then(|v| v.as_bool()),
+                Some(false)
+            );
         }
     }
 
     #[test]
     fn upstream_transport_failure_maps_to_retryable_transport() {
-        let error =
-            MattingError::upstream_transport_error("通用抠图请求失败：dns error".to_string(), false);
+        let error = MattingError::upstream_transport_error(
+            "通用抠图请求失败：dns error".to_string(),
+            false,
+        );
         let mapped = aliyun_matting_failure_to_app_error(&error, 12);
 
         assert!(crate::external_api_audit::matting_failure_external_call_attempted(&mapped));
         let details = mapped.details().expect("details present");
         // 无 HTTP 状态的传输层失败标记为可重试 transport 故障，且不带 upstreamStatus。
-        assert_eq!(details.get("transport").and_then(|v| v.as_bool()), Some(true));
-        assert_eq!(details.get("timeout").and_then(|v| v.as_bool()), Some(false));
+        assert_eq!(
+            details.get("transport").and_then(|v| v.as_bool()),
+            Some(true)
+        );
+        assert_eq!(
+            details.get("timeout").and_then(|v| v.as_bool()),
+            Some(false)
+        );
         assert!(details.get("upstreamStatus").is_some_and(|v| v.is_null()));
     }
 
@@ -146,7 +160,10 @@ mod tests {
         assert_eq!(mapped.status_code(), StatusCode::GATEWAY_TIMEOUT);
         let details = mapped.details().expect("details present");
         assert_eq!(details.get("timeout").and_then(|v| v.as_bool()), Some(true));
-        assert_eq!(details.get("transport").and_then(|v| v.as_bool()), Some(true));
+        assert_eq!(
+            details.get("transport").and_then(|v| v.as_bool()),
+            Some(true)
+        );
     }
 
     #[test]
@@ -159,7 +176,13 @@ mod tests {
 
         assert!(crate::external_api_audit::matting_failure_external_call_attempted(&mapped));
         let details = mapped.details().expect("details present");
-        assert_eq!(details.get("transport").and_then(|v| v.as_bool()), Some(false));
-        assert_eq!(details.get("upstreamStatus").and_then(|v| v.as_u64()), Some(429));
+        assert_eq!(
+            details.get("transport").and_then(|v| v.as_bool()),
+            Some(false)
+        );
+        assert_eq!(
+            details.get("upstreamStatus").and_then(|v| v.as_u64()),
+            Some(429)
+        );
     }
 }
diff --git a/server-rs/crates/api-server/src/auth_me.rs b/server-rs/crates/api-server/src/auth_me.rs
index 32cdc1a0d..bab8c4349 100644
--- a/server-rs/crates/api-server/src/auth_me.rs
+++ b/server-rs/crates/api-server/src/auth_me.rs
@@ -1,4 +1,4 @@
-use axum::{
+use axum::{
     Json,
     extract::{Extension, State},
     http::StatusCode,
diff --git a/server-rs/crates/api-server/src/character_animation_assets.rs b/server-rs/crates/api-server/src/character_animation_assets.rs
index f4c28f170..4c0ac0140 100644
--- a/server-rs/crates/api-server/src/character_animation_assets.rs
+++ b/server-rs/crates/api-server/src/character_animation_assets.rs
@@ -112,8 +112,8 @@ const ARK_VIDEO_TASK_POLL_INTERVAL_MS: u64 = 5_000;
 const SOURCE_IMAGE_RESOLVE_TIMEOUT_MS: u64 = 30_000;
 const EDITOR_CHARACTER_ANIMATION_MODEL: &str = "seedance2.0-fast";
 const EDITOR_CHARACTER_ANIMATION_ASSET_KIND: &str = "editor_character_animation";
-const EDITOR_GREEN_SCREEN_SOURCE_ASSET_KIND: &str = "editor_green_screen_source";
-const EDITOR_GREEN_SCREEN_SOURCE_SLOT: &str = "green_screen_source";
+const EDITOR_CHARACTER_ANIMATION_RESOURCE_ASSET_KIND: &str = "character-animation";
+const EDITOR_CHARACTER_ANIMATION_PROVIDER_SOURCE_SLOT: &str = "provider_source";
 const EDITOR_VIDEO_ASSET_KIND: &str = "editor_video";
 const EDITOR_VIDEO_ENTITY_KIND: &str = "editor_canvas";
 const EDITOR_VIDEO_SLOT: &str = "video_preview";
@@ -736,7 +736,7 @@ pub(crate) async fn generate_editor_character_animation_for_owner(
                 source_data_url.as_str(),
             )
             .await?;
-            persist_editor_generated_media_asset(
+            let source_record = persist_editor_generated_media_asset(
                 &state,
                 PersistEditorGeneratedAssetRequest {
                     project_id: project_id.clone(),
@@ -756,13 +756,19 @@ pub(crate) async fn generate_editor_character_animation_for_owner(
                     provider: "Ark".to_string(),
                     task_id: task_id.clone(),
                     source_resource_id: source_resource_id.clone(),
-                    asset_kind: Some(EDITOR_GREEN_SCREEN_SOURCE_ASSET_KIND.to_string()),
+                    asset_kind: Some(
+                        EDITOR_CHARACTER_ANIMATION_RESOURCE_ASSET_KIND.to_string(),
+                    ),
                     generation_inputs: generation_inputs.clone(),
                     thumbnail_src: None,
-                    generation_cost_mud_points: 0,
+                    generation_cost_mud_points: u64::from(normalized.price_mud_points),
                 },
             )
             .await?;
+            let provider_source_resource_id = source_record
+                .0
+                .as_ref()
+                .map(|resource| resource.resource_id.clone());
             let persisted_frames = extract_and_persist_editor_character_animation_frames(
                 &state,
                 owner_user_id.as_str(),
@@ -807,11 +813,13 @@ pub(crate) async fn generate_editor_character_animation_for_owner(
                     model: EDITOR_CHARACTER_ANIMATION_MODEL.to_string(),
                     provider: "Ark".to_string(),
                     task_id: task_id.clone(),
-                    source_resource_id: None,
-                    asset_kind: Some("character-animation".to_string()),
+                    source_resource_id: provider_source_resource_id,
+                    asset_kind: Some(
+                        EDITOR_CHARACTER_ANIMATION_RESOURCE_ASSET_KIND.to_string(),
+                    ),
                     generation_inputs: generation_inputs.clone(),
                     thumbnail_src: Some(first_frame.image_src.clone()),
-                    generation_cost_mud_points: u64::from(normalized.price_mud_points),
+                    generation_cost_mud_points: 0,
                 },
             )
             .await?;
@@ -1917,11 +1925,11 @@ async fn put_generated_editor_character_animation_preview(
         preview_payload.mime_type,
         preview_payload.bytes,
         build_asset_metadata(
-            EDITOR_GREEN_SCREEN_SOURCE_ASSET_KIND,
+            EDITOR_CHARACTER_ANIMATION_ASSET_KIND,
             owner_user_id,
             "editor_layer",
             source_layer_id,
-            EDITOR_GREEN_SCREEN_SOURCE_SLOT,
+            EDITOR_CHARACTER_ANIMATION_PROVIDER_SOURCE_SLOT,
             "editor-character-animation",
         ),
     )
@@ -2272,7 +2280,7 @@ async fn extract_and_persist_editor_character_animation_frames(
         Some(request.duration_seconds as f64),
     )
     .await?;
-    persist_editor_character_animation_green_screen_source_frames(
+    persist_editor_character_animation_provider_source_frames(
         state,
         owner_user_id,
         source_layer_id,
@@ -2352,7 +2360,7 @@ async fn extract_and_persist_editor_character_animation_frames(
     })
 }
 
-async fn persist_editor_character_animation_green_screen_source_frames(
+async fn persist_editor_character_animation_provider_source_frames(
     state: &AppState,
     owner_user_id: &str,
     source_layer_id: &str,
@@ -2372,11 +2380,11 @@ async fn persist_editor_character_animation_green_screen_source_frames(
             frame.mime_type.clone(),
             frame.bytes.clone(),
             build_asset_metadata(
-                EDITOR_GREEN_SCREEN_SOURCE_ASSET_KIND,
+                EDITOR_CHARACTER_ANIMATION_ASSET_KIND,
                 owner_user_id,
                 "editor_layer",
                 source_layer_id,
-                EDITOR_GREEN_SCREEN_SOURCE_SLOT,
+                EDITOR_CHARACTER_ANIMATION_PROVIDER_SOURCE_SLOT,
                 "editor-character-animation",
             ),
         )
@@ -2819,7 +2827,7 @@ async fn confirm_editor_character_animation_source_asset_object(
         task_id,
         object_key,
         content_type,
-        EDITOR_GREEN_SCREEN_SOURCE_ASSET_KIND,
+        EDITOR_CHARACTER_ANIMATION_ASSET_KIND,
     )
     .await
 }
@@ -6044,7 +6052,7 @@ mod tests {
             "async fn publish_animation_set",
             &[
                 "apply_chroma_key: false",
-                "persist_editor_character_animation_green_screen_source_frames",
+                "persist_editor_character_animation_provider_source_frames",
                 "remove_editor_character_animation_frame_backgrounds",
             ],
         );
@@ -6053,17 +6061,17 @@ mod tests {
             "async fn extract_and_persist_editor_character_animation_frames",
             "async fn publish_animation_set",
             &[
-                "persist_editor_character_animation_green_screen_source_frames",
+                "persist_editor_character_animation_provider_source_frames",
                 "remove_editor_character_animation_frame_backgrounds",
             ],
         );
         assert_function_contains(
             source,
-            "async fn persist_editor_character_animation_green_screen_source_frames",
+            "async fn persist_editor_character_animation_provider_source_frames",
             "fn remove_editor_character_animation_frame_backgrounds",
             &[
-                "EDITOR_GREEN_SCREEN_SOURCE_ASSET_KIND",
-                "EDITOR_GREEN_SCREEN_SOURCE_SLOT",
+                "EDITOR_CHARACTER_ANIMATION_ASSET_KIND",
+                "EDITOR_CHARACTER_ANIMATION_PROVIDER_SOURCE_SLOT",
                 "green-screen-frame",
                 "put_character_animation_object",
             ],
@@ -6134,14 +6142,14 @@ mod tests {
                 "attach_editor_character_animation_result_metadata",
                 "project_id: None",
                 "label: asset_label.clone()",
-                "asset_kind: Some(\"character-animation\".to_string())",
-                "generation_cost_mud_points: u64::from(normalized.price_mud_points)",
+                "EDITOR_CHARACTER_ANIMATION_RESOURCE_ASSET_KIND",
+                "generation_cost_mud_points: 0",
             ],
         );
         assert_function_contains(
             source,
             "async fn extract_and_persist_editor_character_animation_frames",
-            "async fn persist_editor_character_animation_green_screen_source_frames",
+            "async fn persist_editor_character_animation_provider_source_frames",
             &[
                 "confirm_editor_character_animation_frame_asset_object",
                 "first_frame_object_key",
@@ -6175,7 +6183,8 @@ mod tests {
             "pub async fn generate_editor_video",
             &[
                 "or_else(|| Some(\"project\".to_string()))",
-                "EDITOR_GREEN_SCREEN_SOURCE_ASSET_KIND",
+                "EDITOR_CHARACTER_ANIMATION_RESOURCE_ASSET_KIND",
+                "generation_cost_mud_points: u64::from(normalized.price_mud_points)",
             ],
         );
         assert_function_contains_in_order(
diff --git a/server-rs/crates/api-server/src/custom_world_asset_prompts.rs b/server-rs/crates/api-server/src/custom_world_asset_prompts.rs
index 985a83447..f240d1758 100644
--- a/server-rs/crates/api-server/src/custom_world_asset_prompts.rs
+++ b/server-rs/crates/api-server/src/custom_world_asset_prompts.rs
@@ -1,4 +1,4 @@
-pub(crate) use crate::prompt::character_animation::{
+pub(crate) use crate::prompt::character_animation::{
     build_character_animation_prompt, build_fallback_moderation_safe_animation_prompt,
 };
 pub(crate) use crate::prompt::character_visual::{
diff --git a/server-rs/crates/api-server/src/custom_world_rpg_draft_prompts.rs b/server-rs/crates/api-server/src/custom_world_rpg_draft_prompts.rs
index 8ba9c49fb..f506f2034 100644
--- a/server-rs/crates/api-server/src/custom_world_rpg_draft_prompts.rs
+++ b/server-rs/crates/api-server/src/custom_world_rpg_draft_prompts.rs
@@ -1 +1 @@
-pub(crate) use crate::prompt::agent_chat::*;
+pub(crate) use crate::prompt::agent_chat::*;
diff --git a/server-rs/crates/api-server/src/editor_green_screen.rs b/server-rs/crates/api-server/src/editor_green_screen.rs
index 5840533de..c13d3abc1 100644
--- a/server-rs/crates/api-server/src/editor_green_screen.rs
+++ b/server-rs/crates/api-server/src/editor_green_screen.rs
@@ -109,7 +109,6 @@ pub(crate) fn default_editor_screen_background_color() -> EditorScreenBackground
     EDITOR_SCREEN_BACKGROUND_COLORS[0]
 }
 
-
 pub(crate) fn parse_editor_screen_background_color(
     value: Option<&str>,
 ) -> Result<EditorScreenBackgroundColor, AppError> {
diff --git a/server-rs/crates/api-server/src/editor_project.rs b/server-rs/crates/api-server/src/editor_project.rs
index 39ec8a3c4..b07b63629 100644
--- a/server-rs/crates/api-server/src/editor_project.rs
+++ b/server-rs/crates/api-server/src/editor_project.rs
@@ -38,7 +38,8 @@ use shared_kernel::build_prefixed_uuid_id;
 use spacetime_client::{
     EditorAssetCreateRecordInput, EditorAssetDeleteRecordInput, EditorAssetFolderCreateRecordInput,
     EditorAssetFolderDeleteRecordInput, EditorAssetFolderRecord,
-    EditorAssetFolderUpdateRecordInput, EditorAssetLibraryRecord,
+    EditorAssetFolderUpdateRecordInput, EditorAssetGroupCohortCompleteRecordInput,
+    EditorAssetGroupSourceLookupRecordInput, EditorAssetLibraryRecord,
     EditorAssetMediaRepairRecordInput, EditorAssetRecord, EditorAssetUpdateRecordInput,
     EditorCanvasRecord, EditorCanvasViewportRecord, EditorProjectCreateRecordInput,
     EditorProjectDeleteRecordInput, EditorProjectGetRecordInput,
@@ -116,15 +117,14 @@ const EDITOR_SPEC_IMAGE_ASSET_KIND: &str = "editor_spec_image";
 const EDITOR_QUICK_EDIT_IMAGE_ASSET_KIND: &str = "editor_quick_edit_image";
 const EDITOR_UI_DESIGN_IMAGE_ASSET_KIND: &str = "editor_ui_design_image";
 const EDITOR_IMAGE_EDIT_ASSET_KIND: &str = "editor_image_edit";
-const EDITOR_IMAGE_EDIT_SOURCE_ASSET_KIND: &str = "editor_image_edit_source";
 const EDITOR_ICON_SPRITESHEET_ASSET_KIND: &str = "editor_icon_spritesheet";
 const EDITOR_ICON_SPRITESHEET_SLICE_ASSET_KIND: &str = "editor_icon_spritesheet_slice";
 const EDITOR_ICON_SPRITESHEET_SLICE_WARNING_COMPONENTS: &str = "insufficient-connected-components";
 const EDITOR_ICON_SPRITESHEET_SLICE_WARNING_PERSISTENCE: &str = "slice-persistence-failed";
 const EDITOR_UI_DESIGN_SPRITESHEET_ASSET_KIND: &str = "editor_ui_design_spritesheet";
 const EDITOR_UI_DESIGN_ASSET_IMAGE_KIND: &str = "editor_ui_design_asset";
-const EDITOR_GREEN_SCREEN_SOURCE_ASSET_KIND: &str = "editor_green_screen_source";
-const EDITOR_GREEN_SCREEN_SOURCE_SLOT: &str = "green_screen_source";
+const EDITOR_LEGACY_GREEN_SCREEN_SOURCE_ASSET_KIND: &str = "editor_green_screen_source";
+const EDITOR_PROVIDER_SOURCE_SLOT: &str = "provider_source";
 const EDITOR_BGFILTER_DEFAULT_SEG_MODEL: &str = "birefnet";
 const EDITOR_BGFILTER_SEG_MODEL_ANIME_SEG: &str = "anime-seg";
 const EDITOR_PUBLICATION_MATERIAL_ASSET_KIND: &str = "editor_publication_material";
@@ -462,6 +462,8 @@ pub(crate) struct PersistEditorGeneratedAssetInput {
     pub(crate) model: String,
     pub(crate) provider: String,
     pub(crate) task_id: String,
+    pub(crate) group_task_id: Option<String>,
+    pub(crate) group_task_expected_asset_count: Option<u32>,
     pub(crate) source_resource_id: Option<String>,
     pub(crate) asset_kind: Option<String>,
     pub(crate) generation_inputs: Option<Value>,
@@ -1204,6 +1206,8 @@ pub async fn create_editor_asset(
             now_micros: current_utc_micros(),
             thumbnail_src: None,
             generation_cost_mud_points: 0,
+            group_task_id: None,
+            group_task_expected_asset_count: None,
         })
         .await
         .map_err(map_editor_project_error)?;
@@ -1604,25 +1608,37 @@ pub(crate) async fn generate_editor_image_for_owner(
             "message": "VectorEngine 未返回图片",
         }))
     })?;
+    let (provider_width, provider_height) = image::load_from_memory(image.bytes.as_slice())
+        .map(|image| (image.width(), image.height()))
+        .map_err(|error| {
+            AppError::from_status(StatusCode::BAD_GATEWAY).with_details(json!({
+                "provider": "vector-engine",
+                "message": format!("素材生成结果不是有效图片：{error}"),
+            }))
+        })?;
+    let storage_profile = editor_generated_image_storage_profile(normalized_kind);
+    let mut output_prompt = submitted_prompt.clone();
+    let mut output_actual_prompt = generated.actual_prompt.clone();
+    let mut output_model = generation_options.model.to_string();
+    let mut output_provider = "VectorEngine".to_string();
+    let mut output_generation_inputs = generation_inputs.clone();
     let source_record = if is_character_generation {
-        let (source_width, source_height) = image::load_from_memory(image.bytes.as_slice())
-            .map(|image| (image.width(), image.height()))
-            .unwrap_or((1024, 1024));
-        let source_persisted = persist_editor_green_screen_source_image(
+        let source_persisted = persist_editor_provider_source_image(
             state,
             caller.owner_user_id.as_str(),
             generated.task_id.as_str(),
             &image,
             submitted_prompt.as_str(),
             generated.actual_prompt.as_deref(),
+            storage_profile.asset_kind,
             "character-images",
             "character-image",
         )
         .await?;
-        let source_record = persist_editor_green_screen_source_resource(
+        let source_record = persist_editor_provider_source_resource(
             state,
             source_persisted,
-            PersistEditorGreenScreenSourceResourceInput {
+            PersistEditorProviderSourceResourceInput {
                 project_id: payload.project_id.clone(),
                 owner_user_id: caller.owner_user_id.clone(),
                 folder_id: payload
@@ -1630,14 +1646,19 @@ pub(crate) async fn generate_editor_image_for_owner(
                     .clone()
                     .or_else(|| Some(EDITOR_ASSET_DEFAULT_FOLDER_ID.to_string())),
                 label: editor_generated_asset_variant_label(asset_label.as_str(), "原图"),
-                width: source_width,
-                height: source_height,
+                width: provider_width,
+                height: provider_height,
                 prompt: role_setting.clone(),
                 actual_prompt: generated.actual_prompt.clone(),
                 model: generation_options.model.to_string(),
                 task_id: generated.task_id.clone(),
                 source_resource_id: payload.source_resource_id.clone(),
+                asset_kind: payload
+                    .asset_kind
+                    .clone()
+                    .or_else(|| Some("character".to_string())),
                 generation_inputs: generation_inputs.clone(),
+                generation_cost_mud_points: u64::from(configured_price_mud_points),
             },
         )
         .await?;
@@ -1649,7 +1670,7 @@ pub(crate) async fn generate_editor_image_for_owner(
                 .or_else(|| payload.project_id.clone()),
             request_id: Some(request_context.request_id().to_string()),
         };
-        image = remove_editor_generated_screen_background_with_bgfilter(
+        let removal = remove_editor_generated_screen_background_with_bgfilter(
             state,
             &image,
             screen_color.expect("character generation should have screen color"),
@@ -1657,30 +1678,56 @@ pub(crate) async fn generate_editor_image_for_owner(
             &matting_audit,
         )
         .await?;
+        image = removal.image;
+        output_prompt = "去除纯色背景".to_string();
+        output_actual_prompt = None;
+        output_model = removal.model;
+        output_provider = removal.provider.to_string();
+        output_generation_inputs =
+            build_editor_derived_asset_generation_inputs("角色抠图", &output_model, &source_record);
         Some(source_record)
     } else {
         None
     };
 
+    // TODO the image size passed to api is already normalized, should remove those normalize
+    // and let resize here to get the proper size
+    let (restored_image, dimension_restore_error) =
+        restore_editor_generated_image_output_dimensions_or_original(
+            image,
+            generation_options.model,
+            image_size.as_ref(),
+        );
+    if let Some(error) = dimension_restore_error {
+        tracing::warn!(
+            task_id = %generated.task_id,
+            error = ?error,
+            "画板生成图片尺寸恢复失败，保留并上传 provider 原图"
+        );
+    }
+    image = restored_image;
     let (width, height) = image::load_from_memory(image.bytes.as_slice())
         .map(|image| (image.width(), image.height()))
         .unwrap_or((1024, 1024));
-    let storage_profile = editor_generated_image_storage_profile(normalized_kind);
     let persisted = persist_editor_generated_image(
         state,
         caller.owner_user_id.as_str(),
         generated.task_id.as_str(),
         &image,
-        submitted_prompt.as_str(),
-        generated.actual_prompt.as_deref(),
+        output_prompt.as_str(),
+        output_actual_prompt.as_deref(),
         storage_profile.asset_kind,
         storage_profile.path_kind,
         "image",
         storage_profile.slot,
-        "vector-engine",
-    );
-    let persisted = persisted.await?;
+        output_provider.as_str(),
+    )
+    .await?;
     let image_src = editor_media_src_from_object_key(persisted.object_key.as_str());
+    let provider_source_resource_id = source_record
+        .as_ref()
+        .and_then(|record| record.resource.as_ref())
+        .map(|resource| resource.resource_id.clone());
     let generated_asset = persist_editor_generated_asset(
         state,
         PersistEditorGeneratedAssetInput {
@@ -1693,16 +1740,22 @@ pub(crate) async fn generate_editor_image_for_owner(
             asset_object_id: Some(persisted.asset_object_id.clone()),
             width,
             height,
-            prompt: role_setting.clone(),
-            actual_prompt: generated.actual_prompt.clone(),
-            model: generation_options.model.to_string(),
-            provider: "VectorEngine".to_string(),
+            prompt: output_prompt,
+            actual_prompt: output_actual_prompt,
+            model: output_model,
+            provider: output_provider,
             task_id: generated.task_id.clone(),
-            source_resource_id: payload.source_resource_id,
+            group_task_id: None,
+            group_task_expected_asset_count: None,
+            source_resource_id: provider_source_resource_id.or(payload.source_resource_id),
             asset_kind: payload.asset_kind,
-            generation_inputs,
+            generation_inputs: output_generation_inputs,
             thumbnail_src: None,
-            generation_cost_mud_points: u64::from(configured_price_mud_points),
+            generation_cost_mud_points: if is_character_generation {
+                0
+            } else {
+                u64::from(configured_price_mud_points)
+            },
         },
     )
     .await?;
@@ -1778,6 +1831,45 @@ pub(crate) fn apply_editor_screen_background_decision_to_generation_inputs(
     Some(value)
 }
 
+fn build_editor_derived_asset_generation_inputs(
+    stage: &str,
+    model: &str,
+    source: &EditorGeneratedAssetRecord,
+) -> Option<Value> {
+    let reference = source
+        .resource
+        .as_ref()
+        .map(|resource| {
+            json!({
+                "title": "输入素材",
+                "label": source
+                    .asset
+                    .as_ref()
+                    .map(|asset| asset.label.as_str())
+                    .unwrap_or("上一步产物"),
+                "refType": "project-resource",
+                "refId": resource.resource_id,
+            })
+        })
+        .or_else(|| {
+            source.asset.as_ref().map(|asset| {
+                json!({
+                    "title": "输入素材",
+                    "label": asset.label,
+                    "refType": "asset",
+                    "refId": asset.asset_id,
+                })
+            })
+        });
+    Some(json!({
+        "fields": [
+            { "title": "处理阶段", "value": stage },
+            { "title": "处理模型", "value": model },
+        ],
+        "references": reference.into_iter().collect::<Vec<_>>(),
+    }))
+}
+
 fn editor_generated_image_storage_profile(
     normalized_kind: Option<&str>,
 ) -> EditorGeneratedImageStorageProfile {
@@ -2007,14 +2099,14 @@ fn ensure_editor_image_edit_asset_kind_allowed(asset_kind: Option<&str>) -> Resu
     let Some(asset_kind) = asset_kind.map(str::trim).filter(|value| !value.is_empty()) else {
         return Ok(());
     };
-    if !matches!(asset_kind, "icon" | "icon-spritesheet") {
+    if asset_kind != "icon" {
         return Ok(());
     }
 
     Err(
         AppError::from_status(StatusCode::BAD_REQUEST).with_details(json!({
             "provider": "editor-image-edit",
-            "message": "图标与图标图集不支持快速编辑",
+            "message": "单个图标不支持快速编辑",
             "assetKind": asset_kind,
         })),
     )
@@ -2185,9 +2277,9 @@ fn prepare_editor_image_edit_references(
 }
 
 fn restore_editor_image_edit_output_dimensions(
-    output: DownloadedOpenAiImage,
+    output: &DownloadedOpenAiImage,
     dimensions: &EditorImageEditDimensions,
-) -> Result<DownloadedOpenAiImage, AppError> {
+) -> Result<Option<DownloadedOpenAiImage>, AppError> {
     let decoded = image::load_from_memory(output.bytes.as_slice()).map_err(|error| {
         AppError::from_status(StatusCode::BAD_GATEWAY).with_details(json!({
             "provider": "vector-engine",
@@ -2195,7 +2287,7 @@ fn restore_editor_image_edit_output_dimensions(
         }))
     })?;
     if decoded.width() == dimensions.target_width && decoded.height() == dimensions.target_height {
-        return Ok(output);
+        return Ok(None);
     }
 
     let restored = if decoded.width() == dimensions.provider_width
@@ -2209,7 +2301,7 @@ fn restore_editor_image_edit_output_dimensions(
             image::imageops::FilterType::Lanczos3,
         )
     };
-    Ok(DownloadedOpenAiImage {
+    Ok(Some(DownloadedOpenAiImage {
         bytes: encode_editor_image_edit_png(
             restored,
             StatusCode::BAD_GATEWAY,
@@ -2217,7 +2309,84 @@ fn restore_editor_image_edit_output_dimensions(
         )?,
         mime_type: "image/png".to_string(),
         extension: "png".to_string(),
-    })
+    }))
+}
+
+fn restore_editor_image_edit_output_dimensions_or_original(
+    output: DownloadedOpenAiImage,
+    dimensions: &EditorImageEditDimensions,
+) -> (DownloadedOpenAiImage, Option<AppError>) {
+    match restore_editor_image_edit_output_dimensions(&output, dimensions) {
+        Ok(Some(restored)) => (restored, None),
+        Ok(None) => (output, None),
+        Err(error) => (output, Some(error)),
+    }
+}
+
+fn restore_editor_generated_image_output_dimensions_or_original(
+    output: DownloadedOpenAiImage,
+    model: &str,
+    target_size: &str,
+) -> (DownloadedOpenAiImage, Option<AppError>) {
+    match restore_editor_generated_image_output_dimensions(&output, model, target_size) {
+        Ok(Some(restored)) => (restored, None),
+        Ok(None) => (output, None),
+        Err(error) => (output, Some(error)),
+    }
+}
+
+fn restore_editor_generated_image_output_dimensions(
+    output: &DownloadedOpenAiImage,
+    model: &str,
+    target_size: &str,
+) -> Result<Option<DownloadedOpenAiImage>, AppError> {
+    // nanobanana 使用标量清晰度档位和独立比例；provider 回图已经是目标几何尺寸，
+    // 不能再把 512 / 1024 / 2K 当作 WIDTHxHEIGHT 解析。
+    if model == EDITOR_IMAGE_MODEL_NANOBANANA2 {
+        return Ok(None);
+    }
+    let (target_width, target_height) = target_size.split_once('x').ok_or_else(|| {
+        AppError::from_status(StatusCode::BAD_GATEWAY).with_details(json!({
+            "provider": "vector-engine",
+            "message": "尺寸无效",
+        }))
+    })?;
+    let target_width = target_width.parse::<u32>().map_err(|_| {
+        AppError::from_status(StatusCode::BAD_GATEWAY).with_details(json!({
+            "provider": "vector-engine",
+            "message": "宽度无效",
+        }))
+    })?;
+    let target_height = target_height.parse::<u32>().map_err(|_| {
+        AppError::from_status(StatusCode::BAD_GATEWAY).with_details(json!({
+            "provider": "vector-engine",
+            "message": "高度无效",
+        }))
+    })?;
+    let decoded = image::load_from_memory(output.bytes.as_slice()).map_err(|error| {
+        AppError::from_status(StatusCode::BAD_GATEWAY).with_details(json!({
+            "provider": "vector-engine",
+            "message": format!("素材生成结果不是有效图片：{error}"),
+        }))
+    })?;
+    if decoded.width() == target_width && decoded.height() == target_height {
+        return Ok(None);
+    }
+
+    let restored = decoded.resize_to_fill(
+        target_width,
+        target_height,
+        image::imageops::FilterType::Lanczos3,
+    );
+    Ok(Some(DownloadedOpenAiImage {
+        bytes: encode_editor_image_edit_png(
+            restored,
+            StatusCode::BAD_GATEWAY,
+            "恢复宣发素材交付尺寸失败",
+        )?,
+        mime_type: "image/png".to_string(),
+        extension: "png".to_string(),
+    }))
 }
 
 pub async fn edit_editor_image(
@@ -2342,57 +2511,27 @@ pub(crate) async fn edit_editor_image_for_owner(
     let (provider_width, provider_height) =
         image::load_from_memory(provider_image.bytes.as_slice())
             .map(|image| (image.width(), image.height()))
-            .unwrap_or((
-                edit_dimensions.provider_width,
-                edit_dimensions.provider_height,
-            ));
-    let source_persisted = persist_editor_generated_image(
-        state,
-        caller.owner_user_id.as_str(),
-        generated.task_id.as_str(),
-        &provider_image,
-        prompt.as_str(),
-        generated.actual_prompt.as_deref(),
-        EDITOR_IMAGE_EDIT_SOURCE_ASSET_KIND,
-        "edit-images",
-        "image-provider-source",
-        "provider_source",
-        "vector-engine",
-    )
-    .await?;
+            .map_err(|error| {
+                AppError::from_status(StatusCode::BAD_GATEWAY).with_details(json!({
+                    "provider": "vector-engine",
+                    "message": format!("图片改造结果不是有效图片：{error}"),
+                }))
+            })?;
     let asset_label =
         resolve_editor_generated_asset_label(payload.asset_label.clone(), "图片修改结果");
-    let source_label =
-        editor_generated_asset_variant_label(asset_label.as_str(), "原始输出");
-    let _source_record = persist_editor_generated_asset(
-        state,
-        PersistEditorGeneratedAssetInput {
-            project_id: payload.project_id.clone(),
-            owner_user_id: caller.owner_user_id.clone(),
-            folder_id: payload
-                .asset_folder_id
-                .clone()
-                .or_else(|| Some(EDITOR_ASSET_DEFAULT_FOLDER_ID.to_string())),
-            label: source_label,
-            image_src: editor_media_src_from_object_key(source_persisted.object_key.as_str()),
-            object_key: Some(source_persisted.object_key),
-            asset_object_id: Some(source_persisted.asset_object_id),
-            width: provider_width,
-            height: provider_height,
-            prompt: prompt.clone(),
-            actual_prompt: generated.actual_prompt.clone(),
-            model: generation_options.model.to_string(),
-            provider: "VectorEngine".to_string(),
-            task_id: generated.task_id.clone(),
-            source_resource_id: payload.source_resource_id.clone(),
-            asset_kind: Some(EDITOR_IMAGE_EDIT_SOURCE_ASSET_KIND.to_string()),
-            generation_inputs: payload.generation_inputs.clone(),
-            thumbnail_src: None,
-            generation_cost_mud_points: 0,
-        },
-    )
-    .await?;
-    let image = restore_editor_image_edit_output_dimensions(provider_image, &edit_dimensions)?;
+    let (image, dimension_restore_error) =
+        restore_editor_image_edit_output_dimensions_or_original(provider_image, &edit_dimensions);
+    if let Some(error) = dimension_restore_error {
+        tracing::warn!(
+            task_id = %generated.task_id,
+            provider_width,
+            provider_height,
+            target_width = edit_dimensions.target_width,
+            target_height = edit_dimensions.target_height,
+            error = ?error,
+            "画板快速编辑尺寸恢复失败，保留并上传 provider 原图"
+        );
+    }
     let (width, height) = image::load_from_memory(image.bytes.as_slice())
         .map(|image| (image.width(), image.height()))
         .unwrap_or((1024, 1024));
@@ -2429,6 +2568,8 @@ pub(crate) async fn edit_editor_image_for_owner(
             model: generation_options.model.to_string(),
             provider: "VectorEngine".to_string(),
             task_id: generated.task_id.clone(),
+            group_task_id: None,
+            group_task_expected_asset_count: None,
             source_resource_id: payload.source_resource_id,
             asset_kind: payload.asset_kind,
             generation_inputs: payload.generation_inputs,
@@ -2560,6 +2701,8 @@ pub(crate) async fn remove_editor_image_background_for_owner(
             model: "BiRefNet".to_string(),
             provider: "BiRefNet".to_string(),
             task_id: task_id.clone(),
+            group_task_id: None,
+            group_task_expected_asset_count: None,
             source_resource_id: payload.source_resource_id,
             asset_kind: payload.asset_kind,
             generation_inputs: payload.generation_inputs,
@@ -2615,13 +2758,19 @@ struct EditorBackgroundRemovalImage {
     height: u32,
 }
 
+struct EditorScreenBackgroundRemovalOutput {
+    image: DownloadedOpenAiImage,
+    provider: &'static str,
+    model: String,
+}
+
 async fn remove_editor_generated_screen_background_with_bgfilter(
     state: &AppState,
     image: &DownloadedOpenAiImage,
     screen_color: EditorScreenBackgroundColor,
     seg_model: &str,
     audit: &crate::external_api_audit::ExternalApiAuditContext,
-) -> Result<DownloadedOpenAiImage, AppError> {
+) -> Result<EditorScreenBackgroundRemovalOutput, AppError> {
     if let Some(remaining) = editor_bgfilter_circuit_open_remaining(state) {
         // 熔断打开只跳过 BgFilter 调用本身，仍要走阿里云兜底；绝不能在 cooldown 内直接退化到
         // 低质量本地扣色，否则整段冷却期从「双供应商降级」退化成单一本地键色扣除。
@@ -2645,7 +2794,11 @@ async fn remove_editor_generated_screen_background_with_bgfilter(
     {
         Ok(image) => {
             record_editor_bgfilter_success();
-            Ok(image)
+            Ok(EditorScreenBackgroundRemovalOutput {
+                image,
+                provider: "BgFilter",
+                model: seg_model.to_string(),
+            })
         }
         Err(error) => {
             record_editor_bgfilter_failure(state);
@@ -2683,7 +2836,7 @@ async fn fallback_editor_screen_background_removal(
     image: &DownloadedOpenAiImage,
     screen_color: EditorScreenBackgroundColor,
     audit: &crate::external_api_audit::ExternalApiAuditContext,
-) -> Result<DownloadedOpenAiImage, AppError> {
+) -> Result<EditorScreenBackgroundRemovalOutput, AppError> {
     match crate::aliyun_matting::segment_image_with_aliyun_matting(
         state,
         image,
@@ -2691,7 +2844,11 @@ async fn fallback_editor_screen_background_removal(
     )
     .await
     {
-        Ok(image) => Ok(image),
+        Ok(image) => Ok(EditorScreenBackgroundRemovalOutput {
+            image,
+            provider: "Aliyun Matting",
+            model: "segment-common-image".to_string(),
+        }),
         Err(error) => {
             tracing::warn!(
                 provider = "aliyun-matting",
@@ -2716,7 +2873,13 @@ async fn fallback_editor_screen_background_removal(
                 )
                 .await;
             }
-            remove_editor_generated_green_screen_background(image, screen_color)
+            remove_editor_generated_green_screen_background(image, screen_color).map(|image| {
+                EditorScreenBackgroundRemovalOutput {
+                    image,
+                    provider: "Genarrative Local",
+                    model: "screen-color-keying".to_string(),
+                }
+            })
         }
     }
 }
@@ -2887,9 +3050,13 @@ async fn request_editor_generated_screen_background_with_bgfilter(
         .get("x-bgfilter-screen-color")
         .and_then(|value| value.to_str().ok())
         .map(ToOwned::to_owned);
-    let bytes =
-        read_editor_image_removal_response_bytes(response, "bgfilter", "BgFilter", request_started_at)
-            .await?;
+    let bytes = read_editor_image_removal_response_bytes(
+        response,
+        "bgfilter",
+        "BgFilter",
+        request_started_at,
+    )
+    .await?;
     if bytes.is_empty() {
         // HTTP 已成功但 body 为空属于上游内容缺陷（5xx 归类正确），仍补 latencyMs 与 Aliyun 兜底口径对齐。
         return Err(
@@ -3248,6 +3415,7 @@ struct PersistEditorSpritesheetSlicesInput {
     asset_folder_id: Option<String>,
     source_resource_id: Option<String>,
     task_id: String,
+    group_task_id: Option<String>,
     prompt: String,
     actual_prompt: Option<String>,
     model: String,
@@ -3272,6 +3440,12 @@ async fn persist_editor_spritesheet_slices(
         );
     }
 
+    let expected_asset_count = u32::try_from(slices.len()).map_err(|_| {
+        AppError::from_status(StatusCode::UNPROCESSABLE_ENTITY).with_details(json!({
+            "provider": "editor-icon-spritesheet-slicing",
+            "message": "图集拆分产物数量超过支持范围。",
+        }))
+    })?;
     let mut results = Vec::with_capacity(slices.len());
     for (index, slice) in slices.into_iter().enumerate() {
         let image = DownloadedOpenAiImage {
@@ -3312,6 +3486,11 @@ async fn persist_editor_spritesheet_slices(
                 model: input.model.clone(),
                 provider: input.provider.clone(),
                 task_id: input.task_id.clone(),
+                group_task_id: input.group_task_id.clone(),
+                group_task_expected_asset_count: input
+                    .group_task_id
+                    .as_ref()
+                    .map(|_| expected_asset_count),
                 source_resource_id: input.source_resource_id.clone(),
                 asset_kind: Some("icon".to_string()),
                 generation_inputs: input.generation_inputs.clone(),
@@ -3329,6 +3508,24 @@ async fn persist_editor_spritesheet_slices(
             asset: record.asset,
         });
     }
+    if let Some(group_task_id) = input.group_task_id.as_deref() {
+        let asset_ids = results
+            .iter()
+            .filter_map(|result| result.asset.as_ref().map(|asset| asset.asset_id.clone()))
+            .collect::<Vec<_>>();
+        state
+            .spacetime_client()
+            .complete_editor_asset_group_cohort(EditorAssetGroupCohortCompleteRecordInput {
+                owner_user_id: input.owner_user_id,
+                task_id: input.task_id,
+                group_task_id: group_task_id.to_string(),
+                expected_asset_count,
+                asset_ids,
+                completed_at_micros: current_utc_micros(),
+            })
+            .await
+            .map_err(map_editor_project_error)?;
+    }
     Ok(results)
 }
 
@@ -3530,21 +3727,22 @@ pub(crate) async fn generate_editor_icon_spritesheet_for_owner(
         .asset_folder_id
         .clone()
         .or_else(|| Some(EDITOR_ASSET_DEFAULT_FOLDER_ID.to_string()));
-    let source_persisted = persist_editor_green_screen_source_image(
+    let source_persisted = persist_editor_provider_source_image(
         state,
         caller.owner_user_id.as_str(),
         generated.task_id.as_str(),
         &image,
         prompt.as_str(),
         generated.actual_prompt.as_deref(),
+        EDITOR_ICON_SPRITESHEET_ASSET_KIND,
         "icon-spritesheets",
         "spritesheet",
     )
     .await?;
-    let source_record = persist_editor_green_screen_source_resource(
+    let source_record = persist_editor_provider_source_resource(
         state,
         source_persisted,
-        PersistEditorGreenScreenSourceResourceInput {
+        PersistEditorProviderSourceResourceInput {
             project_id: payload.project_id.clone(),
             owner_user_id: caller.owner_user_id.clone(),
             folder_id: asset_folder_id.clone(),
@@ -3556,7 +3754,9 @@ pub(crate) async fn generate_editor_icon_spritesheet_for_owner(
             model: generation_options.model.to_string(),
             task_id: generated.task_id.clone(),
             source_resource_id: None,
+            asset_kind: Some("icon-spritesheet".to_string()),
             generation_inputs: generation_inputs.clone(),
+            generation_cost_mud_points: u64::from(expected_price_mud_points),
         },
     )
     .await?;
@@ -3568,7 +3768,7 @@ pub(crate) async fn generate_editor_icon_spritesheet_for_owner(
             .or_else(|| payload.project_id.clone()),
         request_id: Some(request_context.request_id().to_string()),
     };
-    let image = remove_editor_generated_screen_background_with_bgfilter(
+    let removal = remove_editor_generated_screen_background_with_bgfilter(
         state,
         &image,
         screen_color,
@@ -3576,6 +3776,12 @@ pub(crate) async fn generate_editor_icon_spritesheet_for_owner(
         &matting_audit,
     )
     .await?;
+    let image = removal.image;
+    let matting_generation_inputs = build_editor_derived_asset_generation_inputs(
+        "图标图集抠图",
+        &removal.model,
+        &source_record,
+    );
     let (spritesheet_width, spritesheet_height) = image::load_from_memory(image.bytes.as_slice())
         .map(|image| (image.width(), image.height()))
         .unwrap_or((512, 512));
@@ -3585,13 +3791,13 @@ pub(crate) async fn generate_editor_icon_spritesheet_for_owner(
         owner_user_id.as_str(),
         generated.task_id.as_str(),
         &image,
-        prompt.as_str(),
-        generated.actual_prompt.as_deref(),
+        "去除纯色背景",
+        None,
         EDITOR_ICON_SPRITESHEET_ASSET_KIND,
         "icon-spritesheets",
         "spritesheet",
         "spritesheet",
-        "vector-engine",
+        removal.provider,
     )
     .await?;
     let spritesheet_image_src =
@@ -3608,16 +3814,21 @@ pub(crate) async fn generate_editor_icon_spritesheet_for_owner(
             asset_object_id: Some(spritesheet_persisted.asset_object_id.clone()),
             width: spritesheet_width,
             height: spritesheet_height,
-            prompt: prompt.clone(),
-            actual_prompt: generated.actual_prompt.clone(),
-            model: generation_options.model.to_string(),
-            provider: "VectorEngine".to_string(),
+            prompt: "去除纯色背景".to_string(),
+            actual_prompt: None,
+            model: removal.model.clone(),
+            provider: removal.provider.to_string(),
             task_id: generated.task_id.clone(),
-            source_resource_id: None,
+            group_task_id: None,
+            group_task_expected_asset_count: None,
+            source_resource_id: source_record
+                .resource
+                .as_ref()
+                .map(|resource| resource.resource_id.clone()),
             asset_kind: Some("icon-spritesheet".to_string()),
-            generation_inputs: generation_inputs.clone(),
+            generation_inputs: matting_generation_inputs,
             thumbnail_src: None,
-            generation_cost_mud_points: u64::from(expected_price_mud_points),
+            generation_cost_mud_points: 0,
         },
     )
     .await?;
@@ -3644,11 +3855,16 @@ pub(crate) async fn generate_editor_icon_spritesheet_for_owner(
                             .as_ref()
                             .map(|resource| resource.resource_id.clone()),
                         task_id: generated.task_id.clone(),
-                        prompt: prompt.clone(),
-                        actual_prompt: generated.actual_prompt.clone(),
-                        model: generation_options.model.to_string(),
-                        provider: "VectorEngine".to_string(),
-                        generation_inputs: generation_inputs.clone(),
+                        group_task_id: None,
+                        prompt: "自动拆分图集".to_string(),
+                        actual_prompt: None,
+                        model: "connected-components".to_string(),
+                        provider: "Genarrative".to_string(),
+                        generation_inputs: build_editor_derived_asset_generation_inputs(
+                            "图集拆分",
+                            "connected-components",
+                            &spritesheet_record,
+                        ),
                         path_kind: "icon-spritesheet-assets",
                         asset_kind: EDITOR_ICON_SPRITESHEET_SLICE_ASSET_KIND,
                         persistence_provider: "vector-engine",
@@ -3766,6 +3982,7 @@ pub async fn split_editor_icon_spritesheet(
         .resources
         .iter()
         .find(|resource| resource.resource_id == source_resource_id)
+        .cloned()
         .ok_or_else(|| {
             AppError::from_status(StatusCode::NOT_FOUND).with_details(json!({
                 "provider": "editor-icon-spritesheet-slicing",
@@ -3780,6 +3997,14 @@ pub async fn split_editor_icon_spritesheet(
             })),
         );
     }
+    let task_id = build_prefixed_uuid_id("editor-atlas-split-");
+    let group_task_id = resolve_editor_manual_atlas_split_group_task_id(
+        &state,
+        owner_user_id.as_str(),
+        &source_resource,
+    )
+    .await?
+    .unwrap_or_else(|| task_id.clone());
 
     let reference =
         parse_editor_reference_image(&state, owner_user_id.as_str(), source_resource_id.as_str())
@@ -3798,7 +4023,6 @@ pub async fn split_editor_icon_spritesheet(
             }))
         })?;
     validate_editor_icon_spritesheet_manual_slice_count(slices.len())?;
-    let task_id = build_prefixed_uuid_id("editor-atlas-split-");
     let prompt = source_resource
         .prompt
         .clone()
@@ -3824,6 +4048,7 @@ pub async fn split_editor_icon_spritesheet(
                 .or_else(|| Some(EDITOR_ASSET_DEFAULT_FOLDER_ID.to_string())),
             source_resource_id: Some(source_resource_id),
             task_id,
+            group_task_id: Some(group_task_id),
             prompt,
             actual_prompt,
             model,
@@ -3887,6 +4112,47 @@ fn validate_editor_icon_spritesheet_manual_source(
     validate_editor_icon_spritesheet_manual_dimensions(width, height)
 }
 
+async fn resolve_editor_manual_atlas_split_group_task_id(
+    state: &AppState,
+    owner_user_id: &str,
+    source_resource: &EditorProjectResourceRecord,
+) -> Result<Option<String>, AppError> {
+    let lookup = editor_manual_atlas_split_group_source_lookup_input(
+        owner_user_id,
+        source_resource.resource_id.as_str(),
+        source_resource.source_resource_id.as_deref(),
+        source_resource.asset_object_id.as_deref(),
+        source_resource.object_key.as_deref(),
+    );
+    let asset = state
+        .spacetime_client()
+        .find_editor_asset_group_source(lookup)
+        .await
+        .map_err(map_editor_project_error)?;
+    Ok(asset.and_then(|asset| normalize_optional_string(asset.task_id)))
+}
+
+fn editor_manual_atlas_split_group_source_lookup_input(
+    owner_user_id: &str,
+    resource_id: &str,
+    source_resource_id: Option<&str>,
+    asset_object_id: Option<&str>,
+    object_key: Option<&str>,
+) -> EditorAssetGroupSourceLookupRecordInput {
+    let mut source_resource_ids = vec![resource_id.to_string()];
+    if let Some(source_resource_id) =
+        normalize_optional_string(source_resource_id.map(str::to_string))
+    {
+        source_resource_ids.push(source_resource_id);
+    }
+    EditorAssetGroupSourceLookupRecordInput {
+        owner_user_id: owner_user_id.to_string(),
+        source_resource_ids,
+        asset_object_id: asset_object_id.map(str::to_string),
+        object_key: object_key.map(str::to_string),
+    }
+}
+
 fn validate_editor_icon_spritesheet_manual_dimensions(
     width: u32,
     height: u32,
@@ -4123,21 +4389,22 @@ pub(crate) async fn extract_editor_ui_design_assets_for_owner(
         .asset_folder_id
         .clone()
         .or_else(|| Some(EDITOR_ASSET_DEFAULT_FOLDER_ID.to_string()));
-    let source_persisted = persist_editor_green_screen_source_image(
+    let source_persisted = persist_editor_provider_source_image(
         state,
         caller.owner_user_id.as_str(),
         generated.task_id.as_str(),
         &image,
         prompt.as_str(),
         generated.actual_prompt.as_deref(),
+        EDITOR_UI_DESIGN_SPRITESHEET_ASSET_KIND,
         "ui-design-spritesheets",
         "spritesheet",
     )
     .await?;
-    let source_record = persist_editor_green_screen_source_resource(
+    let source_record = persist_editor_provider_source_resource(
         state,
         source_persisted,
-        PersistEditorGreenScreenSourceResourceInput {
+        PersistEditorProviderSourceResourceInput {
             project_id: payload.project_id.clone(),
             owner_user_id: caller.owner_user_id.clone(),
             folder_id: asset_folder_id.clone(),
@@ -4149,7 +4416,9 @@ pub(crate) async fn extract_editor_ui_design_assets_for_owner(
             model: generation_options.model.to_string(),
             task_id: generated.task_id.clone(),
             source_resource_id: None,
+            asset_kind: Some("icon-spritesheet".to_string()),
             generation_inputs: generation_inputs.clone(),
+            generation_cost_mud_points: u64::from(expected_price_mud_points),
         },
     )
     .await?;
@@ -4161,7 +4430,7 @@ pub(crate) async fn extract_editor_ui_design_assets_for_owner(
             .or_else(|| payload.project_id.clone()),
         request_id: Some(request_context.request_id().to_string()),
     };
-    let image = remove_editor_generated_screen_background_with_bgfilter(
+    let removal = remove_editor_generated_screen_background_with_bgfilter(
         state,
         &image,
         screen_color,
@@ -4169,6 +4438,9 @@ pub(crate) async fn extract_editor_ui_design_assets_for_owner(
         &matting_audit,
     )
     .await?;
+    let image = removal.image;
+    let matting_generation_inputs =
+        build_editor_derived_asset_generation_inputs("UI图集抠图", &removal.model, &source_record);
     let (spritesheet_width, spritesheet_height) = image::load_from_memory(image.bytes.as_slice())
         .map(|image| (image.width(), image.height()))
         .unwrap_or((512, 512));
@@ -4178,13 +4450,13 @@ pub(crate) async fn extract_editor_ui_design_assets_for_owner(
         owner_user_id.as_str(),
         generated.task_id.as_str(),
         &image,
-        prompt.as_str(),
-        generated.actual_prompt.as_deref(),
+        "去除纯色背景",
+        None,
         EDITOR_UI_DESIGN_SPRITESHEET_ASSET_KIND,
         "ui-design-spritesheets",
         "spritesheet",
         "spritesheet",
-        "vector-engine",
+        removal.provider,
     )
     .await?;
     let spritesheet_image_src =
@@ -4201,16 +4473,21 @@ pub(crate) async fn extract_editor_ui_design_assets_for_owner(
             asset_object_id: Some(spritesheet_persisted.asset_object_id.clone()),
             width: spritesheet_width,
             height: spritesheet_height,
-            prompt: prompt.clone(),
-            actual_prompt: generated.actual_prompt.clone(),
-            model: generation_options.model.to_string(),
-            provider: "VectorEngine".to_string(),
+            prompt: "去除纯色背景".to_string(),
+            actual_prompt: None,
+            model: removal.model.clone(),
+            provider: removal.provider.to_string(),
             task_id: generated.task_id.clone(),
-            source_resource_id: None,
+            group_task_id: None,
+            group_task_expected_asset_count: None,
+            source_resource_id: source_record
+                .resource
+                .as_ref()
+                .map(|resource| resource.resource_id.clone()),
             asset_kind: Some("icon-spritesheet".to_string()),
-            generation_inputs: generation_inputs.clone(),
+            generation_inputs: matting_generation_inputs,
             thumbnail_src: None,
-            generation_cost_mud_points: u64::from(expected_price_mud_points),
+            generation_cost_mud_points: 0,
         },
     )
     .await?;
@@ -4234,11 +4511,16 @@ pub(crate) async fn extract_editor_ui_design_assets_for_owner(
                             .as_ref()
                             .map(|resource| resource.resource_id.clone()),
                         task_id: generated.task_id.clone(),
-                        prompt: prompt.clone(),
-                        actual_prompt: generated.actual_prompt.clone(),
-                        model: generation_options.model.to_string(),
-                        provider: "VectorEngine".to_string(),
-                        generation_inputs: generation_inputs.clone(),
+                        group_task_id: None,
+                        prompt: "自动拆分图集".to_string(),
+                        actual_prompt: None,
+                        model: "connected-components".to_string(),
+                        provider: "Genarrative".to_string(),
+                        generation_inputs: build_editor_derived_asset_generation_inputs(
+                            "图集拆分",
+                            "connected-components",
+                            &spritesheet_record,
+                        ),
                         path_kind: "ui-design-assets",
                         asset_kind: EDITOR_UI_DESIGN_ASSET_IMAGE_KIND,
                         persistence_provider: "vector-engine",
@@ -4792,6 +5074,7 @@ struct EditorPayloadMediaReference {
     image_src: String,
     object_key: Option<String>,
     asset_object_id: Option<String>,
+    asset_kind: Option<String>,
 }
 
 fn sanitize_editor_payload_media(
@@ -4808,6 +5091,7 @@ fn sanitize_editor_payload_media(
                     image_src: resource.image_src.clone(),
                     object_key: resource.object_key.clone(),
                     asset_object_id: resource.asset_object_id.clone(),
+                    asset_kind: resource.asset_kind.clone(),
                 },
             )
         })
@@ -4844,6 +5128,11 @@ fn sanitize_editor_payload_media_value(
                     "assetObjectId",
                     media.asset_object_id.as_ref(),
                 );
+                if object.get("assetKind").and_then(Value::as_str)
+                    == Some(EDITOR_LEGACY_GREEN_SCREEN_SOURCE_ASSET_KIND)
+                {
+                    set_optional_json_string_field(object, "assetKind", media.asset_kind.as_ref());
+                }
             }
             for child in object.values_mut() {
                 sanitize_editor_payload_media_value(child, current_media.as_ref(), resource_media);
@@ -4974,6 +5263,8 @@ pub(crate) async fn persist_editor_generated_asset(
                 generation_cost_mud_points: input.generation_cost_mud_points,
                 now_micros,
                 thumbnail_src: normalize_optional_string(input.thumbnail_src),
+                group_task_id: normalize_optional_string(input.group_task_id),
+                group_task_expected_asset_count: input.group_task_expected_asset_count,
             })
             .await
             .map_err(map_editor_project_error)?;
@@ -5012,6 +5303,8 @@ pub(crate) async fn persist_editor_generated_media_asset(
             model: input.model,
             provider: input.provider,
             task_id: input.task_id,
+            group_task_id: None,
+            group_task_expected_asset_count: None,
             source_resource_id: input.source_resource_id,
             asset_kind: input.asset_kind,
             generation_inputs: input.generation_inputs,
@@ -6110,7 +6403,7 @@ pub(crate) struct PersistedEditorGeneratedImage {
     pub(crate) asset_object_id: String,
 }
 
-struct PersistEditorGreenScreenSourceResourceInput {
+struct PersistEditorProviderSourceResourceInput {
     project_id: Option<String>,
     owner_user_id: String,
     folder_id: Option<String>,
@@ -6122,7 +6415,9 @@ struct PersistEditorGreenScreenSourceResourceInput {
     model: String,
     task_id: String,
     source_resource_id: Option<String>,
+    asset_kind: Option<String>,
     generation_inputs: Option<Value>,
+    generation_cost_mud_points: u64,
 }
 
 pub(crate) async fn persist_editor_generated_image(
@@ -6228,13 +6523,14 @@ pub(crate) async fn persist_editor_generated_image(
     })
 }
 
-async fn persist_editor_green_screen_source_image(
+async fn persist_editor_provider_source_image(
     state: &AppState,
     owner_user_id: &str,
     task_id: &str,
     image: &DownloadedOpenAiImage,
     prompt: &str,
     actual_prompt: Option<&str>,
+    asset_kind: &str,
     path_kind: &str,
     file_stem: &str,
 ) -> Result<PersistedEditorGeneratedImage, AppError> {
@@ -6245,19 +6541,19 @@ async fn persist_editor_green_screen_source_image(
         image,
         prompt,
         actual_prompt,
-        EDITOR_GREEN_SCREEN_SOURCE_ASSET_KIND,
+        asset_kind,
         path_kind,
-        &format!("{file_stem}-green-screen-source"),
-        EDITOR_GREEN_SCREEN_SOURCE_SLOT,
+        &format!("{file_stem}-provider-source"),
+        EDITOR_PROVIDER_SOURCE_SLOT,
         "vector-engine",
     )
     .await
 }
 
-async fn persist_editor_green_screen_source_resource(
+async fn persist_editor_provider_source_resource(
     state: &AppState,
     persisted: PersistedEditorGeneratedImage,
-    input: PersistEditorGreenScreenSourceResourceInput,
+    input: PersistEditorProviderSourceResourceInput,
 ) -> Result<EditorGeneratedAssetRecord, AppError> {
     persist_editor_generated_asset(
         state,
@@ -6276,11 +6572,13 @@ async fn persist_editor_green_screen_source_resource(
             model: input.model,
             provider: "VectorEngine".to_string(),
             task_id: input.task_id,
+            group_task_id: None,
+            group_task_expected_asset_count: None,
             source_resource_id: input.source_resource_id,
-            asset_kind: Some(EDITOR_GREEN_SCREEN_SOURCE_ASSET_KIND.to_string()),
+            asset_kind: input.asset_kind,
             generation_inputs: input.generation_inputs,
             thumbnail_src: None,
-            generation_cost_mud_points: 0,
+            generation_cost_mud_points: input.generation_cost_mud_points,
         },
     )
     .await
@@ -6814,7 +7112,9 @@ mod tests {
             None,
             "body-read 传输故障不应带 HTTP statusCode，否则会落成 5xx"
         );
-        assert!(!crate::external_api_audit::matting_failure_audit_timeout(&error));
+        assert!(!crate::external_api_audit::matting_failure_audit_timeout(
+            &error
+        ));
         assert_eq!(
             crate::external_api_audit::matting_failure_audit_latency_ms(&error),
             Some(137)
@@ -6827,15 +7127,22 @@ mod tests {
 
     #[test]
     fn bgfilter_body_read_timeout_maps_to_gateway_timeout_and_transport() {
-        let error =
-            editor_image_removal_body_read_error("bgfilter", "BgFilter", true, 42, "operation timed out");
+        let error = editor_image_removal_body_read_error(
+            "bgfilter",
+            "BgFilter",
+            true,
+            42,
+            "operation timed out",
+        );
 
         assert_eq!(error.status_code(), StatusCode::GATEWAY_TIMEOUT);
         assert_eq!(
             crate::external_api_audit::matting_failure_audit_status_code(&error),
             None
         );
-        assert!(crate::external_api_audit::matting_failure_audit_timeout(&error));
+        assert!(crate::external_api_audit::matting_failure_audit_timeout(
+            &error
+        ));
         assert_eq!(
             crate::external_api_audit::matting_failure_audit_latency_ms(&error),
             Some(42)
@@ -6846,7 +7153,8 @@ mod tests {
         EditorScreenBackgroundDecision {
             color: parse_editor_screen_background_color(Some(hex))
                 .expect("hex should be a known background color candidate"),
-            mode: crate::editor_screen_background_decision::EditorScreenBackgroundDecisionMode::Manual,
+            mode:
+                crate::editor_screen_background_decision::EditorScreenBackgroundDecisionMode::Manual,
             attempts: 0,
             fallback: false,
         }
@@ -7479,15 +7787,14 @@ mod tests {
         let extra = image::load_from_memory(references[1].bytes.as_slice()).unwrap();
         assert_eq!((extra.width(), extra.height()), (512, 336));
 
-        let restored = restore_editor_image_edit_output_dimensions(
-            DownloadedOpenAiImage {
-                bytes: encode_png(1552, 1040),
-                mime_type: "image/png".to_string(),
-                extension: "png".to_string(),
-            },
-            &dimensions,
-        )
-        .expect("provider output should restore source dimensions");
+        let provider_output = DownloadedOpenAiImage {
+            bytes: encode_png(1552, 1040),
+            mime_type: "image/png".to_string(),
+            extension: "png".to_string(),
+        };
+        let restored = restore_editor_image_edit_output_dimensions(&provider_output, &dimensions)
+            .expect("provider output should restore source dimensions")
+            .expect("aligned provider output should require a transformation");
         let restored_image = image::load_from_memory(restored.bytes.as_slice()).unwrap();
         assert_eq!(
             (restored_image.width(), restored_image.height()),
@@ -7497,6 +7804,91 @@ mod tests {
         assert_eq!(restored.extension, "png");
     }
 
+    #[test]
+    fn publication_material_generation_restores_provider_output_to_workflow_dimensions() {
+        let image = image::DynamicImage::new_rgba8(944, 704);
+        let mut bytes = Cursor::new(Vec::new());
+        image
+            .write_to(&mut bytes, image::ImageFormat::Png)
+            .expect("test image should encode");
+
+        let provider_output = DownloadedOpenAiImage {
+            bytes: bytes.into_inner(),
+            mime_type: "image/png".to_string(),
+            extension: "png".to_string(),
+        };
+        let restored = restore_editor_generated_image_output_dimensions(
+            &provider_output,
+            GPT_IMAGE_2_MODEL,
+            "720x540",
+        )
+        .expect("provider output should restore delivery dimensions")
+        .expect("mismatched provider output should require a transformation");
+        let restored_image = image::load_from_memory(restored.bytes.as_slice()).unwrap();
+
+        assert_eq!(
+            (restored_image.width(), restored_image.height()),
+            (720, 540)
+        );
+        assert_eq!(restored.mime_type, "image/png");
+        assert_eq!(restored.extension, "png");
+    }
+
+    #[test]
+    fn nanobanana_generation_keeps_provider_dimensions_for_scalar_size_tiers() {
+        let image = image::DynamicImage::new_rgba8(896, 896);
+        let mut bytes = Cursor::new(Vec::new());
+        image
+            .write_to(&mut bytes, image::ImageFormat::Png)
+            .expect("test image should encode");
+
+        let provider_output = DownloadedOpenAiImage {
+            bytes: bytes.into_inner(),
+            mime_type: "image/png".to_string(),
+            extension: "png".to_string(),
+        };
+        let (restored, restore_error) =
+            restore_editor_generated_image_output_dimensions_or_original(
+                provider_output,
+                EDITOR_IMAGE_MODEL_NANOBANANA2,
+                "1024",
+            );
+        assert!(restore_error.is_none());
+        let restored_image = image::load_from_memory(restored.bytes.as_slice()).unwrap();
+
+        assert_eq!(
+            (restored_image.width(), restored_image.height()),
+            (896, 896)
+        );
+    }
+
+    #[test]
+    fn failed_dimension_restore_keeps_provider_output_for_single_upload() {
+        let image = image::DynamicImage::new_rgba8(896, 896);
+        let mut bytes = Cursor::new(Vec::new());
+        image
+            .write_to(&mut bytes, image::ImageFormat::Png)
+            .expect("test image should encode");
+        let provider_output = DownloadedOpenAiImage {
+            bytes: bytes.into_inner(),
+            mime_type: "image/png".to_string(),
+            extension: "png".to_string(),
+        };
+        let expected_bytes = provider_output.bytes.clone();
+
+        let (delivery_output, restore_error) =
+            restore_editor_generated_image_output_dimensions_or_original(
+                provider_output,
+                GPT_IMAGE_2_MODEL,
+                "invalid-size",
+            );
+
+        assert!(restore_error.is_some());
+        assert_eq!(delivery_output.bytes, expected_bytes);
+        assert_eq!(delivery_output.mime_type, "image/png");
+        assert_eq!(delivery_output.extension, "png");
+    }
+
     #[test]
     fn editor_generation_dimensions_follow_model_options() {
         let default_generation = normalize_editor_generation_options(None, Some("1:1"), Some("1K"));
@@ -8137,7 +8529,7 @@ mod tests {
         );
         let source = editor_project_resource_for_canvas_test(
             "resource-character-source",
-            EDITOR_GREEN_SCREEN_SOURCE_ASSET_KIND,
+            "character",
             400,
             600,
         );
@@ -8155,6 +8547,7 @@ mod tests {
         assert_eq!(items[0]["y"], json!(-70.0));
         assert_eq!(items[1]["resourceId"], json!("resource-character-source"));
         assert_eq!(items[1]["title"], json!("角色形象 1（原图）"));
+        assert_eq!(items[1]["assetKind"], json!("character"));
         assert_eq!(items[1]["x"], json!(432.0));
         assert_eq!(items[1]["y"], json!(-70.0));
 
@@ -8222,7 +8615,7 @@ mod tests {
         );
         let source = editor_project_resource_for_canvas_test(
             "resource-ui-source",
-            EDITOR_GREEN_SCREEN_SOURCE_ASSET_KIND,
+            "icon-spritesheet",
             512,
             512,
         );
@@ -8250,9 +8643,9 @@ mod tests {
         );
         assert_eq!(items[0]["resourceId"], json!("resource-ui-sheet"));
         assert_eq!(items[1]["resourceId"], json!("resource-ui-source"));
+        assert_eq!(items[1]["assetKind"], json!("icon-spritesheet"));
         assert_eq!(items[2]["resourceId"], json!("resource-ui-slice"));
-        let source_right =
-            items[1]["x"].as_f64().unwrap() + items[1]["width"].as_f64().unwrap();
+        let source_right = items[1]["x"].as_f64().unwrap() + items[1]["width"].as_f64().unwrap();
         assert!(items[2]["x"].as_f64().unwrap() > source_right);
     }
 
@@ -8278,7 +8671,7 @@ mod tests {
         );
         let source = editor_project_resource_for_canvas_test(
             "resource-icon-source",
-            EDITOR_GREEN_SCREEN_SOURCE_ASSET_KIND,
+            "icon-spritesheet",
             512,
             512,
         );
@@ -8293,6 +8686,7 @@ mod tests {
         assert_eq!(items.len(), 2);
         assert_eq!(items[0]["resourceId"], json!("resource-icon-sheet"));
         assert_eq!(items[1]["resourceId"], json!("resource-icon-source"));
+        assert_eq!(items[1]["assetKind"], json!("icon-spritesheet"));
         assert_eq!(
             primary_layer_id.as_deref(),
             Some("layer-editor-resource-resource-icon-sheet")
@@ -8792,21 +9186,20 @@ mod tests {
     }
 
     #[test]
-    fn editor_image_edit_rejects_icons_but_allows_icon_specs() {
-        for asset_kind in ["icon", "icon-spritesheet"] {
-            let error = ensure_editor_image_edit_asset_kind_allowed(Some(asset_kind))
-                .expect_err("icon assets should not support quick edit");
-            assert_eq!(error.status_code(), StatusCode::BAD_REQUEST);
-            assert_eq!(
-                error.details().and_then(|details| details.get("message")),
-                Some(&json!("图标与图标图集不支持快速编辑")),
-            );
-            assert_eq!(
-                error.details().and_then(|details| details.get("assetKind")),
-                Some(&json!(asset_kind)),
-            );
-        }
+    fn editor_image_edit_rejects_individual_icons_but_allows_spritesheets_and_specs() {
+        let error = ensure_editor_image_edit_asset_kind_allowed(Some("icon"))
+            .expect_err("individual icon assets should not support quick edit");
+        assert_eq!(error.status_code(), StatusCode::BAD_REQUEST);
+        assert_eq!(
+            error.details().and_then(|details| details.get("message")),
+            Some(&json!("单个图标不支持快速编辑")),
+        );
+        assert_eq!(
+            error.details().and_then(|details| details.get("assetKind")),
+            Some(&json!("icon")),
+        );
 
+        assert!(ensure_editor_image_edit_asset_kind_allowed(Some("icon-spritesheet")).is_ok());
         assert!(ensure_editor_image_edit_asset_kind_allowed(Some("icon-spec")).is_ok());
         assert!(ensure_editor_image_edit_asset_kind_allowed(Some("image")).is_ok());
         assert!(ensure_editor_image_edit_asset_kind_allowed(None).is_ok());
@@ -8942,6 +9335,41 @@ mod tests {
         assert_eq!(request.canvas_completion.placeholder.width, 360.0);
     }
 
+    #[test]
+    fn editor_manual_atlas_split_lookup_keeps_original_provenance_after_project_copy() {
+        let mut copied_resource = editor_project_resource_for_canvas_test(
+            "copied-resource-atlas-1",
+            "icon-spritesheet",
+            1024,
+            1024,
+        );
+        copied_resource.source_resource_id = Some("resource-atlas-1".to_string());
+        copied_resource.asset_object_id = Some("asset-object-atlas-1".to_string());
+        copied_resource.object_key = Some("generated/icon-atlas-1.png".to_string());
+
+        let lookup = editor_manual_atlas_split_group_source_lookup_input(
+            "user-1",
+            copied_resource.resource_id.as_str(),
+            copied_resource.source_resource_id.as_deref(),
+            copied_resource.asset_object_id.as_deref(),
+            copied_resource.object_key.as_deref(),
+        );
+
+        assert_eq!(lookup.owner_user_id, "user-1");
+        assert_eq!(
+            lookup.source_resource_ids,
+            vec!["copied-resource-atlas-1", "resource-atlas-1"]
+        );
+        assert_eq!(
+            lookup.asset_object_id.as_deref(),
+            Some("asset-object-atlas-1")
+        );
+        assert_eq!(
+            lookup.object_key.as_deref(),
+            Some("generated/icon-atlas-1.png")
+        );
+    }
+
     #[test]
     fn editor_bgfilter_seg_model_parser_defaults_and_rejects_unknown() {
         assert_eq!(
@@ -9027,9 +9455,9 @@ mod tests {
             "pub(crate) async fn generate_editor_image_for_owner",
             "fn normalize_editor_image_generation_size",
             &[
-                "persist_editor_green_screen_source_image",
+                "persist_editor_provider_source_image",
                 "remove_editor_generated_screen_background_with_bgfilter",
-                "persist_editor_green_screen_source_resource",
+                "persist_editor_provider_source_resource",
                 "if is_character_generation",
             ],
         );
@@ -9038,8 +9466,8 @@ mod tests {
             "pub(crate) async fn generate_editor_image_for_owner",
             "fn normalize_editor_image_generation_size",
             &[
-                "persist_editor_green_screen_source_image",
-                "persist_editor_green_screen_source_resource",
+                "persist_editor_provider_source_image",
+                "persist_editor_provider_source_resource",
                 "remove_editor_generated_screen_background_with_bgfilter",
             ],
         );
@@ -9048,9 +9476,9 @@ mod tests {
             "pub(crate) async fn generate_editor_icon_spritesheet_for_owner",
             "pub async fn extract_editor_ui_design_assets",
             &[
-                "persist_editor_green_screen_source_image",
+                "persist_editor_provider_source_image",
                 "remove_editor_generated_screen_background_with_bgfilter",
-                "persist_editor_green_screen_source_resource",
+                "persist_editor_provider_source_resource",
                 "slice_generated_icon_spritesheet_by_connected_components",
                 "persist_editor_spritesheet_slices",
             ],
@@ -9060,8 +9488,8 @@ mod tests {
             "pub(crate) async fn generate_editor_icon_spritesheet_for_owner",
             "pub async fn extract_editor_ui_design_assets",
             &[
-                "persist_editor_green_screen_source_image",
-                "persist_editor_green_screen_source_resource",
+                "persist_editor_provider_source_image",
+                "persist_editor_provider_source_resource",
                 "remove_editor_generated_screen_background_with_bgfilter",
             ],
         );
@@ -9070,9 +9498,9 @@ mod tests {
             "pub(crate) async fn extract_editor_ui_design_assets_for_owner",
             "pub(crate) fn editor_project_payload_from_record",
             &[
-                "persist_editor_green_screen_source_image",
+                "persist_editor_provider_source_image",
                 "remove_editor_generated_screen_background_with_bgfilter",
-                "persist_editor_green_screen_source_resource",
+                "persist_editor_provider_source_resource",
                 "slice_generated_icon_spritesheet_all_by_connected_components",
             ],
         );
@@ -9081,8 +9509,8 @@ mod tests {
             "pub(crate) async fn extract_editor_ui_design_assets_for_owner",
             "pub(crate) fn editor_project_payload_from_record",
             &[
-                "persist_editor_green_screen_source_image",
-                "persist_editor_green_screen_source_resource",
+                "persist_editor_provider_source_image",
+                "persist_editor_provider_source_resource",
                 "remove_editor_generated_screen_background_with_bgfilter",
             ],
         );
@@ -9203,20 +9631,43 @@ mod tests {
         assert_function_contains_in_order(
             source,
             "pub(crate) async fn edit_editor_image_for_owner",
-            "pub async fn generate_editor_icon_spritesheet",
+            "pub async fn remove_editor_image_background",
             &[
                 "let provider_image",
-                "EDITOR_IMAGE_EDIT_SOURCE_ASSET_KIND",
-                "persist_editor_generated_asset",
-                "restore_editor_image_edit_output_dimensions",
+                "restore_editor_image_edit_output_dimensions_or_original",
+                "persist_editor_generated_image",
             ],
         );
+        assert_function_contains_in_order(
+            source,
+            "pub(crate) async fn generate_editor_image_for_owner",
+            "fn normalize_editor_image_generation_size",
+            &[
+                "let mut image",
+                "restore_editor_generated_image_output_dimensions_or_original",
+                "persist_editor_generated_image",
+            ],
+        );
+        assert_function_occurrence_count(
+            source,
+            "pub(crate) async fn edit_editor_image_for_owner",
+            "pub async fn remove_editor_image_background",
+            "persist_editor_generated_image(",
+            1,
+        );
+        assert_function_occurrence_count(
+            source,
+            "pub(crate) async fn generate_editor_image_for_owner",
+            "fn normalize_editor_image_generation_size",
+            "persist_editor_generated_image(",
+            1,
+        );
         assert_function_contains_in_order(
             source,
             "pub(crate) async fn extract_editor_ui_design_assets_for_owner",
             "pub(crate) fn editor_project_payload_from_record",
             &[
-                "persist_editor_green_screen_source_resource",
+                "persist_editor_provider_source_resource",
                 "remove_editor_generated_screen_background_with_bgfilter",
                 "EDITOR_UI_DESIGN_SPRITESHEET_ASSET_KIND",
                 "persist_editor_generated_asset",
@@ -9313,4 +9764,26 @@ mod tests {
             );
         }
     }
+
+    fn assert_function_occurrence_count(
+        source: &str,
+        start: &str,
+        end: &str,
+        snippet: &str,
+        expected_count: usize,
+    ) {
+        let start_index = source
+            .find(start)
+            .unwrap_or_else(|| panic!("missing function start marker: {start}"));
+        let tail = &source[start_index..];
+        let end_index = tail
+            .find(end)
+            .unwrap_or_else(|| panic!("missing function end marker: {end}"));
+        let body = &tail[..end_index];
+        assert_eq!(
+            body.matches(snippet).count(),
+            expected_count,
+            "function body starting with {start} should contain {snippet} exactly {expected_count} times"
+        );
+    }
 }
diff --git a/server-rs/crates/api-server/src/editor_screen_background_filter.rs b/server-rs/crates/api-server/src/editor_screen_background_filter.rs
index 59c70a521..d67d7bba0 100644
--- a/server-rs/crates/api-server/src/editor_screen_background_filter.rs
+++ b/server-rs/crates/api-server/src/editor_screen_background_filter.rs
@@ -203,11 +203,12 @@ impl ForegroundHistogram {
             .filter(|bin| bin.mass >= mass_floor)
             .filter_map(|bin| {
                 let lab = bin.mean();
-                (lab[0] > SKIN_MIN_LIGHTNESS && lab[1] > SKIN_MIN_A && lab[2] > SKIN_MIN_B)
-                    .then(|| SkinReference {
+                (lab[0] > SKIN_MIN_LIGHTNESS && lab[1] > SKIN_MIN_A && lab[2] > SKIN_MIN_B).then(
+                    || SkinReference {
                         lab,
                         rgb: bin.mean_rgb(),
-                    })
+                    },
+                )
             })
             .max_by(|left, right| {
                 left.lab[0]
@@ -481,12 +482,18 @@ mod tests {
         let report = report_for(&transparent_image_with_center_block([250, 224, 200]), true);
 
         assert!(
-            report.excluded.iter().any(|(color, _)| color.hex == "#FFD6C2"),
+            report
+                .excluded
+                .iter()
+                .any(|(color, _)| color.hex == "#FFD6C2"),
             "肤色前景应剔除暖浅桃色，excluded: {}",
             report.excluded_summary()
         );
         assert!(
-            report.excluded.iter().any(|(color, _)| color.hex == "#FFF2A8"),
+            report
+                .excluded
+                .iter()
+                .any(|(color, _)| color.hex == "#FFF2A8"),
             "肤色前景应剔除淡黄（Rule 2/3 关键新覆盖），excluded: {}",
             report.excluded_summary()
         );
@@ -520,7 +527,10 @@ mod tests {
 
         let enabled = report_for(&image, true);
         assert!(
-            enabled.excluded.iter().any(|(color, _)| color.hex == "#FFF2A8"),
+            enabled
+                .excluded
+                .iter()
+                .any(|(color, _)| color.hex == "#FFF2A8"),
             "开启皮肤否决时淡黄应被剔除，excluded: {}",
             enabled.excluded_summary()
         );
@@ -542,7 +552,10 @@ mod tests {
         let report = report_for(&transparent_image_with_center_block([127, 179, 255]), false);
 
         assert!(
-            report.excluded.iter().any(|(color, _)| color.hex == "#7FB3FF"),
+            report
+                .excluded
+                .iter()
+                .any(|(color, _)| color.hex == "#7FB3FF"),
             "蓝色前景应剔除中度天蓝，excluded: {}",
             report.excluded_summary()
         );
diff --git a/server-rs/crates/api-server/src/external_editor_api.rs b/server-rs/crates/api-server/src/external_editor_api.rs
index ee6628de6..b8789b1dc 100644
--- a/server-rs/crates/api-server/src/external_editor_api.rs
+++ b/server-rs/crates/api-server/src/external_editor_api.rs
@@ -494,6 +494,8 @@ pub async fn create_external_editor_asset(
             generation_cost_mud_points: 0,
             now_micros: current_utc_micros(),
             thumbnail_src: None,
+            group_task_id: None,
+            group_task_expected_asset_count: None,
         })
         .await
         .map_err(map_editor_project_error)?;
diff --git a/server-rs/crates/api-server/src/external_generation.rs b/server-rs/crates/api-server/src/external_generation.rs
index def534cf9..e766bb669 100644
--- a/server-rs/crates/api-server/src/external_generation.rs
+++ b/server-rs/crates/api-server/src/external_generation.rs
@@ -172,24 +172,14 @@ fn map_external_generation_job_status(
             100,
             None,
         ),
-        "running" => (
-            ExternalGenerationJobStatus::Running,
-            "正在生成。",
-            35,
-            None,
-        ),
+        "running" => (ExternalGenerationJobStatus::Running, "正在生成。", 35, None),
         "failed" => (
             ExternalGenerationJobStatus::Failed,
             "生成失败。",
             0,
             job.last_error_message.clone(),
         ),
-        _ => (
-            ExternalGenerationJobStatus::Queued,
-            "排队中。",
-            8,
-            None,
-        ),
+        _ => (ExternalGenerationJobStatus::Queued, "排队中。", 8, None),
     };
 
     ExternalGenerationJobStatusRecord {
diff --git a/server-rs/crates/api-server/src/login_options.rs b/server-rs/crates/api-server/src/login_options.rs
index 19fe4bde1..f71f4d511 100644
--- a/server-rs/crates/api-server/src/login_options.rs
+++ b/server-rs/crates/api-server/src/login_options.rs
@@ -1,4 +1,4 @@
-use axum::{
+use axum::{
     Json,
     extract::{Extension, State},
 };
diff --git a/server-rs/crates/api-server/src/main.rs b/server-rs/crates/api-server/src/main.rs
index 28e32d58b..6ce33e2ce 100644
--- a/server-rs/crates/api-server/src/main.rs
+++ b/server-rs/crates/api-server/src/main.rs
@@ -1,10 +1,11 @@
 #![recursion_limit = "256"]
 
 mod admin;
+mod admin_accounts;
 mod admin_recharge;
 mod ai_generation_drafts;
-mod aliyun_matting;
 mod ai_tasks;
+mod aliyun_matting;
 mod api_response;
 mod app;
 mod asset_billing;
@@ -669,8 +670,12 @@ mod tests {
 
     #[test]
     fn profile_recharge_expiration_listener_is_limited_to_http_roles() {
-        assert!(should_start_profile_recharge_expiration_listener(ProcessRole::Api));
-        assert!(should_start_profile_recharge_expiration_listener(ProcessRole::All));
+        assert!(should_start_profile_recharge_expiration_listener(
+            ProcessRole::Api
+        ));
+        assert!(should_start_profile_recharge_expiration_listener(
+            ProcessRole::All
+        ));
         assert!(!should_start_profile_recharge_expiration_listener(
             ProcessRole::ExternalGenerationWorker
         ));
diff --git a/server-rs/crates/api-server/src/modules/admin.rs b/server-rs/crates/api-server/src/modules/admin.rs
index 77a679af7..4c0ac39a3 100644
--- a/server-rs/crates/api-server/src/modules/admin.rs
+++ b/server-rs/crates/api-server/src/modules/admin.rs
@@ -18,6 +18,7 @@ use crate::{
         admin_upsert_feature_gate_config, admin_upsert_public_work_interaction_config,
         require_admin_auth,
     },
+    admin_accounts::{admin_create_account, admin_list_accounts, admin_update_account},
     admin_recharge::{
         admin_execute_recharge_refund, admin_get_user_detail, admin_list_recharge_orders,
         admin_preview_recharge_refund, admin_register_recharge_refund,
@@ -37,6 +38,22 @@ use crate::{
 pub fn router(state: AppState) -> Router<AppState> {
     Router::new()
         .route("/admin/api/login", axum::routing::post(admin_login))
+        .route(
+            "/admin/api/accounts",
+            get(admin_list_accounts)
+                .post(admin_create_account)
+                .route_layer(middleware::from_fn_with_state(
+                    state.clone(),
+                    require_admin_auth,
+                )),
+        )
+        .route(
+            "/admin/api/accounts/{account_id}",
+            axum::routing::put(admin_update_account).route_layer(middleware::from_fn_with_state(
+                state.clone(),
+                require_admin_auth,
+            )),
+        )
         .route(
             "/admin/api/me",
             get(admin_me).route_layer(middleware::from_fn_with_state(
diff --git a/server-rs/crates/api-server/src/modules/auth.rs b/server-rs/crates/api-server/src/modules/auth.rs
index fecbf4fe0..d8644873d 100644
--- a/server-rs/crates/api-server/src/modules/auth.rs
+++ b/server-rs/crates/api-server/src/modules/auth.rs
@@ -1,4 +1,4 @@
-use axum::{
+use axum::{
     Router, middleware,
     routing::{get, post},
 };
diff --git a/server-rs/crates/api-server/src/platform_errors.rs b/server-rs/crates/api-server/src/platform_errors.rs
index 792fb8817..6da6f87c3 100644
--- a/server-rs/crates/api-server/src/platform_errors.rs
+++ b/server-rs/crates/api-server/src/platform_errors.rs
@@ -1,4 +1,4 @@
-use axum::http::{HeaderValue, StatusCode};
+use axum::http::{HeaderValue, StatusCode};
 use platform_auth::{AuthPlatformErrorKind, WechatProviderError};
 use platform_llm::{LlmError, LlmErrorKind};
 use platform_oss::{OssError, OssErrorKind};
diff --git a/server-rs/crates/api-server/src/profile_recharge_refund_reconciliation.rs b/server-rs/crates/api-server/src/profile_recharge_refund_reconciliation.rs
index 870e13489..04ffc9262 100644
--- a/server-rs/crates/api-server/src/profile_recharge_refund_reconciliation.rs
+++ b/server-rs/crates/api-server/src/profile_recharge_refund_reconciliation.rs
@@ -949,6 +949,7 @@ mod tests {
             manual_review_resolved_by_admin_user_id: None,
             manual_review_resolution_reason: None,
             manual_review_resolved_at_micros: None,
+            manual_review_resolved_error_code: None,
         }
     }
 
diff --git a/server-rs/crates/api-server/src/puzzle.rs b/server-rs/crates/api-server/src/puzzle.rs
index 973a03033..e8d620edf 100644
--- a/server-rs/crates/api-server/src/puzzle.rs
+++ b/server-rs/crates/api-server/src/puzzle.rs
@@ -1,4 +1,4 @@
-use std::{
+use std::{
     collections::BTreeMap,
     time::{Instant, SystemTime, UNIX_EPOCH},
 };
diff --git a/server-rs/crates/api-server/src/runtime_profile.rs b/server-rs/crates/api-server/src/runtime_profile.rs
index afae476d5..ce8d714e1 100644
--- a/server-rs/crates/api-server/src/runtime_profile.rs
+++ b/server-rs/crates/api-server/src/runtime_profile.rs
@@ -86,7 +86,7 @@ use std::{convert::Infallible, time::Duration};
 use time::OffsetDateTime;
 
 use crate::{
-    admin::AuthenticatedAdmin,
+    admin::{AdminDisplayNameDirectory, AuthenticatedAdmin, load_admin_display_name_directory},
     api_response::json_success_body,
     auth::AuthenticatedAccessToken,
     http_error::AppError,
@@ -856,13 +856,21 @@ pub async fn admin_list_profile_task_configs(
                 map_runtime_profile_client_error(error),
             )
         })?;
+    let admin_display_names = load_admin_display_name_directory(&state)
+        .await
+        .map_err(|error| {
+            runtime_profile_error_response(
+                &request_context,
+                map_runtime_profile_client_error(error),
+            )
+        })?;
 
     Ok(json_success_body(
         Some(&request_context),
         ProfileTaskConfigAdminListResponse {
             entries: entries
                 .into_iter()
-                .map(build_profile_task_config_admin_response)
+                .map(|entry| build_profile_task_config_admin_response(entry, &admin_display_names))
                 .collect(),
         },
     ))
@@ -894,6 +902,14 @@ pub async fn admin_upsert_profile_task_config(
                 .with_message("个人任务 scopeKind 首版仅支持 user"),
         ));
     }
+    let admin_display_names = load_admin_display_name_directory(&state)
+        .await
+        .map_err(|error| {
+            runtime_profile_error_response(
+                &request_context,
+                map_runtime_profile_client_error(error),
+            )
+        })?;
     let updated_at_micros = OffsetDateTime::now_utc().unix_timestamp_nanos() / 1_000;
     let record = state
         .spacetime_client()
@@ -918,10 +934,9 @@ pub async fn admin_upsert_profile_task_config(
                 map_runtime_profile_client_error(error),
             )
         })?;
-
     Ok(json_success_body(
         Some(&request_context),
-        build_profile_task_config_admin_response(record),
+        build_profile_task_config_admin_response(record, &admin_display_names),
     ))
 }
 
@@ -931,6 +946,14 @@ pub async fn admin_disable_profile_task_config(
     Extension(admin): Extension<AuthenticatedAdmin>,
     Json(payload): Json<AdminDisableProfileTaskConfigRequest>,
 ) -> Result<Json<Value>, Response> {
+    let admin_display_names = load_admin_display_name_directory(&state)
+        .await
+        .map_err(|error| {
+            runtime_profile_error_response(
+                &request_context,
+                map_runtime_profile_client_error(error),
+            )
+        })?;
     let updated_at_micros = OffsetDateTime::now_utc().unix_timestamp_nanos() / 1_000;
     let record = state
         .spacetime_client()
@@ -946,10 +969,9 @@ pub async fn admin_disable_profile_task_config(
                 map_runtime_profile_client_error(error),
             )
         })?;
-
     Ok(json_success_body(
         Some(&request_context),
-        build_profile_task_config_admin_response(record),
+        build_profile_task_config_admin_response(record, &admin_display_names),
     ))
 }
 
@@ -968,10 +990,18 @@ pub async fn admin_get_profile_wallet_config(
                 map_runtime_profile_client_error(error),
             )
         })?;
+    let admin_display_names = load_admin_display_name_directory(&state)
+        .await
+        .map_err(|error| {
+            runtime_profile_error_response(
+                &request_context,
+                map_runtime_profile_client_error(error),
+            )
+        })?;
 
     Ok(json_success_body(
         Some(&request_context),
-        build_profile_wallet_config_admin_response(record),
+        build_profile_wallet_config_admin_response(record, &admin_display_names),
     ))
 }
 
@@ -981,6 +1011,14 @@ pub async fn admin_upsert_profile_wallet_config(
     Extension(admin): Extension<AuthenticatedAdmin>,
     Json(payload): Json<AdminUpsertProfileWalletConfigRequest>,
 ) -> Result<Json<Value>, Response> {
+    let admin_display_names = load_admin_display_name_directory(&state)
+        .await
+        .map_err(|error| {
+            runtime_profile_error_response(
+                &request_context,
+                map_runtime_profile_client_error(error),
+            )
+        })?;
     let updated_at_micros = OffsetDateTime::now_utc().unix_timestamp_nanos() / 1_000;
     let record = state
         .spacetime_client()
@@ -996,10 +1034,9 @@ pub async fn admin_upsert_profile_wallet_config(
                 map_runtime_profile_client_error(error),
             )
         })?;
-
     Ok(json_success_body(
         Some(&request_context),
-        build_profile_wallet_config_admin_response(record),
+        build_profile_wallet_config_admin_response(record, &admin_display_names),
     ))
 }
 
@@ -1100,6 +1137,14 @@ pub async fn admin_list_profile_redeem_codes(
                 map_runtime_profile_client_error(error),
             )
         })?;
+    let admin_display_names = load_admin_display_name_directory(&state)
+        .await
+        .map_err(|error| {
+            runtime_profile_error_response(
+                &request_context,
+                map_runtime_profile_client_error(error),
+            )
+        })?;
 
     Ok(json_success_body(
         Some(&request_context),
@@ -1112,7 +1157,9 @@ pub async fn admin_list_profile_redeem_codes(
             operations: record
                 .operations
                 .into_iter()
-                .map(build_profile_code_operation_admin_response)
+                .map(|operation| {
+                    build_profile_code_operation_admin_response(operation, &admin_display_names)
+                })
                 .collect(),
         },
     ))
@@ -1209,6 +1256,14 @@ pub async fn admin_list_profile_invite_codes(
                 map_runtime_profile_client_error(error),
             )
         })?;
+    let admin_display_names = load_admin_display_name_directory(&state)
+        .await
+        .map_err(|error| {
+            runtime_profile_error_response(
+                &request_context,
+                map_runtime_profile_client_error(error),
+            )
+        })?;
 
     Ok(json_success_body(
         Some(&request_context),
@@ -1221,7 +1276,9 @@ pub async fn admin_list_profile_invite_codes(
             operations: record
                 .operations
                 .into_iter()
-                .map(build_profile_code_operation_admin_response)
+                .map(|operation| {
+                    build_profile_code_operation_admin_response(operation, &admin_display_names)
+                })
                 .collect(),
         },
     ))
@@ -2068,7 +2125,10 @@ fn build_claim_profile_task_reward_response(
 
 fn build_profile_task_config_admin_response(
     record: RuntimeProfileTaskConfigRecord,
+    admin_display_names: &AdminDisplayNameDirectory,
 ) -> ProfileTaskConfigAdminResponse {
+    let created_by_display_name = admin_display_names.resolve(&record.created_by);
+    let updated_by_display_name = admin_display_names.resolve(&record.updated_by);
     ProfileTaskConfigAdminResponse {
         task_id: record.task_id,
         title: record.title,
@@ -2081,8 +2141,10 @@ fn build_profile_task_config_admin_response(
         enabled: record.enabled,
         sort_order: record.sort_order,
         created_by: record.created_by,
+        created_by_display_name,
         created_at: record.created_at,
         updated_by: record.updated_by,
+        updated_by_display_name,
         updated_at: record.updated_at,
     }
 }
@@ -2116,13 +2178,18 @@ fn build_profile_recharge_product_config_admin_response(
 
 fn build_profile_wallet_config_admin_response(
     record: module_runtime::RuntimeProfileWalletConfigRecord,
+    admin_display_names: &AdminDisplayNameDirectory,
 ) -> ProfileWalletConfigAdminResponse {
+    let created_by_display_name = admin_display_names.resolve(&record.created_by);
+    let updated_by_display_name = admin_display_names.resolve(&record.updated_by);
     ProfileWalletConfigAdminResponse {
         config_id: record.config_id,
         initial_mud_points: record.initial_mud_points,
         created_by: record.created_by,
+        created_by_display_name,
         created_at: record.created_at,
         updated_by: record.updated_by,
+        updated_by_display_name,
         updated_at: record.updated_at,
     }
 }
@@ -2318,13 +2385,16 @@ fn build_profile_redeem_code_admin_response(
 
 fn build_profile_code_operation_admin_response(
     record: RuntimeProfileCodeOperationRecord,
+    admin_display_names: &AdminDisplayNameDirectory,
 ) -> ProfileCodeOperationAdminResponse {
+    let operator_display_name = admin_display_names.resolve(&record.operator_user_id);
     ProfileCodeOperationAdminResponse {
         operation_id: record.operation_id,
         code_kind: record.code_kind,
         code: record.code,
         action: record.action,
         operator_user_id: record.operator_user_id,
+        operator_display_name,
         created_at: record.created_at,
     }
 }
diff --git a/server-rs/crates/api-server/src/state.rs b/server-rs/crates/api-server/src/state.rs
index 17e064ac2..62d067b4a 100644
--- a/server-rs/crates/api-server/src/state.rs
+++ b/server-rs/crates/api-server/src/state.rs
@@ -307,6 +307,9 @@ pub struct AdminRuntime {
 pub struct AdminClaims {
     pub subject: String,
     pub username: String,
+    pub display_name: String,
+    pub roles: Vec<String>,
+    pub token_version: u64,
     pub issued_at: OffsetDateTime,
     pub expires_at: OffsetDateTime,
 }
@@ -317,6 +320,8 @@ pub struct AdminSession {
     pub username: String,
     pub display_name: String,
     pub roles: Vec<String>,
+    pub account_role: String,
+    pub tab_permissions: Vec<String>,
     pub issued_at: OffsetDateTime,
     pub expires_at: OffsetDateTime,
 }
@@ -621,14 +626,12 @@ impl AppState {
             let models = editor_generation_pricing_to_records(&next)?;
             let record = self
                 .spacetime_client
-                .upsert_editor_generation_pricing_config(
-                    editor_generation_pricing_upsert_input(
-                        &self.config,
-                        admin_user_id,
-                        models,
-                        crate::editor_project::current_utc_micros(),
-                    ),
-                )
+                .upsert_editor_generation_pricing_config(editor_generation_pricing_upsert_input(
+                    &self.config,
+                    admin_user_id,
+                    models,
+                    crate::editor_project::current_utc_micros(),
+                ))
                 .await
                 .map_err(|error| EditorGenerationPricingError::Persistence(error.to_string()))?;
             let pricing = editor_generation_pricing_from_record(record)?;
@@ -1726,7 +1729,34 @@ impl AdminRuntime {
         &self.password
     }
 
+    pub fn subject(&self) -> &str {
+        &self.subject
+    }
+
+    pub fn display_name(&self) -> &str {
+        &self.display_name
+    }
+
     pub fn build_claims(&self, now: OffsetDateTime) -> Result<AdminClaims, String> {
+        self.build_account_claims(
+            self.subject.to_string(),
+            self.username.to_string(),
+            self.display_name.to_string(),
+            vec![ADMIN_ROLE.to_string(), "owner".to_string()],
+            1,
+            now,
+        )
+    }
+
+    pub fn build_account_claims(
+        &self,
+        subject: String,
+        username: String,
+        display_name: String,
+        roles: Vec<String>,
+        token_version: u64,
+        now: OffsetDateTime,
+    ) -> Result<AdminClaims, String> {
         let expires_at = now
             .checked_add(time::Duration::seconds(
                 i64::try_from(self.token_ttl_seconds)
@@ -1734,8 +1764,11 @@ impl AdminRuntime {
             ))
             .ok_or_else(|| "后台 token 过期时间计算溢出".to_string())?;
         Ok(AdminClaims {
-            subject: self.subject.to_string(),
-            username: self.username.to_string(),
+            subject,
+            username,
+            display_name,
+            roles,
+            token_version,
             issued_at: now,
             expires_at,
         })
@@ -1745,13 +1778,13 @@ impl AdminRuntime {
         let jwt_claims = AccessTokenClaims::from_input(
             AccessTokenClaimsInput {
                 user_id: claims.subject.clone(),
-                session_id: format!("admin-session-{}", claims.username),
+                session_id: format!("admin-session:{}:{}", claims.subject, claims.token_version),
                 provider: AuthProvider::Password,
-                roles: vec![ADMIN_ROLE.to_string()],
-                token_version: 1,
+                roles: claims.roles.clone(),
+                token_version: claims.token_version,
                 phone_verified: false,
                 binding_status: BindingStatus::Active,
-                display_name: Some(self.display_name.to_string()),
+                display_name: Some(claims.display_name.clone()),
             },
             &self.jwt_config,
             claims.issued_at,
@@ -1780,17 +1813,59 @@ impl AdminRuntime {
             username: self.username.to_string(),
             display_name: self.display_name.to_string(),
             roles: claims.roles.clone(),
+            account_role: "owner".to_string(),
+            tab_permissions: Vec::new(),
             issued_at,
             expires_at,
         })
     }
 
+    pub fn validate_account_claims(
+        &self,
+        claims: &AccessTokenClaims,
+        expected_subject: &str,
+        expected_token_version: u64,
+        username: String,
+        display_name: String,
+        tab_permissions: Vec<String>,
+    ) -> Result<AdminSession, String> {
+        if claims.user_id() != expected_subject {
+            return Err("后台管理员主体不匹配".to_string());
+        }
+        if !claims.roles.iter().any(|role| role == ADMIN_ROLE) {
+            return Err("当前令牌不是管理员令牌".to_string());
+        }
+        if claims.token_version() != expected_token_version {
+            return Err("后台登录状态已失效".to_string());
+        }
+        let issued_at = OffsetDateTime::from_unix_timestamp(claims.iat as i64)
+            .map_err(|_| "后台令牌签发时间无效".to_string())?;
+        let expires_at = OffsetDateTime::from_unix_timestamp(claims.exp as i64)
+            .map_err(|_| "后台令牌过期时间无效".to_string())?;
+        Ok(AdminSession {
+            subject: claims.user_id().to_string(),
+            username,
+            display_name,
+            roles: claims.roles.clone(),
+            account_role: "member".to_string(),
+            tab_permissions,
+            issued_at,
+            expires_at,
+        })
+    }
+
+    pub fn is_owner_subject(&self, subject: &str) -> bool {
+        subject == self.subject.as_ref()
+    }
+
     pub fn build_session(&self, claims: &AdminClaims) -> AdminSession {
         AdminSession {
             subject: claims.subject.clone(),
             username: claims.username.clone(),
-            display_name: self.display_name.to_string(),
-            roles: vec![ADMIN_ROLE.to_string()],
+            display_name: claims.display_name.clone(),
+            roles: claims.roles.clone(),
+            account_role: "owner".to_string(),
+            tab_permissions: Vec::new(),
             issued_at: claims.issued_at,
             expires_at: claims.expires_at,
         }
diff --git a/server-rs/crates/api-server/src/wechat/auth.rs b/server-rs/crates/api-server/src/wechat/auth.rs
index b2571903c..7496ad4e1 100644
--- a/server-rs/crates/api-server/src/wechat/auth.rs
+++ b/server-rs/crates/api-server/src/wechat/auth.rs
@@ -1,4 +1,4 @@
-use axum::{
+use axum::{
     Json,
     extract::{Extension, Query, State},
     http::{HeaderMap, StatusCode},
diff --git a/server-rs/crates/api-server/src/wechat/provider.rs b/server-rs/crates/api-server/src/wechat/provider.rs
index 94c3a117d..60722cb82 100644
--- a/server-rs/crates/api-server/src/wechat/provider.rs
+++ b/server-rs/crates/api-server/src/wechat/provider.rs
@@ -1,4 +1,4 @@
-use platform_auth::{
+use platform_auth::{
     DEFAULT_WECHAT_ACCESS_TOKEN_ENDPOINT, DEFAULT_WECHAT_AUTHORIZE_ENDPOINT,
     DEFAULT_WECHAT_JS_CODE_SESSION_ENDPOINT, DEFAULT_WECHAT_PHONE_NUMBER_ENDPOINT,
     DEFAULT_WECHAT_STABLE_ACCESS_TOKEN_ENDPOINT, DEFAULT_WECHAT_USER_INFO_ENDPOINT,
diff --git a/server-rs/crates/api-server/src/wooden_fish.rs b/server-rs/crates/api-server/src/wooden_fish.rs
index f5b423f3a..debac6c71 100644
--- a/server-rs/crates/api-server/src/wooden_fish.rs
+++ b/server-rs/crates/api-server/src/wooden_fish.rs
@@ -1,4 +1,4 @@
-use std::{
+use std::{
     collections::BTreeMap,
     time::{SystemTime, UNIX_EPOCH},
 };
diff --git a/server-rs/crates/module-runtime/src/commands.rs b/server-rs/crates/module-runtime/src/commands.rs
index e93836234..24f93d4e8 100644
--- a/server-rs/crates/module-runtime/src/commands.rs
+++ b/server-rs/crates/module-runtime/src/commands.rs
@@ -615,7 +615,18 @@ pub fn build_runtime_profile_recharge_refund_manual_review_resolve_input(
     out_refund_no: String,
     admin_user_id: String,
     reason: String,
+    expected_error_code: String,
 ) -> Result<RuntimeProfileRechargeRefundManualReviewResolveInput, String> {
+    let expected_error_code = normalize_profile_recharge_refund_identifier(
+        expected_error_code,
+        "refund_manual_review.expected_error_code",
+    )?;
+    if !matches!(
+        expected_error_code.as_str(),
+        "provider_transaction_id_mismatch" | "order_total_mismatch"
+    ) {
+        return Err("refund_manual_review.expected_error_code 不支持人工确认".to_string());
+    }
     Ok(RuntimeProfileRechargeRefundManualReviewResolveInput {
         out_refund_no: normalize_profile_recharge_refund_identifier(
             out_refund_no,
@@ -626,6 +637,7 @@ pub fn build_runtime_profile_recharge_refund_manual_review_resolve_input(
             "refund_manual_review.admin_user_id",
         )?,
         reason: normalize_profile_recharge_refund_reason(reason, "refund_manual_review.reason")?,
+        expected_error_code,
     })
 }
 
@@ -1456,17 +1468,32 @@ mod tests {
             " refund-1 ".to_string(),
             " admin-1 ".to_string(),
             " 已核对微信商户平台原始账单 ".to_string(),
+            " provider_transaction_id_mismatch ".to_string(),
         )
         .expect("manual review input should normalize");
         assert_eq!(input.out_refund_no, "refund-1");
         assert_eq!(input.admin_user_id, "admin-1");
         assert_eq!(input.reason, "已核对微信商户平台原始账单");
+        assert_eq!(
+            input.expected_error_code,
+            "provider_transaction_id_mismatch"
+        );
 
         assert!(
             build_runtime_profile_recharge_refund_manual_review_resolve_input(
                 "refund-1".to_string(),
                 "admin-1".to_string(),
                 "  ".to_string(),
+                "provider_transaction_id_mismatch".to_string(),
+            )
+            .is_err()
+        );
+        assert!(
+            build_runtime_profile_recharge_refund_manual_review_resolve_input(
+                "refund-1".to_string(),
+                "admin-1".to_string(),
+                "已核对".to_string(),
+                "other_error".to_string(),
             )
             .is_err()
         );
diff --git a/server-rs/crates/module-runtime/src/domain.rs b/server-rs/crates/module-runtime/src/domain.rs
index 768c5dce2..a7d35ba55 100644
--- a/server-rs/crates/module-runtime/src/domain.rs
+++ b/server-rs/crates/module-runtime/src/domain.rs
@@ -1438,6 +1438,7 @@ pub struct RuntimeProfileRechargeRefundSnapshot {
     pub manual_review_resolved_by_admin_user_id: Option<String>,
     pub manual_review_resolution_reason: Option<String>,
     pub manual_review_resolved_at_micros: Option<i64>,
+    pub manual_review_resolved_error_code: Option<String>,
 }
 
 #[cfg_attr(feature = "spacetime-types", derive(SpacetimeType))]
@@ -1731,6 +1732,7 @@ pub struct RuntimeProfileRechargeRefundManualReviewResolveInput {
     pub out_refund_no: String,
     pub admin_user_id: String,
     pub reason: String,
+    pub expected_error_code: String,
 }
 
 #[cfg_attr(feature = "spacetime-types", derive(SpacetimeType))]
diff --git a/server-rs/crates/platform-auth/Cargo.toml b/server-rs/crates/platform-auth/Cargo.toml
index 67cda1529..0133f2c14 100644
--- a/server-rs/crates/platform-auth/Cargo.toml
+++ b/server-rs/crates/platform-auth/Cargo.toml
@@ -16,6 +16,7 @@ rand_core = { workspace = true, features = ["getrandom"] }
 serde = { workspace = true }
 shared-kernel = { workspace = true }
 time = { workspace = true, features = ["std"] }
+tokio = { workspace = true, features = ["rt"] }
 tracing = { workspace = true }
 url = { workspace = true }
 urlencoding = { workspace = true }
diff --git a/server-rs/crates/platform-auth/src/lib.rs b/server-rs/crates/platform-auth/src/lib.rs
index 65dbe3aeb..cd6dba354 100644
--- a/server-rs/crates/platform-auth/src/lib.rs
+++ b/server-rs/crates/platform-auth/src/lib.rs
@@ -1755,23 +1755,35 @@ pub fn read_refresh_session_token(
 }
 
 pub async fn hash_password(password: &str) -> Result<String, PasswordHashError> {
-    let salt = SaltString::generate(&mut OsRng);
-    Argon2::default()
-        .hash_password(password.as_bytes(), &salt)
-        .map(|hash| hash.to_string())
-        .map_err(|error| PasswordHashError::HashFailed(format!("密码哈希失败：{error}")))
+    let password = password.to_string();
+    tokio::task::spawn_blocking(move || {
+        let salt = SaltString::generate(&mut OsRng);
+        Argon2::default()
+            .hash_password(password.as_bytes(), &salt)
+            .map(|hash| hash.to_string())
+            .map_err(|error| PasswordHashError::HashFailed(format!("密码哈希失败：{error}")))
+    })
+    .await
+    .map_err(|error| PasswordHashError::HashFailed(format!("密码哈希任务失败：{error}")))?
 }
 
 pub async fn verify_password(
     password_hash: &str,
     password: &str,
 ) -> Result<bool, PasswordHashError> {
-    let parsed_hash = PasswordHash::new(password_hash)
-        .map_err(|error| PasswordHashError::VerifyFailed(format!("密码哈希格式非法：{error}")))?;
+    let password_hash = password_hash.to_string();
+    let password = password.to_string();
+    tokio::task::spawn_blocking(move || {
+        let parsed_hash = PasswordHash::new(&password_hash).map_err(|error| {
+            PasswordHashError::VerifyFailed(format!("密码哈希格式非法：{error}"))
+        })?;
 
-    Ok(Argon2::default()
-        .verify_password(password.as_bytes(), &parsed_hash)
-        .is_ok())
+        Ok(Argon2::default()
+            .verify_password(password.as_bytes(), &parsed_hash)
+            .is_ok())
+    })
+    .await
+    .map_err(|error| PasswordHashError::VerifyFailed(format!("密码校验任务失败：{error}")))?
 }
 
 pub fn create_refresh_session_token() -> String {
diff --git a/server-rs/crates/platform-image/src/vector_engine/client.rs b/server-rs/crates/platform-image/src/vector_engine/client.rs
index e5024124a..d8ee9271d 100644
--- a/server-rs/crates/platform-image/src/vector_engine/client.rs
+++ b/server-rs/crates/platform-image/src/vector_engine/client.rs
@@ -15,9 +15,10 @@ use super::{
     request::{
         build_vector_engine_image_edit_request_log_params,
         build_vector_engine_image_request_body_with_model,
-        build_vector_engine_nanobanana_generate_content_request_body, normalize_image_size,
-        normalize_vector_engine_image_model, vector_engine_images_edit_url,
-        vector_engine_images_generation_url, vector_engine_nanobanana_generate_content_url,
+        build_vector_engine_nanobanana_generate_content_request_body,
+        normalize_image_size_for_model, normalize_vector_engine_image_model,
+        vector_engine_images_edit_url, vector_engine_images_generation_url,
+        vector_engine_nanobanana_generate_content_url,
     },
     response::handle_vector_engine_response,
     types::{GeneratedImages, ReferenceImage, VectorEngineImageSettings},
@@ -79,7 +80,7 @@ pub async fn create_vector_engine_image_generation_with_model(
     }
 
     let request_url = vector_engine_images_generation_url(settings);
-    let normalized_size = normalize_image_size(size);
+    let normalized_size = normalize_image_size_for_model(model, size);
     let request_body = build_vector_engine_image_request_body_with_model(
         model,
         prompt,
@@ -387,7 +388,7 @@ pub async fn create_vector_engine_image_edit_with_references_and_model(
     }
 
     let request_url = vector_engine_images_edit_url(settings);
-    let normalized_size = normalize_image_size(size);
+    let normalized_size = normalize_image_size_for_model(model, size);
     let request_params = build_vector_engine_image_edit_request_log_params(
         model,
         prompt,
diff --git a/server-rs/crates/platform-image/src/vector_engine/mod.rs b/server-rs/crates/platform-image/src/vector_engine/mod.rs
index f8d953e8a..1422ecb3a 100644
--- a/server-rs/crates/platform-image/src/vector_engine/mod.rs
+++ b/server-rs/crates/platform-image/src/vector_engine/mod.rs
@@ -23,7 +23,7 @@ pub use error::{PlatformImageError, PlatformImageStatusHint};
 pub use image_source::download_remote_image;
 pub use request::{
     build_vector_engine_image_request_body, build_vector_engine_image_request_body_with_model,
-    build_vector_engine_nanobanana_generate_content_request_body, normalize_image_size,
+    build_vector_engine_nanobanana_generate_content_request_body, normalize_image_size_for_model,
     vector_engine_images_edit_url, vector_engine_images_generation_url,
     vector_engine_nanobanana_generate_content_url,
 };
diff --git a/server-rs/crates/platform-image/src/vector_engine/request.rs b/server-rs/crates/platform-image/src/vector_engine/request.rs
index 869f4e374..e67771f15 100644
--- a/server-rs/crates/platform-image/src/vector_engine/request.rs
+++ b/server-rs/crates/platform-image/src/vector_engine/request.rs
@@ -40,7 +40,7 @@ pub fn build_vector_engine_image_request_body_with_model(
         ("n".to_string(), json!(candidate_count.clamp(1, 4))),
         (
             "size".to_string(),
-            Value::String(normalize_image_size(size)),
+            Value::String(normalize_image_size_for_model(model, size)),
         ),
     ]);
 
@@ -90,9 +90,9 @@ pub fn normalize_vector_engine_image_model(model: &str) -> &str {
     }
 }
 
-pub fn normalize_image_size(size: &str) -> String {
+pub fn normalize_image_size_for_model(model: &str, size: &str) -> String {
     let size = size.trim();
-    match size {
+    let normalized_size = match size {
         "1:1" => "1024x1024".to_string(),
         "16:9" | "2k" => "1536x1024".to_string(),
         "2k-16:9" => "2048x1152".to_string(),
@@ -100,6 +100,12 @@ pub fn normalize_image_size(size: &str) -> String {
         value if is_explicit_pixel_size(value) => normalize_explicit_pixel_size(value),
         value if !value.is_empty() => value.to_string(),
         _ => "1024x1024".to_string(),
+    };
+
+    if normalize_vector_engine_image_model(model) == GPT_IMAGE_2_MODEL {
+        clamp_gpt_image_2_pixel_size(normalized_size.as_str())
+    } else {
+        normalized_size
     }
 }
 
@@ -115,6 +121,94 @@ fn normalize_explicit_pixel_size(value: &str) -> String {
     value.replace('*', "x")
 }
 
+fn clamp_gpt_image_2_pixel_size(size: &str) -> String {
+    const MIN_PIXELS: u64 = 655_360;
+    const MAX_PIXELS: u64 = 8_294_400;
+    const MAX_EDGE: u32 = 3_840;
+    const DIMENSION_ALIGNMENT: u32 = 16;
+    const MAX_ASPECT_RATIO: f64 = 3.0;
+
+    // 中文注释：这里是 VectorEngine 的共享发送边界，只处理 gpt-image-2 的显式像素尺寸。
+    let Some((width, height)) = parse_explicit_pixel_size(size) else {
+        return size.to_string();
+    };
+    // 中文注释：零尺寸无法计算比例或像素数，直接使用已知合法的默认尺寸。
+    if width == 0 || height == 0 {
+        return "1024x1024".to_string();
+    }
+
+    let (mut width, mut height) = (f64::from(width), f64::from(height));
+    // 中文注释：先把短边补至长边的三分之一，确保长短边比不超过 3:1。
+    if width / height > MAX_ASPECT_RATIO {
+        height = width / MAX_ASPECT_RATIO;
+    } else if height / width > MAX_ASPECT_RATIO {
+        width = height / MAX_ASPECT_RATIO;
+    }
+
+    let pixels = width * height;
+    // 中文注释：等比缩小，优先保留已收紧后的画面比例，同时满足最大边和最大总像素。
+    let scale = (MAX_EDGE as f64 / width.max(height))
+        .min((MAX_PIXELS as f64 / pixels).sqrt())
+        .min(1.0);
+    width *= scale;
+    height *= scale;
+
+    let pixels = width * height;
+    // 中文注释：小于最小总像素时等比放大；此前已处理比例，放大不会重新突破 3:1。
+    if pixels < MIN_PIXELS as f64 {
+        let scale = (MIN_PIXELS as f64 / pixels).sqrt();
+        width *= scale;
+        height *= scale;
+    }
+
+    // 中文注释：provider 要求两边均为 16px 倍数，向上取整避免对齐后落到最小像素以下。
+    let width = align_dimension_up(width, DIMENSION_ALIGNMENT);
+    let height = align_dimension_up(height, DIMENSION_ALIGNMENT);
+    // TODO unlikely but can improve
+    // 中文注释：对齐可能触碰最大边或最大像素，因此发送前重新核验全部约束。
+    if is_valid_gpt_image_2_size(
+        width,
+        height,
+        MIN_PIXELS,
+        MAX_PIXELS,
+        MAX_EDGE,
+        MAX_ASPECT_RATIO,
+    ) {
+        return format!("{width}x{height}");
+    }
+
+    // 中文注释：无法同时满足全部约束时，回退为已知会被 provider 接受的默认尺寸。
+    "1024x1024".to_string()
+}
+
+fn align_dimension_up(value: f64, alignment: u32) -> u32 {
+    ((value.ceil() as u32).saturating_add(alignment - 1) / alignment) * alignment
+}
+
+fn is_valid_gpt_image_2_size(
+    width: u32,
+    height: u32,
+    min_pixels: u64,
+    max_pixels: u64,
+    max_edge: u32,
+    max_aspect_ratio: f64,
+) -> bool {
+    let pixels = u64::from(width) * u64::from(height);
+    width > 0
+        && height > 0
+        && width <= max_edge
+        && height <= max_edge
+        && width.is_multiple_of(16)
+        && height.is_multiple_of(16)
+        && (min_pixels..=max_pixels).contains(&pixels)
+        && f64::from(width.max(height)) / f64::from(width.min(height)) <= max_aspect_ratio
+}
+
+fn parse_explicit_pixel_size(value: &str) -> Option<(u32, u32)> {
+    let (width, height) = value.split_once('x')?;
+    Some((width.parse().ok()?, height.parse().ok()?))
+}
+
 fn normalize_nanobanana_aspect_ratio(aspect_ratio: &str) -> &str {
     match aspect_ratio.trim() {
         "2:3" => "2:3",
diff --git a/server-rs/crates/platform-image/tests/vector_engine.rs b/server-rs/crates/platform-image/tests/vector_engine.rs
index 66c6dc0b0..0ec6d9c43 100644
--- a/server-rs/crates/platform-image/tests/vector_engine.rs
+++ b/server-rs/crates/platform-image/tests/vector_engine.rs
@@ -47,12 +47,12 @@ fn vector_engine_module_exposes_provider_protocol_helpers() {
 }
 
 #[test]
-fn vector_engine_keeps_explicit_publication_material_pixel_sizes() {
+fn vector_engine_clamps_gpt_image_2_explicit_pixel_sizes_to_its_supported_pixel_budget() {
     let cover = build_vector_engine_image_request_body("宣发首图", None, "720x540", 1, &[]);
     let detail = build_vector_engine_image_request_body("详情单图", None, "720x1280", 1, &[]);
     let poster = build_vector_engine_image_request_body("运营海报", None, "1280x720", 1, &[]);
 
-    assert_eq!(cover["size"], "720x540");
+    assert_eq!(cover["size"], "944x704");
     assert_eq!(detail["size"], "720x1280");
     assert_eq!(poster["size"], "1280x720");
 }
@@ -82,6 +82,65 @@ fn vector_engine_request_body_can_use_nanobanana2_model() {
     assert_eq!(body["n"], 1);
 }
 
+#[test]
+fn vector_engine_only_enforces_the_gpt_image_2_pixel_budget_for_that_model() {
+    let gpt_body = build_vector_engine_image_request_body_with_model(
+        GPT_IMAGE_2_MODEL,
+        "小尺寸图",
+        None,
+        "640x640",
+        1,
+        &[],
+    );
+    let nanobanana_body = build_vector_engine_image_request_body_with_model(
+        "gemini-3.1-flash-image-preview",
+        "小尺寸图",
+        None,
+        "640x640",
+        1,
+        &[],
+    );
+    let oversized_gpt_body = build_vector_engine_image_request_body_with_model(
+        GPT_IMAGE_2_MODEL,
+        "大尺寸图",
+        None,
+        "4096x4096",
+        1,
+        &[],
+    );
+
+    assert_eq!(gpt_body["size"], "816x816");
+    assert_eq!(nanobanana_body["size"], "640x640");
+    assert_eq!(oversized_gpt_body["size"], "2880x2880");
+}
+
+#[test]
+fn vector_engine_gpt_image_2_sizes_always_meet_the_full_provider_envelope() {
+    for size in [
+        "1x1",
+        "720x540",
+        "3841x1280",
+        "4096x4096",
+        "3200x400",
+        "16x4096",
+        "3840x3840",
+    ] {
+        let body = build_vector_engine_image_request_body("约束测试", None, size, 1, &[]);
+        let normalized = body["size"].as_str().expect("size should be a string");
+        let (width, height) = normalized
+            .split_once('x')
+            .expect("gpt-image-2 size should be explicit pixels");
+        let width = width.parse::<u32>().expect("width should be numeric");
+        let height = height.parse::<u32>().expect("height should be numeric");
+        let pixels = u64::from(width) * u64::from(height);
+
+        assert!(width <= 3_840 && height <= 3_840, "{size} -> {normalized}");
+        assert!(width.is_multiple_of(16) && height.is_multiple_of(16));
+        assert!((655_360..=8_294_400).contains(&pixels));
+        assert!(width.max(height) <= width.min(height) * 3);
+    }
+}
+
 #[test]
 fn vector_engine_request_body_can_use_nanobanana2_half_k() {
     let body = build_vector_engine_image_request_body_with_model(
diff --git a/server-rs/crates/platform-matting/examples/segment_smoke.rs b/server-rs/crates/platform-matting/examples/segment_smoke.rs
index c778b5f02..a0c817402 100644
--- a/server-rs/crates/platform-matting/examples/segment_smoke.rs
+++ b/server-rs/crates/platform-matting/examples/segment_smoke.rs
@@ -38,17 +38,16 @@ async fn main() {
     });
     let input_bytes = std::fs::read(&input_path)
         .unwrap_or_else(|error| panic!("读取测试图片失败（{input_path}）：{error}"));
-    println!("[1/5] 已读取测试图片：{input_path}（{} 字节）", input_bytes.len());
+    println!(
+        "[1/5] 已读取测试图片：{input_path}（{} 字节）",
+        input_bytes.len()
+    );
 
     // SegmentCommonImage 要求分辨率低于 2000x2000，超限先等比缩小。
     const MAX_EDGE: u32 = 1999;
     let decoded = image::load_from_memory(&input_bytes).expect("测试图片应可解码");
     let input_bytes = if decoded.width() > MAX_EDGE || decoded.height() > MAX_EDGE {
-        let resized = decoded.resize(
-            MAX_EDGE,
-            MAX_EDGE,
-            image::imageops::FilterType::CatmullRom,
-        );
+        let resized = decoded.resize(MAX_EDGE, MAX_EDGE, image::imageops::FilterType::CatmullRom);
         let mut buffer = std::io::Cursor::new(Vec::new());
         resized
             .write_to(&mut buffer, image::ImageFormat::Png)
@@ -70,8 +69,14 @@ async fn main() {
     // --- 调用通用抠图 ---
     // key 优先级：VIAPI 专用 → 官方 SDK 标准命名（#IMAGE_CALL）→ 短信 key 兜底。
     let (matting_key_id, matting_key_secret) = [
-        ("ALIYUN_IMAGESEG_ACCESS_KEY_ID", "ALIYUN_IMAGESEG_ACCESS_KEY_SECRET"),
-        ("ALIBABA_CLOUD_ACCESS_KEY_ID", "ALIBABA_CLOUD_ACCESS_KEY_SECRET"),
+        (
+            "ALIYUN_IMAGESEG_ACCESS_KEY_ID",
+            "ALIYUN_IMAGESEG_ACCESS_KEY_SECRET",
+        ),
+        (
+            "ALIBABA_CLOUD_ACCESS_KEY_ID",
+            "ALIBABA_CLOUD_ACCESS_KEY_SECRET",
+        ),
         ("ALIYUN_SMS_ACCESS_KEY_ID", "ALIYUN_SMS_ACCESS_KEY_SECRET"),
     ]
     .iter()
diff --git a/server-rs/crates/platform-matting/src/lib.rs b/server-rs/crates/platform-matting/src/lib.rs
index 0df252889..854fafb19 100644
--- a/server-rs/crates/platform-matting/src/lib.rs
+++ b/server-rs/crates/platform-matting/src/lib.rs
@@ -162,9 +162,9 @@ pub struct UpstreamFailure {
 impl MattingError {
     pub fn message(&self) -> &str {
         match self {
-            Self::InvalidConfig(message)
-            | Self::InvalidRequest(message)
-            | Self::Sign(message) => message,
+            Self::InvalidConfig(message) | Self::InvalidRequest(message) | Self::Sign(message) => {
+                message
+            }
             Self::Upstream(failure) => &failure.message,
         }
     }
@@ -270,7 +270,10 @@ impl MattingClient {
         }
 
         let mut form = BTreeMap::new();
-        form.insert("Action".to_string(), SEGMENT_COMMON_IMAGE_ACTION.to_string());
+        form.insert(
+            "Action".to_string(),
+            SEGMENT_COMMON_IMAGE_ACTION.to_string(),
+        );
         form.insert("Format".to_string(), "json".to_string());
         form.insert("Version".to_string(), IMAGESEG_API_VERSION.to_string());
         form.insert("ImageURL".to_string(), image_url);
@@ -451,17 +454,12 @@ impl MattingClient {
     }
 
     async fn download_result_image(&self, url: &str) -> Result<Vec<u8>, MattingError> {
-        let mut response = self
-            .client
-            .get(url)
-            .send()
-            .await
-            .map_err(|error| {
-                MattingError::upstream_transport_error(
-                    describe_result_download_transport_error(&error),
-                    error.is_timeout(),
-                )
-            })?;
+        let mut response = self.client.get(url).send().await.map_err(|error| {
+            MattingError::upstream_transport_error(
+                describe_result_download_transport_error(&error),
+                error.is_timeout(),
+            )
+        })?;
         let status = response.status();
         if !status.is_success() {
             return Err(MattingError::upstream_http_error(
@@ -501,9 +499,7 @@ impl MattingClient {
         content_type: &str,
     ) -> Result<String, MattingError> {
         if bytes.is_empty() {
-            return Err(MattingError::InvalidRequest(
-                "上传内容不能为空".to_string(),
-            ));
+            return Err(MattingError::InvalidRequest("上传内容不能为空".to_string()));
         }
         let sts = self.get_oss_sts_token().await?;
         let file_name = file_name.trim().trim_matches('/');
@@ -536,7 +532,8 @@ impl MattingClient {
             "PUT\n\n{content_type}\n{date}\nx-oss-security-token:{}\n/{VIAPI_TEMP_BUCKET}/{object_key}",
             sts.security_token
         );
-        let signature = hmac_sha1_base64(sts.access_key_secret.as_bytes(), string_to_sign.as_bytes())?;
+        let signature =
+            hmac_sha1_base64(sts.access_key_secret.as_bytes(), string_to_sign.as_bytes())?;
         let authorization = format!("OSS {}:{}", sts.access_key_id, signature);
 
         let target_url = format!("https://{VIAPI_TEMP_OSS_HOST}/{object_key}");
@@ -625,7 +622,9 @@ impl MattingClient {
                 format!(
                     "GetOssStsToken 返回失败（HTTP {}，Code={}）：{}",
                     http_status.as_u16(),
-                    body.get("Code").and_then(|value| value.as_str()).unwrap_or("unknown"),
+                    body.get("Code")
+                        .and_then(|value| value.as_str())
+                        .unwrap_or("unknown"),
                     body.get("Message")
                         .and_then(|value| value.as_str())
                         .unwrap_or("unknown")
@@ -762,10 +761,7 @@ fn encode_rgba_png(image: &image::RgbaImage) -> Result<Vec<u8>, MattingError> {
             image::ExtendedColorType::Rgba8,
         )
         .map_err(|error| {
-            MattingError::upstream_response_error(
-                format!("编码抠图结果 PNG 失败：{error}"),
-                None,
-            )
+            MattingError::upstream_response_error(format!("编码抠图结果 PNG 失败：{error}"), None)
         })?;
     Ok(encoded)
 }
@@ -934,13 +930,7 @@ fn current_aliyun_timestamp() -> String {
 fn canonicalize_aliyun_form_params(params: &BTreeMap<String, String>) -> String {
     params
         .iter()
-        .map(|(key, value)| {
-            format!(
-                "{}={}",
-                urlencoding_encode(key),
-                urlencoding_encode(value)
-            )
-        })
+        .map(|(key, value)| format!("{}={}", urlencoding_encode(key), urlencoding_encode(value)))
         .collect::<Vec<_>>()
         .join("&")
 }
@@ -1001,8 +991,10 @@ mod tests {
 
     #[test]
     fn upstream_transport_error_classifies_as_transport() {
-        let error =
-            MattingError::upstream_transport_error("通用抠图请求失败：dns error".to_string(), false);
+        let error = MattingError::upstream_transport_error(
+            "通用抠图请求失败：dns error".to_string(),
+            false,
+        );
         assert!(error.external_call_attempted());
         assert!(error.is_transport());
         assert!(!error.is_timeout());
@@ -1032,10 +1024,7 @@ mod tests {
 
     #[test]
     fn upstream_response_error_is_external_but_not_transport() {
-        let error = MattingError::upstream_response_error(
-            "抠图结果尺寸不一致".to_string(),
-            None,
-        );
+        let error = MattingError::upstream_response_error("抠图结果尺寸不一致".to_string(), None);
         assert!(error.external_call_attempted());
         assert!(!error.is_transport());
         assert!(!error.is_timeout());
@@ -1130,13 +1119,31 @@ mod tests {
         let sanitized = sanitize_oss_upload_error_body(&body, token);
 
         // 敏感串全部消失：StringToSign 明文、其中的 token、十六进制、签名串、以及 Message 里的 token 明文。
-        assert!(!sanitized.contains(token), "STS token 不能残留（含元素外的明文）");
-        assert!(!sanitized.contains("x-oss-security-token:CAIS"), "StringToSign 明文不能残留");
-        assert!(!sanitized.contains("sigSECRET"), "SignatureProvided 不能残留");
-        assert!(!sanitized.contains("50 55 54 0a"), "StringToSignBytes 不能残留");
+        assert!(
+            !sanitized.contains(token),
+            "STS token 不能残留（含元素外的明文）"
+        );
+        assert!(
+            !sanitized.contains("x-oss-security-token:CAIS"),
+            "StringToSign 明文不能残留"
+        );
+        assert!(
+            !sanitized.contains("sigSECRET"),
+            "SignatureProvided 不能残留"
+        );
+        assert!(
+            !sanitized.contains("50 55 54 0a"),
+            "StringToSignBytes 不能残留"
+        );
         // 可诊断信息保留。
-        assert!(sanitized.contains("SignatureDoesNotMatch"), "OSS Code 应保留供诊断");
-        assert!(sanitized.contains("[redacted]"), "签名材料元素应被脱敏为 [redacted]");
+        assert!(
+            sanitized.contains("SignatureDoesNotMatch"),
+            "OSS Code 应保留供诊断"
+        );
+        assert!(
+            sanitized.contains("[redacted]"),
+            "签名材料元素应被脱敏为 [redacted]"
+        );
     }
 
     fn noise_image(width: u32, height: u32) -> image::DynamicImage {
@@ -1151,10 +1158,12 @@ mod tests {
 
     #[test]
     fn normalize_keeps_small_image_and_outputs_png() {
-        let source =
-            image::DynamicImage::ImageRgba8(image::RgbaImage::from_pixel(200, 150, image::Rgba([10, 20, 30, 255])));
-        let (bytes, dims) =
-            normalize_matting_input_png(&source).expect("normalize should succeed");
+        let source = image::DynamicImage::ImageRgba8(image::RgbaImage::from_pixel(
+            200,
+            150,
+            image::Rgba([10, 20, 30, 255]),
+        ));
+        let (bytes, dims) = normalize_matting_input_png(&source).expect("normalize should succeed");
 
         assert_eq!(dims, (200, 150), "小图不缩放，尺寸原样");
         assert_eq!(
@@ -1168,12 +1177,18 @@ mod tests {
 
     #[test]
     fn normalize_caps_oversized_edge_to_1999() {
-        let source =
-            image::DynamicImage::ImageRgba8(image::RgbaImage::from_pixel(2400, 1200, image::Rgba([0, 0, 0, 255])));
+        let source = image::DynamicImage::ImageRgba8(image::RgbaImage::from_pixel(
+            2400,
+            1200,
+            image::Rgba([0, 0, 0, 255]),
+        ));
         let (_bytes, (width, height)) =
             normalize_matting_input_png(&source).expect("normalize should succeed");
 
-        assert!(width <= MAX_INPUT_EDGE && height <= MAX_INPUT_EDGE, "两边都 ≤1999，实得 {width}x{height}");
+        assert!(
+            width <= MAX_INPUT_EDGE && height <= MAX_INPUT_EDGE,
+            "两边都 ≤1999，实得 {width}x{height}"
+        );
         assert_eq!(width.max(height), MAX_INPUT_EDGE, "最长边压到 1999");
     }
 
@@ -1189,7 +1204,10 @@ mod tests {
         let (bytes, (width, height)) = normalize_matting_input_png_within(&source, limit)
             .expect("limited normalize should succeed");
 
-        assert!(width < 300 && height < 300, "应从 300x300 降尺寸，实得 {width}x{height}");
+        assert!(
+            width < 300 && height < 300,
+            "应从 300x300 降尺寸，实得 {width}x{height}"
+        );
         assert!(
             bytes.len() <= limit || width.min(height) <= MIN_INPUT_EDGE + 1,
             "编码 {} 字节应落在 {limit} 内（或已触最小边下限）",
diff --git a/server-rs/crates/shared-contracts/src/admin.rs b/server-rs/crates/shared-contracts/src/admin.rs
index 7956ee4fb..b893fe4e5 100644
--- a/server-rs/crates/shared-contracts/src/admin.rs
+++ b/server-rs/crates/shared-contracts/src/admin.rs
@@ -8,6 +8,35 @@ use crate::creation_entry_config::{
     UnifiedCreationSpecResponse,
 };
 
+/// 后台 member 可被授予的一级 Tab 权限；账号管理仅 owner 可见，不进入该集合。
+pub const ADMIN_TAB_PERMISSIONS: [&str; 18] = [
+    "dashboard",
+    "overview",
+    "tables",
+    "debug",
+    "tracking",
+    "gray-release",
+    "redeem",
+    "invite",
+    "profile-wallet",
+    "tasks",
+    "recharge-products",
+    "recharge-orders",
+    "editor-generation-pricing",
+    "editor-showcase",
+    "editor-assets",
+    "creation-announcement",
+    "creation-entry",
+    "work-visibility",
+];
+
+#[derive(Clone, Copy, Debug, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+pub enum AdminAccountRole {
+    Owner,
+    Member,
+}
+
 // 管理后台协议统一收口在 shared-contracts，避免页面脚本和 Rust handler 各自手拼字段。
 #[derive(Clone, Debug, Serialize, Deserialize, PartialEq, Eq)]
 #[serde(rename_all = "camelCase")]
@@ -190,6 +219,7 @@ pub struct AdminEditorAssetPayload {
     pub model: Option<String>,
     pub provider: Option<String>,
     pub task_id: Option<String>,
+    pub group_task_id: Option<String>,
     pub asset_kind: Option<String>,
     pub generation_inputs: Option<Value>,
     pub source_resource_id: Option<String>,
@@ -197,6 +227,10 @@ pub struct AdminEditorAssetPayload {
     pub generation_cost_mud_points: u64,
     pub created_at: String,
     pub updated_at: String,
+    pub generator: String,
+    pub task_generator: String,
+    pub task_cost_mud_points: u64,
+    pub children: Vec<AdminEditorAssetPayload>,
 }
 
 #[derive(Clone, Debug, Serialize, Deserialize, PartialEq, Eq)]
@@ -358,10 +392,67 @@ pub struct AdminSessionPayload {
     pub username: String,
     pub display_name: String,
     pub roles: Vec<String>,
+    pub account_role: AdminAccountRole,
+    pub tab_permissions: Vec<String>,
     pub issued_at: String,
     pub expires_at: String,
 }
 
+/// 后台账号列表和写操作响应均复用该安全视图，不返回密码摘要。
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+pub struct AdminAccountPayload {
+    pub account_id: String,
+    pub username: String,
+    pub display_name: String,
+    pub account_role: AdminAccountRole,
+    pub tab_permissions: Vec<String>,
+    pub enabled: bool,
+    pub token_version: u64,
+    pub created_by: String,
+    pub updated_by: String,
+    pub created_at: String,
+    pub updated_at: String,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+pub struct AdminAccountListResponse {
+    pub accounts: Vec<AdminAccountPayload>,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+pub struct AdminCreateAccountRequest {
+    pub username: String,
+    pub display_name: String,
+    pub password: String,
+    pub tab_permissions: Vec<String>,
+    pub enabled: bool,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+pub struct AdminCreateAccountResponse {
+    pub account: AdminAccountPayload,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+pub struct AdminUpdateAccountRequest {
+    pub display_name: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub password: Option<String>,
+    pub tab_permissions: Vec<String>,
+    pub enabled: bool,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+pub struct AdminUpdateAccountResponse {
+    pub account: AdminAccountPayload,
+}
+
 // 页面恢复登录态时读取当前管理员会话。
 #[derive(Clone, Debug, Serialize, Deserialize, PartialEq, Eq)]
 #[serde(rename_all = "camelCase")]
@@ -421,11 +512,32 @@ pub struct AdminDashboardMetricsPayload {
     pub consumed_mud_points: u64,
     pub total_registered_users: u64,
     pub new_registered_users: u64,
+    pub day1_retention: AdminDashboardRetentionPayload,
+    pub day7_retention: AdminDashboardRetentionPayload,
     pub visit_users: u64,
     pub total_visit_users: u64,
     pub visit_count: u64,
     pub total_visit_count: u64,
     pub current_users: u64,
+    pub new_user_payment_conversion: AdminDashboardPaymentConversionPayload,
+}
+
+/// dashboard 新增用户付费转化；rate_basis_points 取值 0..=10000，1 表示 0.01%。
+#[derive(Clone, Debug, Default, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+pub struct AdminDashboardPaymentConversionPayload {
+    pub paid_users: u64,
+    pub new_registered_users: u64,
+    pub rate_basis_points: u32,
+}
+
+/// dashboard 新增用户留存；rate_basis_points 取值 0..=10000，1 表示 0.01%。
+#[derive(Clone, Debug, Default, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+pub struct AdminDashboardRetentionPayload {
+    pub eligible_users: u64,
+    pub retained_users: u64,
+    pub rate_basis_points: u32,
 }
 
 /// dashboard 图表定义，前端只渲染后端给出的 bucket。
@@ -670,8 +782,10 @@ pub struct AdminWalletManualRestrictionPayload {
     pub frozen: bool,
     pub reason: String,
     pub created_by_admin_user_id: String,
+    pub created_by_admin_display_name: String,
     pub created_at_micros: i64,
     pub updated_by_admin_user_id: String,
+    pub updated_by_admin_display_name: String,
     pub updated_at_micros: i64,
 }
 
@@ -697,7 +811,9 @@ pub struct AdminProfileWalletPayload {
 pub struct AdminRechargeRefundPayload {
     pub out_refund_no: String,
     pub provider_refund_id: String,
+    pub provider_transaction_id: String,
     pub provider_status: String,
+    pub total_cents: u64,
     pub refund_cents: u64,
     pub payer_refund_cents: u64,
     pub success_at_micros: Option<i64>,
@@ -712,6 +828,7 @@ pub struct AdminRechargeRefundPayload {
     pub manual_review_resolved_by_admin_user_id: Option<String>,
     pub manual_review_resolution_reason: Option<String>,
     pub manual_review_resolved_at_micros: Option<i64>,
+    pub manual_review_resolved_error_code: Option<String>,
 }
 
 #[derive(Clone, Debug, Serialize, Deserialize, PartialEq, Eq)]
@@ -812,6 +929,7 @@ pub struct AdminRechargeRefundRegisterRequest {
 pub struct AdminRechargeRefundManualReviewResolveRequest {
     pub out_refund_no: String,
     pub reason: String,
+    pub expected_error_code: String,
 }
 
 #[derive(Clone, Debug, Serialize, Deserialize, PartialEq, Eq)]
@@ -864,19 +982,22 @@ pub struct AdminWalletRestrictionResponse {
 mod tests {
     use serde_json::json;
 
-    use super::{
-        AdminEditorShowcaseAssetPayload, AdminRechargeRefundManualReviewResolveRequest,
-    };
+    use super::{AdminEditorShowcaseAssetPayload, AdminRechargeRefundManualReviewResolveRequest};
 
     #[test]
     fn refund_manual_review_resolution_request_uses_camel_case_contract() {
         let value = serde_json::to_value(AdminRechargeRefundManualReviewResolveRequest {
             out_refund_no: "refund-1".to_string(),
             reason: "已核对微信商户平台原始账单".to_string(),
+            expected_error_code: "provider_transaction_id_mismatch".to_string(),
         })
         .expect("request should serialize");
 
         assert_eq!(value["outRefundNo"], json!("refund-1"));
+        assert_eq!(
+            value["expectedErrorCode"],
+            json!("provider_transaction_id_mismatch")
+        );
         assert!(value.get("out_refund_no").is_none());
     }
 
diff --git a/server-rs/crates/shared-contracts/src/runtime.rs b/server-rs/crates/shared-contracts/src/runtime.rs
index aeab11183..ae8c20e49 100644
--- a/server-rs/crates/shared-contracts/src/runtime.rs
+++ b/server-rs/crates/shared-contracts/src/runtime.rs
@@ -533,8 +533,10 @@ pub struct ProfileTaskConfigAdminResponse {
     pub enabled: bool,
     pub sort_order: i32,
     pub created_by: String,
+    pub created_by_display_name: String,
     pub created_at: String,
     pub updated_by: String,
+    pub updated_by_display_name: String,
     pub updated_at: String,
 }
 
@@ -581,8 +583,10 @@ pub struct ProfileWalletConfigAdminResponse {
     pub config_id: String,
     pub initial_mud_points: u64,
     pub created_by: String,
+    pub created_by_display_name: String,
     pub created_at: String,
     pub updated_by: String,
+    pub updated_by_display_name: String,
     pub updated_at: String,
 }
 
@@ -731,6 +735,7 @@ pub struct ProfileCodeOperationAdminResponse {
     pub code: String,
     pub action: String,
     pub operator_user_id: String,
+    pub operator_display_name: String,
     pub created_at: String,
 }
 
diff --git a/server-rs/crates/shared-contracts/tests/profile_task_contract.rs b/server-rs/crates/shared-contracts/tests/profile_task_contract.rs
index e679e9608..d9076c09d 100644
--- a/server-rs/crates/shared-contracts/tests/profile_task_contract.rs
+++ b/server-rs/crates/shared-contracts/tests/profile_task_contract.rs
@@ -39,8 +39,10 @@ fn profile_task_config_admin_response_serializes_scope_kind_as_user() {
         enabled: true,
         sort_order: 10,
         created_by: "admin".to_string(),
+        created_by_display_name: "管理员".to_string(),
         created_at: "2026-05-04T00:00:00Z".to_string(),
         updated_by: "admin".to_string(),
+        updated_by_display_name: "管理员".to_string(),
         updated_at: "2026-05-04T00:00:00Z".to_string(),
     };
 
diff --git a/server-rs/crates/spacetime-client/README.md b/server-rs/crates/spacetime-client/README.md
index 124c06c14..638f07223 100644
--- a/server-rs/crates/spacetime-client/README.md
+++ b/server-rs/crates/spacetime-client/README.md
@@ -24,7 +24,7 @@
 当前目录已不再只是占位。`WP-SC Spacetime Client` 在当前稳定 SpacetimeDB facade 范围内已经完成收尾：
 
 1. 通过 `npm run spacetime:generate -- --rust-only` 生成并纳管公开 Rust bindings。
-2. `DbConnection` 连接池、握手等待、超时和断线清理已封装在 `SpacetimeClient` 内部。
+2. `DbConnection` 调用连接池、单一缓存读连接、握手等待、超时和断线清理已封装在 `SpacetimeClient` 内部；调用池不订阅 read model，HTTP 角色额外使用一条共享连接保存订阅行缓存。
 3. 已稳定的 assets、auth、AI task、Big Fish、Custom World、Puzzle、Runtime/Profile/Save、Story session、combat、inventory、NPC facade 均通过 typed 方法对外暴露。
 4. 生成绑定到 BFF record / module record 的 row snapshot mapper 已集中在 `mapper.rs`。
 5. SDK 调用错误、reducer 业务错误、procedure 业务错误、缺快照错误和本地输入校验错误已统一收口到 `SpacetimeClientError` helper。
diff --git a/server-rs/crates/spacetime-client/src/admin_account.rs b/server-rs/crates/spacetime-client/src/admin_account.rs
new file mode 100644
index 000000000..ffc33e004
--- /dev/null
+++ b/server-rs/crates/spacetime-client/src/admin_account.rs
@@ -0,0 +1,106 @@
+use super::*;
+
+impl SpacetimeClient {
+    pub async fn get_admin_account_by_username(
+        &self,
+        username: String,
+    ) -> Result<AdminAccountCredentialRecord, SpacetimeClientError> {
+        let input = AdminAccountGetByUsernameInput { username };
+        self.call_after_connect(
+            "get_admin_account_by_username_and_return",
+            move |connection, sender| {
+                connection
+                    .procedures()
+                    .get_admin_account_by_username_and_return_then(input, move |_, result| {
+                        let mapped = result
+                            .map_err(SpacetimeClientError::from_sdk_error)
+                            .and_then(map_admin_account_credential_procedure_result);
+                        send_once(&sender, mapped);
+                    });
+            },
+        )
+        .await
+    }
+
+    pub async fn get_admin_account_by_id(
+        &self,
+        account_id: String,
+    ) -> Result<AdminAccountRecord, SpacetimeClientError> {
+        let input = AdminAccountGetByIdInput { account_id };
+        self.call_after_connect(
+            "get_admin_account_by_id_and_return",
+            move |connection, sender| {
+                connection
+                    .procedures()
+                    .get_admin_account_by_id_and_return_then(input, move |_, result| {
+                        let mapped = result
+                            .map_err(SpacetimeClientError::from_sdk_error)
+                            .and_then(map_admin_account_single_procedure_result);
+                        send_once(&sender, mapped);
+                    });
+            },
+        )
+        .await
+    }
+
+    pub async fn list_admin_accounts(
+        &self,
+    ) -> Result<Vec<AdminAccountRecord>, SpacetimeClientError> {
+        self.call_after_connect(
+            "list_admin_accounts_and_return",
+            move |connection, sender| {
+                connection
+                    .procedures()
+                    .list_admin_accounts_and_return_then(move |_, result| {
+                        let mapped = result
+                            .map_err(SpacetimeClientError::from_sdk_error)
+                            .and_then(map_admin_account_list_procedure_result);
+                        send_once(&sender, mapped);
+                    });
+            },
+        )
+        .await
+    }
+
+    pub async fn create_admin_account(
+        &self,
+        input: AdminAccountCreateRecordInput,
+    ) -> Result<AdminAccountRecord, SpacetimeClientError> {
+        let procedure_input = input.into();
+        self.call_after_connect(
+            "create_admin_account_and_return",
+            move |connection, sender| {
+                connection
+                    .procedures()
+                    .create_admin_account_and_return_then(procedure_input, move |_, result| {
+                        let mapped = result
+                            .map_err(SpacetimeClientError::from_sdk_error)
+                            .and_then(map_admin_account_single_procedure_result);
+                        send_once(&sender, mapped);
+                    });
+            },
+        )
+        .await
+    }
+
+    pub async fn update_admin_account(
+        &self,
+        input: AdminAccountUpdateRecordInput,
+    ) -> Result<AdminAccountRecord, SpacetimeClientError> {
+        let procedure_input = input.into();
+        self.call_after_connect(
+            "update_admin_account_and_return",
+            move |connection, sender| {
+                connection
+                    .procedures()
+                    .update_admin_account_and_return_then(procedure_input, move |_, result| {
+                        let mapped = result
+                            .map_err(SpacetimeClientError::from_sdk_error)
+                            .and_then(map_admin_account_single_procedure_result);
+                        send_once(&sender, mapped);
+                    });
+            },
+        )
+        .await
+    }
+}
diff --git a/server-rs/crates/spacetime-client/src/admin_dashboard.rs b/server-rs/crates/spacetime-client/src/admin_dashboard.rs
new file mode 100644
index 000000000..d981070ed
--- /dev/null
+++ b/server-rs/crates/spacetime-client/src/admin_dashboard.rs
@@ -0,0 +1,27 @@
+use super::*;
+
+impl SpacetimeClient {
+    pub async fn get_admin_dashboard_stats(
+        &self,
+        input: AdminDashboardStatsRecordInput,
+    ) -> Result<AdminDashboardStatsRecord, SpacetimeClientError> {
+        let procedure_input = input.into();
+        self.call_after_connect(
+            "get_admin_dashboard_stats_and_return",
+            move |connection, sender| {
+                connection
+                    .procedures()
+                    .get_admin_dashboard_stats_and_return_then(
+                        procedure_input,
+                        move |_, result| {
+                            let mapped = result
+                                .map_err(SpacetimeClientError::from_sdk_error)
+                                .and_then(map_admin_dashboard_stats_procedure_result);
+                            send_once(&sender, mapped);
+                        },
+                    );
+            },
+        )
+        .await
+    }
+}
diff --git a/server-rs/crates/spacetime-client/src/editor_project.rs b/server-rs/crates/spacetime-client/src/editor_project.rs
index faa5e4595..3511a1fa0 100644
--- a/server-rs/crates/spacetime-client/src/editor_project.rs
+++ b/server-rs/crates/spacetime-client/src/editor_project.rs
@@ -333,6 +333,31 @@ impl SpacetimeClient {
         .await
     }
 
+    pub async fn find_editor_asset_group_source(
+        &self,
+        input: EditorAssetGroupSourceLookupRecordInput,
+    ) -> Result<Option<EditorAssetRecord>, SpacetimeClientError> {
+        let procedure_input = input.into();
+
+        self.call_after_connect(
+            "find_editor_asset_group_source_and_return",
+            move |connection, sender| {
+                connection
+                    .procedures()
+                    .find_editor_asset_group_source_and_return_then(
+                        procedure_input,
+                        move |_, result| {
+                            let mapped = result
+                                .map_err(SpacetimeClientError::from_sdk_error)
+                                .and_then(map_optional_editor_asset_procedure_result);
+                            send_once(&sender, mapped);
+                        },
+                    );
+            },
+        )
+        .await
+    }
+
     pub async fn create_editor_asset_folder(
         &self,
         input: EditorAssetFolderCreateRecordInput,
@@ -431,6 +456,31 @@ impl SpacetimeClient {
         .await
     }
 
+    pub async fn complete_editor_asset_group_cohort(
+        &self,
+        input: EditorAssetGroupCohortCompleteRecordInput,
+    ) -> Result<EditorAssetRecord, SpacetimeClientError> {
+        let procedure_input = input.into();
+
+        self.call_after_connect(
+            "complete_editor_asset_group_cohort_and_return",
+            move |connection, sender| {
+                connection
+                    .procedures()
+                    .complete_editor_asset_group_cohort_and_return_then(
+                        procedure_input,
+                        move |_, result| {
+                            let mapped = result
+                                .map_err(SpacetimeClientError::from_sdk_error)
+                                .and_then(map_editor_asset_procedure_result);
+                            send_once(&sender, mapped);
+                        },
+                    );
+            },
+        )
+        .await
+    }
+
     pub async fn update_editor_asset(
         &self,
         input: EditorAssetUpdateRecordInput,
diff --git a/server-rs/crates/spacetime-client/src/lib.rs b/server-rs/crates/spacetime-client/src/lib.rs
index 304be0eb9..a8c73dc43 100644
--- a/server-rs/crates/spacetime-client/src/lib.rs
+++ b/server-rs/crates/spacetime-client/src/lib.rs
@@ -6,24 +6,27 @@ mod mapper;
 mod telemetry;
 use mapper::*;
 pub use mapper::{
-    AdminEditorAssetListRecordInput, AdminEditorAssetRecord, AdminWorkVisibilityRecord,
-    AiResultReferenceRecord, AiTaskMutationRecord, AiTaskRecord, AiTaskStageRecord,
-    AiTextChunkRecord, BarkBattleDraftConfigRecord, BarkBattleRunRecord,
-    BarkBattleRuntimeConfigRecord, BattleStateRecord, BigFishAgentMessageRecord,
-    BigFishAnchorItemRecord, BigFishAnchorPackRecord, BigFishAssetCoverageRecord,
-    BigFishAssetGenerateRecordInput, BigFishAssetSlotRecord, BigFishBackgroundBlueprintRecord,
-    BigFishDraftCompileRecordInput, BigFishGameDraftRecord, BigFishInputSubmitRecordInput,
-    BigFishLevelBlueprintRecord, BigFishLikeReportRecordInput, BigFishMessageFinalizeRecordInput,
-    BigFishMessageSubmitRecordInput, BigFishPlayReportRecordInput, BigFishRunStartRecordInput,
-    BigFishRuntimeEntityRecord, BigFishRuntimeParamsRecord, BigFishRuntimeRunRecord,
-    BigFishSessionCreateRecordInput, BigFishSessionRecord, BigFishVector2Record,
-    BigFishWorkRemixRecordInput, BigFishWorkSummaryRecord, CreationEntryConfigRecord,
-    CustomWorldAgentActionExecuteRecord, CustomWorldAgentActionExecuteRecordInput,
-    CustomWorldAgentCheckpointRecord, CustomWorldAgentMessageFinalizeRecordInput,
-    CustomWorldAgentMessageRecord, CustomWorldAgentMessageSubmitRecordInput,
-    CustomWorldAgentOperationProgressRecordInput, CustomWorldAgentOperationRecord,
-    CustomWorldAgentSessionCreateRecordInput, CustomWorldAgentSessionRecord,
-    CustomWorldCheckpointRecord, CustomWorldDraftCardDetailRecord,
+    AdminAccountCreateRecordInput, AdminAccountCredentialRecord, AdminAccountRecord,
+    AdminAccountUpdateRecordInput, AdminDashboardBreakdownRecord, AdminDashboardDailyCountRecord,
+    AdminDashboardPaymentConversionRecord, AdminDashboardRetentionRecord,
+    AdminDashboardStatsRecord, AdminDashboardStatsRecordInput, AdminEditorAssetListRecordInput,
+    AdminEditorAssetRecord, AdminWorkVisibilityRecord, AiResultReferenceRecord,
+    AiTaskMutationRecord, AiTaskRecord, AiTaskStageRecord, AiTextChunkRecord,
+    BarkBattleDraftConfigRecord, BarkBattleRunRecord, BarkBattleRuntimeConfigRecord,
+    BattleStateRecord, BigFishAgentMessageRecord, BigFishAnchorItemRecord, BigFishAnchorPackRecord,
+    BigFishAssetCoverageRecord, BigFishAssetGenerateRecordInput, BigFishAssetSlotRecord,
+    BigFishBackgroundBlueprintRecord, BigFishDraftCompileRecordInput, BigFishGameDraftRecord,
+    BigFishInputSubmitRecordInput, BigFishLevelBlueprintRecord, BigFishLikeReportRecordInput,
+    BigFishMessageFinalizeRecordInput, BigFishMessageSubmitRecordInput,
+    BigFishPlayReportRecordInput, BigFishRunStartRecordInput, BigFishRuntimeEntityRecord,
+    BigFishRuntimeParamsRecord, BigFishRuntimeRunRecord, BigFishSessionCreateRecordInput,
+    BigFishSessionRecord, BigFishVector2Record, BigFishWorkRemixRecordInput,
+    BigFishWorkSummaryRecord, CreationEntryConfigRecord, CustomWorldAgentActionExecuteRecord,
+    CustomWorldAgentActionExecuteRecordInput, CustomWorldAgentCheckpointRecord,
+    CustomWorldAgentMessageFinalizeRecordInput, CustomWorldAgentMessageRecord,
+    CustomWorldAgentMessageSubmitRecordInput, CustomWorldAgentOperationProgressRecordInput,
+    CustomWorldAgentOperationRecord, CustomWorldAgentSessionCreateRecordInput,
+    CustomWorldAgentSessionRecord, CustomWorldCheckpointRecord, CustomWorldDraftCardDetailRecord,
     CustomWorldDraftCardDetailSectionRecord, CustomWorldDraftCardRecord,
     CustomWorldGalleryEntryRecord, CustomWorldLibraryEntryRecord, CustomWorldLibraryMutationRecord,
     CustomWorldProfileLikeReportRecordInput, CustomWorldProfilePlayReportRecordInput,
@@ -36,7 +39,8 @@ pub use mapper::{
     EditorAgentConversationTouchRecordInput, EditorAssetCreateRecordInput,
     EditorAssetDeleteRecordInput, EditorAssetFolderCreateRecordInput,
     EditorAssetFolderDeleteRecordInput, EditorAssetFolderRecord,
-    EditorAssetFolderUpdateRecordInput, EditorAssetLibraryRecord,
+    EditorAssetFolderUpdateRecordInput, EditorAssetGroupCohortCompleteRecordInput,
+    EditorAssetGroupSourceLookupRecordInput, EditorAssetLibraryRecord,
     EditorAssetMediaRepairRecordInput, EditorAssetRecord, EditorAssetUpdateRecordInput,
     EditorCanvasRecord, EditorCanvasViewportRecord, EditorGenerationModelPricingRecord,
     EditorGenerationPricingConfigRecord, EditorGenerationPricingConfigUpsertRecordInput,
@@ -130,6 +134,8 @@ pub use mapper::{
     WoodenFishWorkSummaryResponse, WoodenFishWorkspaceCreateRequest,
 };
 
+pub mod admin_account;
+pub mod admin_dashboard;
 pub mod ai;
 pub mod assets;
 pub mod auth;
@@ -365,6 +371,7 @@ pub struct AuthStoreProjectionSyncRecord {
 pub struct SpacetimeClient {
     config: SpacetimeClientConfig,
     pool: Arc<SpacetimeConnectionPool>,
+    cached_read_connection: Option<Arc<CachedReadConnectionState>>,
     health_state: Arc<RwLock<SpacetimeClientHealthState>>,
     creation_entry_config_cache: Arc<RwLock<Option<CreationEntryConfigRecord>>>,
     feature_gate_config_cache: Arc<RwLock<Option<Vec<FeatureGateConfigRecord>>>>,
@@ -449,11 +456,20 @@ struct PooledConnectionSlot {
 
 struct PooledConnection {
     connection: DbConnection,
-    _read_model_subscriptions: Vec<SubscriptionHandle>,
     runner: Option<JoinHandle<()>>,
     broken: Arc<AtomicBool>,
 }
 
+struct CachedReadConnectionState {
+    connection: RwLock<Option<Arc<CachedReadConnection>>>,
+    initialize: tokio::sync::Mutex<()>,
+}
+
+struct CachedReadConnection {
+    connection: PooledConnection,
+    _read_model_subscriptions: Vec<SubscriptionHandle>,
+}
+
 struct PooledConnectionLease {
     slot_index: usize,
     connection: Option<PooledConnection>,
@@ -500,10 +516,17 @@ impl SpacetimeClient {
             slots,
             permits: Arc::new(Semaphore::new(pool_size)),
         });
+        let cached_read_connection = config.subscribe_cached_read_models.then(|| {
+            Arc::new(CachedReadConnectionState {
+                connection: RwLock::new(None),
+                initialize: tokio::sync::Mutex::new(()),
+            })
+        });
 
         Self {
             config,
             pool,
+            cached_read_connection,
             health_state: Arc::new(RwLock::new(SpacetimeClientHealthState::default())),
             creation_entry_config_cache: Arc::new(RwLock::new(None)),
             feature_gate_config_cache: Arc::new(RwLock::new(None)),
@@ -650,11 +673,11 @@ impl SpacetimeClient {
     {
         let started_at = Instant::now();
         let metrics_guard = telemetry::begin_read(read_name);
-        let lease = match self
-            .acquire_connection_with_timeout(self.config.procedure_timeout)
+        let connection = match self
+            .cached_read_connection_with_timeout(self.config.procedure_timeout)
             .await
         {
-            Ok(lease) => lease,
+            Ok(connection) => connection,
             Err(error) => {
                 log_spacetime_client_failure(
                     "read",
@@ -668,14 +691,7 @@ impl SpacetimeClient {
                 return final_result;
             }
         };
-        let final_result = if let Some(connection) = lease.connection.as_ref() {
-            read(&connection.connection)
-        } else {
-            Err(SpacetimeClientError::Runtime(
-                "SpacetimeDB 连接租约缺少连接".to_string(),
-            ))
-        };
-        self.release_connection(lease).await;
+        let final_result = read(&connection.connection.connection);
 
         if let Err(error) = &final_result {
             log_spacetime_client_failure(
@@ -714,10 +730,22 @@ impl SpacetimeClient {
         };
         let started_at = Instant::now();
         let checked_at_micros = current_unix_micros();
-        let result = self.acquire_connection_with_timeout(timeout).await;
-        match result {
+        let result = match self.acquire_connection_with_timeout(timeout).await {
             Ok(lease) => {
                 self.release_connection(lease).await;
+                if self.cached_read_connection.is_some() {
+                    let remaining = timeout.saturating_sub(started_at.elapsed());
+                    self.cached_read_connection_with_timeout(remaining)
+                        .await
+                        .map(|_| ())
+                } else {
+                    Ok(())
+                }
+            }
+            Err(error) => Err(error),
+        };
+        match result {
+            Ok(()) => {
                 let mut health_state = self.health_state.write().await;
                 health_state.last_success_at_micros = Some(checked_at_micros);
                 health_state.last_error = None;
@@ -821,6 +849,68 @@ impl SpacetimeClient {
         Ok(lease)
     }
 
+    async fn cached_read_connection_with_timeout(
+        &self,
+        operation_timeout: Duration,
+    ) -> Result<Arc<CachedReadConnection>, SpacetimeStageError> {
+        let started_at = Instant::now();
+        let state = self.cached_read_connection.as_ref().ok_or_else(|| {
+            SpacetimeStageError::new(
+                SpacetimeClientStage::ReadCache,
+                SpacetimeClientError::Runtime("当前进程未启用 SpacetimeDB 缓存读连接".to_string()),
+            )
+        })?;
+
+        if let Some(connection) = state
+            .connection
+            .read()
+            .await
+            .clone()
+            .filter(|connection| !connection.is_broken())
+        {
+            return Ok(connection);
+        }
+
+        let remaining = operation_timeout.saturating_sub(started_at.elapsed());
+        let _initialize = timeout(remaining, state.initialize.lock())
+            .await
+            .map_err(|_| {
+                SpacetimeStageError::new(
+                    SpacetimeClientStage::ReadCache,
+                    SpacetimeClientError::Timeout(SpacetimeClientStage::ReadCache),
+                )
+            })?;
+
+        if let Some(connection) = state
+            .connection
+            .read()
+            .await
+            .clone()
+            .filter(|connection| !connection.is_broken())
+        {
+            return Ok(connection);
+        }
+
+        let remaining = operation_timeout.saturating_sub(started_at.elapsed());
+        let connection = timeout(remaining, self.build_cached_read_connection(remaining))
+            .await
+            .map_err(|_| {
+                SpacetimeStageError::new(
+                    SpacetimeClientStage::ReadCache,
+                    SpacetimeClientError::Timeout(SpacetimeClientStage::ReadCache),
+                )
+            })??;
+        if connection.is_broken() {
+            return Err(SpacetimeStageError::new(
+                SpacetimeClientStage::ReadCache,
+                SpacetimeClientError::ConnectDropped,
+            ));
+        }
+        let connection = Arc::new(connection);
+        *state.connection.write().await = Some(connection.clone());
+        Ok(connection)
+    }
+
     async fn build_pooled_connection(
         &self,
         operation_timeout: Duration,
@@ -889,21 +979,33 @@ impl SpacetimeClient {
                 SpacetimeStageError::new(SpacetimeClientStage::ConnectHandshake, error)
             })?;
 
-        let read_model_subscriptions = if self.config.subscribe_cached_read_models {
-            self.subscribe_cached_read_models(&connection, broken.clone(), operation_timeout)
-                .await?
-        } else {
-            Vec::new()
-        };
-
         Ok(PooledConnection {
             connection,
-            _read_model_subscriptions: read_model_subscriptions,
             runner: Some(runner),
             broken,
         })
     }
 
+    async fn build_cached_read_connection(
+        &self,
+        operation_timeout: Duration,
+    ) -> Result<CachedReadConnection, SpacetimeStageError> {
+        let connection = self.build_pooled_connection(operation_timeout).await?;
+        let subscriptions = self
+            .subscribe_cached_read_models(
+                &connection.connection,
+                connection.broken.clone(),
+                operation_timeout,
+            )
+            .await?;
+        Self::ensure_cached_read_connection_alive(connection.broken.as_ref())?;
+
+        Ok(CachedReadConnection {
+            connection,
+            _read_model_subscriptions: subscriptions,
+        })
+    }
+
     async fn subscribe_cached_read_models(
         &self,
         connection: &DbConnection,
@@ -912,6 +1014,7 @@ impl SpacetimeClient {
     ) -> Result<Vec<SubscriptionHandle>, SpacetimeStageError> {
         let mut subscriptions = Vec::new();
         for query in REQUIRED_CACHED_READ_MODEL_QUERIES {
+            Self::ensure_cached_read_connection_alive(broken.as_ref())?;
             let subscription = self
                 .subscribe_cached_read_model_query(
                     connection,
@@ -925,7 +1028,8 @@ impl SpacetimeClient {
         }
 
         for query in OPTIONAL_CACHED_READ_MODEL_QUERIES {
-            if let Ok(subscription) = self
+            Self::ensure_cached_read_connection_alive(broken.as_ref())?;
+            match self
                 .subscribe_cached_read_model_query(
                     connection,
                     broken.clone(),
@@ -935,13 +1039,33 @@ impl SpacetimeClient {
                 )
                 .await
             {
-                subscriptions.push(subscription);
+                Ok(subscription) => subscriptions.push(subscription),
+                Err(error) => {
+                    Self::ensure_cached_read_connection_alive(broken.as_ref())?;
+                    warn!(
+                        query,
+                        spacetime_stage = error.stage.as_str(),
+                        error = %error.error,
+                        "SpacetimeDB optional cached read-model subscription failed"
+                    );
+                }
             }
         }
+        Self::ensure_cached_read_connection_alive(broken.as_ref())?;
 
         Ok(subscriptions)
     }
 
+    fn ensure_cached_read_connection_alive(broken: &AtomicBool) -> Result<(), SpacetimeStageError> {
+        if broken.load(Ordering::SeqCst) {
+            return Err(SpacetimeStageError::new(
+                SpacetimeClientStage::ReadModelSubscribe,
+                SpacetimeClientError::ConnectDropped,
+            ));
+        }
+        Ok(())
+    }
+
     async fn subscribe_cached_read_model_query(
         &self,
         connection: &DbConnection,
@@ -1100,6 +1224,12 @@ impl PooledConnection {
     }
 }
 
+impl CachedReadConnection {
+    fn is_broken(&self) -> bool {
+        self.connection.is_broken()
+    }
+}
+
 impl Drop for PooledConnection {
     fn drop(&mut self) {
         let _ = self.connection.disconnect();
@@ -1114,6 +1244,10 @@ impl fmt::Debug for SpacetimeClient {
         f.debug_struct("SpacetimeClient")
             .field("config", &self.config)
             .field("pool_size", &self.pool.slots.len())
+            .field(
+                "cached_read_connection_enabled",
+                &self.cached_read_connection.is_some(),
+            )
             .finish()
     }
 }
@@ -1225,6 +1359,94 @@ mod tests {
         })
     }
 
+    fn test_client_with_cached_reads(pool_size: u32) -> SpacetimeClient {
+        SpacetimeClient::new(SpacetimeClientConfig {
+            server_url: "http://127.0.0.1:9".to_string(),
+            database: "pool-test".to_string(),
+            token: None,
+            pool_size,
+            procedure_timeout: Duration::from_millis(200),
+            subscribe_cached_read_models: true,
+        })
+    }
+
+    #[test]
+    fn cached_read_models_use_one_connection_outside_the_procedure_pool() {
+        let client = test_client_with_cached_reads(8);
+
+        assert_eq!(client.pool.slots.len(), 8);
+        assert!(client.cached_read_connection.is_some());
+        assert!(
+            client.pool.slots.iter().all(|slot| slot
+                .connection
+                .try_lock()
+                .expect("slot lock")
+                .is_none())
+        );
+    }
+
+    #[test]
+    fn non_http_client_does_not_allocate_cached_read_connection_state() {
+        let client = test_client(1, Duration::from_millis(200));
+
+        assert_eq!(client.pool.slots.len(), 1);
+        assert!(client.cached_read_connection.is_none());
+    }
+
+    #[tokio::test]
+    async fn cached_read_fails_before_connect_when_role_disables_read_models() {
+        let client = test_client(1, Duration::from_millis(200));
+        let result = client
+            .cached_read_connection_with_timeout(Duration::from_millis(200))
+            .await;
+
+        let error = match result {
+            Ok(_) => panic!("未启用 read model 的进程不应创建缓存读连接"),
+            Err(error) => error,
+        };
+        assert_eq!(error.stage, SpacetimeClientStage::ReadCache);
+        assert!(matches!(error.error, SpacetimeClientError::Runtime(_)));
+    }
+
+    #[tokio::test]
+    async fn cached_read_initialization_wait_respects_total_timeout() {
+        let client = test_client_with_cached_reads(1);
+        let state = client
+            .cached_read_connection
+            .as_ref()
+            .expect("cached read state")
+            .clone();
+        let _initialize = state.initialize.lock().await;
+        let operation_timeout = Duration::from_millis(25);
+        let started_at = Instant::now();
+
+        let result = client
+            .cached_read_connection_with_timeout(operation_timeout)
+            .await;
+        let error = match result {
+            Ok(_) => panic!("singleflight wait should time out"),
+            Err(error) => error,
+        };
+
+        assert_eq!(error.stage, SpacetimeClientStage::ReadCache);
+        assert!(matches!(
+            error.error,
+            SpacetimeClientError::Timeout(SpacetimeClientStage::ReadCache)
+        ));
+        assert!(started_at.elapsed() < Duration::from_millis(150));
+    }
+
+    #[test]
+    fn broken_cached_read_connection_cannot_be_published() {
+        let broken = AtomicBool::new(true);
+
+        let error = SpacetimeClient::ensure_cached_read_connection_alive(&broken)
+            .expect_err("broken cached read connection should fail");
+
+        assert_eq!(error.stage, SpacetimeClientStage::ReadModelSubscribe);
+        assert!(matches!(error.error, SpacetimeClientError::ConnectDropped));
+    }
+
     /// 复现线上故障机制：修复前请求 future 被取消时租约不会归还，槽位永久停留在 in_use，
     /// 后续 acquire 拿着 permit 空转挂死。修复后租约 Drop 必须同时复位槽位与 permit。
     #[tokio::test]
diff --git a/server-rs/crates/spacetime-client/src/mapper.rs b/server-rs/crates/spacetime-client/src/mapper.rs
index baf9e351e..0eb851f95 100644
--- a/server-rs/crates/spacetime-client/src/mapper.rs
+++ b/server-rs/crates/spacetime-client/src/mapper.rs
@@ -1,5 +1,7 @@
 use super::*;
 
+mod admin_account;
+mod admin_dashboard;
 mod ai;
 mod assets;
 mod auth;
@@ -27,6 +29,15 @@ mod story;
 mod visual_novel;
 mod wooden_fish;
 
+pub use self::admin_account::{
+    AdminAccountCreateRecordInput, AdminAccountCredentialRecord, AdminAccountRecord,
+    AdminAccountUpdateRecordInput,
+};
+pub use self::admin_dashboard::{
+    AdminDashboardBreakdownRecord, AdminDashboardDailyCountRecord,
+    AdminDashboardPaymentConversionRecord, AdminDashboardRetentionRecord,
+    AdminDashboardStatsRecord, AdminDashboardStatsRecordInput,
+};
 pub use self::ai::{
     AiResultReferenceRecord, AiTaskMutationRecord, AiTaskRecord, AiTaskStageRecord,
     AiTextChunkRecord,
@@ -81,7 +92,8 @@ pub use self::editor_project::{
     AdminEditorAssetListRecordInput, AdminEditorAssetRecord, EditorAssetCreateRecordInput,
     EditorAssetDeleteRecordInput, EditorAssetFolderCreateRecordInput,
     EditorAssetFolderDeleteRecordInput, EditorAssetFolderRecord,
-    EditorAssetFolderUpdateRecordInput, EditorAssetLibraryRecord,
+    EditorAssetFolderUpdateRecordInput, EditorAssetGroupCohortCompleteRecordInput,
+    EditorAssetGroupSourceLookupRecordInput, EditorAssetLibraryRecord,
     EditorAssetMediaRepairRecordInput, EditorAssetRecord, EditorAssetUpdateRecordInput,
     EditorCanvasRecord, EditorCanvasViewportRecord, EditorGenerationModelPricingRecord,
     EditorGenerationPricingConfigRecord, EditorGenerationPricingConfigUpsertRecordInput,
@@ -189,6 +201,11 @@ pub use self::wooden_fish::{
     WoodenFishWorkSummaryResponse, WoodenFishWorkspaceCreateRequest,
 };
 
+pub(crate) use self::admin_account::{
+    map_admin_account_credential_procedure_result, map_admin_account_list_procedure_result,
+    map_admin_account_single_procedure_result,
+};
+pub(crate) use self::admin_dashboard::map_admin_dashboard_stats_procedure_result;
 pub(crate) use self::ai::map_ai_task_procedure_result;
 pub(crate) use self::assets::{
     map_asset_read_access_procedure_result, map_entity_binding_procedure_result,
@@ -240,6 +257,7 @@ pub(crate) use self::editor_project::{
     map_editor_project_resource_procedure_result, map_editor_showcase_asset_list_procedure_result,
     map_editor_showcase_asset_procedure_result,
     map_editor_showcase_campaign_config_procedure_result,
+    map_optional_editor_asset_procedure_result,
 };
 pub(crate) use self::external_api_key::{
     map_external_api_key_list_procedure_result, map_external_api_key_single_procedure_result,
diff --git a/server-rs/crates/spacetime-client/src/mapper/admin_account.rs b/server-rs/crates/spacetime-client/src/mapper/admin_account.rs
new file mode 100644
index 000000000..b8a6d4fda
--- /dev/null
+++ b/server-rs/crates/spacetime-client/src/mapper/admin_account.rs
@@ -0,0 +1,191 @@
+use super::*;
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct AdminAccountRecord {
+    pub account_id: String,
+    pub username: String,
+    pub display_name: String,
+    pub tab_permissions: Vec<String>,
+    pub enabled: bool,
+    pub token_version: u64,
+    pub created_by: String,
+    pub updated_by: String,
+    pub created_at: String,
+    pub updated_at: String,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct AdminAccountCredentialRecord {
+    pub account: AdminAccountRecord,
+    pub password_hash: String,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct AdminAccountCreateRecordInput {
+    pub account_id: String,
+    pub username: String,
+    pub display_name: String,
+    pub password_hash: String,
+    pub tab_permissions: Vec<String>,
+    pub enabled: bool,
+    pub created_by: String,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct AdminAccountUpdateRecordInput {
+    pub account_id: String,
+    pub display_name: String,
+    pub password_hash: Option<String>,
+    pub tab_permissions: Vec<String>,
+    pub enabled: bool,
+    pub updated_by: String,
+}
+
+impl From<AdminAccountCreateRecordInput> for crate::module_bindings::AdminAccountCreateInput {
+    fn from(input: AdminAccountCreateRecordInput) -> Self {
+        Self {
+            account_id: input.account_id,
+            username: input.username,
+            display_name: input.display_name,
+            password_hash: input.password_hash,
+            tab_permissions_json: serde_json::to_string(&input.tab_permissions)
+                .unwrap_or_else(|_| "[]".to_string()),
+            enabled: input.enabled,
+            created_by: input.created_by,
+        }
+    }
+}
+
+impl From<AdminAccountUpdateRecordInput> for crate::module_bindings::AdminAccountUpdateInput {
+    fn from(input: AdminAccountUpdateRecordInput) -> Self {
+        Self {
+            account_id: input.account_id,
+            display_name: input.display_name,
+            password_hash: input.password_hash,
+            tab_permissions_json: serde_json::to_string(&input.tab_permissions)
+                .unwrap_or_else(|_| "[]".to_string()),
+            enabled: input.enabled,
+            updated_by: input.updated_by,
+        }
+    }
+}
+
+pub(crate) fn map_admin_account_single_procedure_result(
+    result: AdminAccountProcedureResult,
+) -> Result<AdminAccountRecord, SpacetimeClientError> {
+    if !result.ok {
+        return Err(SpacetimeClientError::procedure_failed(result.error_message));
+    }
+
+    result
+        .account
+        .map(map_admin_account_snapshot)
+        .transpose()?
+        .ok_or_else(|| SpacetimeClientError::missing_snapshot("后台账号快照"))
+}
+
+pub(crate) fn map_admin_account_credential_procedure_result(
+    result: AdminAccountCredentialProcedureResult,
+) -> Result<AdminAccountCredentialRecord, SpacetimeClientError> {
+    if !result.ok {
+        return Err(SpacetimeClientError::procedure_failed(result.error_message));
+    }
+
+    result
+        .account
+        .map(map_admin_account_credential_snapshot)
+        .transpose()?
+        .ok_or_else(|| SpacetimeClientError::missing_snapshot("后台账号凭据快照"))
+}
+
+pub(crate) fn map_admin_account_list_procedure_result(
+    result: AdminAccountProcedureResult,
+) -> Result<Vec<AdminAccountRecord>, SpacetimeClientError> {
+    if !result.ok {
+        return Err(SpacetimeClientError::procedure_failed(result.error_message));
+    }
+
+    result
+        .accounts
+        .into_iter()
+        .map(map_admin_account_snapshot)
+        .collect()
+}
+
+fn map_admin_account_snapshot(
+    snapshot: AdminAccountSnapshot,
+) -> Result<AdminAccountRecord, SpacetimeClientError> {
+    Ok(AdminAccountRecord {
+        account_id: snapshot.account_id,
+        username: snapshot.username,
+        display_name: snapshot.display_name,
+        tab_permissions: serde_json::from_str::<Vec<String>>(
+            snapshot.tab_permissions_json.as_str(),
+        )
+        .map_err(SpacetimeClientError::validation_failed)?,
+        enabled: snapshot.enabled,
+        token_version: snapshot.token_version,
+        created_by: snapshot.created_by,
+        updated_by: snapshot.updated_by,
+        created_at: format_timestamp_micros(snapshot.created_at_micros),
+        updated_at: format_timestamp_micros(snapshot.updated_at_micros),
+    })
+}
+
+fn map_admin_account_credential_snapshot(
+    snapshot: AdminAccountCredentialSnapshot,
+) -> Result<AdminAccountCredentialRecord, SpacetimeClientError> {
+    Ok(AdminAccountCredentialRecord {
+        account: map_admin_account_snapshot(snapshot.account)?,
+        password_hash: snapshot.password_hash,
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn maps_public_account_without_password_hash() {
+        let record = map_admin_account_snapshot(AdminAccountSnapshot {
+            account_id: "member-1".to_string(),
+            username: "operator".to_string(),
+            display_name: "运营".to_string(),
+            tab_permissions_json: r#"["dashboard","tracking"]"#.to_string(),
+            enabled: false,
+            token_version: 3,
+            created_by: "owner".to_string(),
+            updated_by: "owner".to_string(),
+            created_at_micros: 0,
+            updated_at_micros: 0,
+        })
+        .expect("snapshot should map");
+
+        assert_eq!(record.tab_permissions, ["dashboard", "tracking"]);
+        assert!(!record.enabled);
+        assert_eq!(record.token_version, 3);
+    }
+
+    #[test]
+    fn maps_login_credential_separately_from_public_account() {
+        let record = map_admin_account_credential_snapshot(AdminAccountCredentialSnapshot {
+            account: AdminAccountSnapshot {
+                account_id: "member-1".to_string(),
+                username: "operator".to_string(),
+                display_name: "运营".to_string(),
+                tab_permissions_json: r#"["dashboard"]"#.to_string(),
+                enabled: true,
+                token_version: 3,
+                created_by: "owner".to_string(),
+                updated_by: "owner".to_string(),
+                created_at_micros: 0,
+                updated_at_micros: 0,
+            },
+            password_hash: "$argon2id$hash".to_string(),
+        })
+        .expect("credential snapshot should map");
+
+        assert_eq!(record.account.account_id, "member-1");
+        assert_eq!(record.password_hash, "$argon2id$hash");
+    }
+}
diff --git a/server-rs/crates/spacetime-client/src/mapper/admin_dashboard.rs b/server-rs/crates/spacetime-client/src/mapper/admin_dashboard.rs
new file mode 100644
index 000000000..a0694266d
--- /dev/null
+++ b/server-rs/crates/spacetime-client/src/mapper/admin_dashboard.rs
@@ -0,0 +1,214 @@
+use super::*;
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct AdminDashboardStatsRecordInput {
+    pub start_day_key: i64,
+    pub end_day_key: i64,
+    pub now_micros: i64,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct AdminDashboardDailyCountRecord {
+    pub day_key: i64,
+    pub count: u64,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct AdminDashboardBreakdownRecord {
+    pub key: String,
+    pub count: u64,
+}
+
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+pub struct AdminDashboardRetentionRecord {
+    pub eligible_users: u64,
+    pub retained_users: u64,
+    pub rate_basis_points: u32,
+}
+
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+pub struct AdminDashboardPaymentConversionRecord {
+    pub paid_users: u64,
+    pub new_registered_users: u64,
+    pub rate_basis_points: u32,
+}
+
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+pub struct AdminDashboardStatsRecord {
+    pub total_registered_users: u64,
+    pub new_registered_users: Vec<AdminDashboardDailyCountRecord>,
+    pub visit_count: Vec<AdminDashboardDailyCountRecord>,
+    pub visit_users_by_day: Vec<AdminDashboardDailyCountRecord>,
+    pub visit_users: u64,
+    pub total_visit_count: u64,
+    pub total_visit_users: u64,
+    pub current_users: u64,
+    pub day1_retention: AdminDashboardRetentionRecord,
+    pub day7_retention: AdminDashboardRetentionRecord,
+    pub module_visit_breakdown: Vec<AdminDashboardBreakdownRecord>,
+    pub new_user_payment_conversion: AdminDashboardPaymentConversionRecord,
+}
+
+impl From<AdminDashboardStatsRecordInput> for AdminDashboardStatsInput {
+    fn from(input: AdminDashboardStatsRecordInput) -> Self {
+        Self {
+            start_day_key: input.start_day_key,
+            end_day_key: input.end_day_key,
+            now_micros: input.now_micros,
+        }
+    }
+}
+
+pub(crate) fn map_admin_dashboard_stats_procedure_result(
+    result: AdminDashboardStatsProcedureResult,
+) -> Result<AdminDashboardStatsRecord, SpacetimeClientError> {
+    if !result.ok {
+        return Err(SpacetimeClientError::procedure_failed(result.error_message));
+    }
+    result
+        .snapshot
+        .map(map_admin_dashboard_stats_snapshot)
+        .ok_or_else(|| SpacetimeClientError::missing_snapshot("后台 Dashboard 统计快照"))
+}
+
+fn map_admin_dashboard_stats_snapshot(
+    snapshot: AdminDashboardStatsSnapshot,
+) -> AdminDashboardStatsRecord {
+    AdminDashboardStatsRecord {
+        total_registered_users: snapshot.total_registered_users,
+        new_registered_users: snapshot
+            .new_registered_users
+            .into_iter()
+            .map(map_admin_dashboard_daily_count)
+            .collect(),
+        visit_count: snapshot
+            .visit_count
+            .into_iter()
+            .map(map_admin_dashboard_daily_count)
+            .collect(),
+        visit_users_by_day: snapshot
+            .visit_users_by_day
+            .into_iter()
+            .map(map_admin_dashboard_daily_count)
+            .collect(),
+        visit_users: snapshot.visit_users,
+        total_visit_count: snapshot.total_visit_count,
+        total_visit_users: snapshot.total_visit_users,
+        current_users: snapshot.current_users,
+        day1_retention: map_admin_dashboard_retention(snapshot.day_1_retention),
+        day7_retention: map_admin_dashboard_retention(snapshot.day_7_retention),
+        module_visit_breakdown: snapshot
+            .module_visit_breakdown
+            .into_iter()
+            .map(|entry| AdminDashboardBreakdownRecord {
+                key: entry.key,
+                count: entry.count,
+            })
+            .collect(),
+        new_user_payment_conversion: map_admin_dashboard_payment_conversion(
+            snapshot.new_user_payment_conversion,
+        ),
+    }
+}
+
+fn map_admin_dashboard_daily_count(
+    entry: AdminDashboardDailyCountSnapshot,
+) -> AdminDashboardDailyCountRecord {
+    AdminDashboardDailyCountRecord {
+        day_key: entry.day_key,
+        count: entry.count,
+    }
+}
+
+fn map_admin_dashboard_retention(
+    retention: AdminDashboardRetentionSnapshot,
+) -> AdminDashboardRetentionRecord {
+    AdminDashboardRetentionRecord {
+        eligible_users: retention.eligible_users,
+        retained_users: retention.retained_users,
+        rate_basis_points: retention.rate_basis_points,
+    }
+}
+
+fn map_admin_dashboard_payment_conversion(
+    conversion: AdminDashboardPaymentConversionSnapshot,
+) -> AdminDashboardPaymentConversionRecord {
+    AdminDashboardPaymentConversionRecord {
+        paid_users: conversion.paid_users,
+        new_registered_users: conversion.new_registered_users,
+        rate_basis_points: conversion.rate_basis_points,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn maps_admin_dashboard_stats_procedure_snapshot() {
+        let record =
+            map_admin_dashboard_stats_procedure_result(AdminDashboardStatsProcedureResult {
+                ok: true,
+                snapshot: Some(AdminDashboardStatsSnapshot {
+                    total_registered_users: 12,
+                    new_registered_users: vec![AdminDashboardDailyCountSnapshot {
+                        day_key: 100,
+                        count: 3,
+                    }],
+                    visit_count: vec![AdminDashboardDailyCountSnapshot {
+                        day_key: 100,
+                        count: 20,
+                    }],
+                    visit_users_by_day: vec![AdminDashboardDailyCountSnapshot {
+                        day_key: 100,
+                        count: 8,
+                    }],
+                    visit_users: 8,
+                    total_visit_count: 99,
+                    total_visit_users: 11,
+                    current_users: 2,
+                    day_1_retention: AdminDashboardRetentionSnapshot {
+                        eligible_users: 4,
+                        retained_users: 2,
+                        rate_basis_points: 5_000,
+                    },
+                    day_7_retention: AdminDashboardRetentionSnapshot {
+                        eligible_users: 3,
+                        retained_users: 1,
+                        rate_basis_points: 3_333,
+                    },
+                    module_visit_breakdown: vec![AdminDashboardBreakdownSnapshot {
+                        key: "profile".to_string(),
+                        count: 7,
+                    }],
+                    new_user_payment_conversion: AdminDashboardPaymentConversionSnapshot {
+                        paid_users: 2,
+                        new_registered_users: 5,
+                        rate_basis_points: 4_000,
+                    },
+                }),
+                error_message: None,
+            })
+            .expect("dashboard stats should map");
+
+        assert_eq!(record.total_visit_count, 99);
+        assert_eq!(record.day1_retention.rate_basis_points, 5_000);
+        assert_eq!(record.module_visit_breakdown[0].key, "profile");
+        assert_eq!(record.new_user_payment_conversion.paid_users, 2);
+        assert_eq!(record.new_user_payment_conversion.new_registered_users, 5);
+        assert_eq!(record.new_user_payment_conversion.rate_basis_points, 4_000);
+    }
+
+    #[test]
+    fn rejects_failed_admin_dashboard_stats_procedure_result() {
+        let error =
+            map_admin_dashboard_stats_procedure_result(AdminDashboardStatsProcedureResult {
+                ok: false,
+                snapshot: None,
+                error_message: Some("统计失败".to_string()),
+            })
+            .expect_err("failed result should stay failed");
+
+        assert!(error.to_string().contains("统计失败"));
+    }
+}
diff --git a/server-rs/crates/spacetime-client/src/mapper/editor_project.rs b/server-rs/crates/spacetime-client/src/mapper/editor_project.rs
index 4f96a5fc0..f5ed19831 100644
--- a/server-rs/crates/spacetime-client/src/mapper/editor_project.rs
+++ b/server-rs/crates/spacetime-client/src/mapper/editor_project.rs
@@ -121,6 +121,7 @@ pub struct AdminEditorAssetRecord {
     pub model: Option<String>,
     pub provider: Option<String>,
     pub task_id: Option<String>,
+    pub group_task_id: Option<String>,
     pub asset_kind: Option<String>,
     pub generation_inputs: Option<serde_json::Value>,
     pub source_resource_id: Option<String>,
@@ -344,6 +345,26 @@ pub struct EditorAssetCreateRecordInput {
     pub now_micros: i64,
     pub thumbnail_src: Option<String>,
     pub generation_cost_mud_points: u64,
+    pub group_task_id: Option<String>,
+    pub group_task_expected_asset_count: Option<u32>,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct EditorAssetGroupSourceLookupRecordInput {
+    pub owner_user_id: String,
+    pub source_resource_ids: Vec<String>,
+    pub asset_object_id: Option<String>,
+    pub object_key: Option<String>,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct EditorAssetGroupCohortCompleteRecordInput {
+    pub owner_user_id: String,
+    pub task_id: String,
+    pub group_task_id: String,
+    pub expected_asset_count: u32,
+    pub asset_ids: Vec<String>,
+    pub completed_at_micros: i64,
 }
 
 #[derive(Clone, Debug, PartialEq, Eq)]
@@ -653,6 +674,36 @@ impl From<EditorAssetCreateRecordInput> for crate::module_bindings::EditorAssetC
             now_micros: input.now_micros,
             thumbnail_src: input.thumbnail_src,
             generation_cost_mud_points: input.generation_cost_mud_points,
+            group_task_id: input.group_task_id,
+            group_task_expected_asset_count: input.group_task_expected_asset_count,
+        }
+    }
+}
+
+impl From<EditorAssetGroupSourceLookupRecordInput>
+    for crate::module_bindings::EditorAssetGroupSourceLookupInput
+{
+    fn from(input: EditorAssetGroupSourceLookupRecordInput) -> Self {
+        Self {
+            owner_user_id: input.owner_user_id,
+            source_resource_ids: input.source_resource_ids,
+            asset_object_id: input.asset_object_id,
+            object_key: input.object_key,
+        }
+    }
+}
+
+impl From<EditorAssetGroupCohortCompleteRecordInput>
+    for crate::module_bindings::EditorAssetGroupCohortCompleteInput
+{
+    fn from(input: EditorAssetGroupCohortCompleteRecordInput) -> Self {
+        Self {
+            owner_user_id: input.owner_user_id,
+            task_id: input.task_id,
+            group_task_id: input.group_task_id,
+            expected_asset_count: input.expected_asset_count,
+            asset_ids: input.asset_ids,
+            completed_at_micros: input.completed_at_micros,
         }
     }
 }
@@ -1003,6 +1054,16 @@ pub(crate) fn map_editor_asset_procedure_result(
         .ok_or_else(|| SpacetimeClientError::missing_snapshot("图片画布素材快照"))
 }
 
+pub(crate) fn map_optional_editor_asset_procedure_result(
+    result: EditorAssetProcedureResult,
+) -> Result<Option<EditorAssetRecord>, SpacetimeClientError> {
+    if !result.ok {
+        return Err(SpacetimeClientError::procedure_failed(result.error_message));
+    }
+
+    result.asset.map(map_editor_asset_snapshot).transpose()
+}
+
 pub(crate) fn map_admin_editor_asset_list_procedure_result(
     result: AdminEditorAssetListProcedureResult,
 ) -> Result<Vec<AdminEditorAssetRecord>, SpacetimeClientError> {
@@ -1239,6 +1300,7 @@ fn map_admin_editor_asset_snapshot(
         model: snapshot.model,
         provider: snapshot.provider,
         task_id: snapshot.task_id,
+        group_task_id: snapshot.group_task_id,
         asset_kind: snapshot.asset_kind,
         generation_inputs,
         source_resource_id: snapshot.source_resource_id,
diff --git a/server-rs/crates/spacetime-client/src/mapper/runtime_profile.rs b/server-rs/crates/spacetime-client/src/mapper/runtime_profile.rs
index ff9c46710..127994854 100644
--- a/server-rs/crates/spacetime-client/src/mapper/runtime_profile.rs
+++ b/server-rs/crates/spacetime-client/src/mapper/runtime_profile.rs
@@ -169,6 +169,7 @@ impl From<module_runtime::RuntimeProfileRechargeRefundManualReviewResolveInput>
             out_refund_no: input.out_refund_no,
             admin_user_id: input.admin_user_id,
             reason: input.reason,
+            expected_error_code: input.expected_error_code,
         }
     }
 }
@@ -1432,6 +1433,7 @@ pub(crate) fn map_runtime_profile_recharge_refund_snapshot(
         manual_review_resolved_by_admin_user_id: snapshot.manual_review_resolved_by_admin_user_id,
         manual_review_resolution_reason: snapshot.manual_review_resolution_reason,
         manual_review_resolved_at_micros: snapshot.manual_review_resolved_at_micros,
+        manual_review_resolved_error_code: snapshot.manual_review_resolved_error_code,
     }
 }
 
diff --git a/server-rs/crates/spacetime-client/src/module_bindings.rs b/server-rs/crates/spacetime-client/src/module_bindings.rs
index 874ddd235..ad0f6cc8e 100644
--- a/server-rs/crates/spacetime-client/src/module_bindings.rs
+++ b/server-rs/crates/spacetime-client/src/module_bindings.rs
@@ -10,6 +10,23 @@ pub mod accept_quest_reducer;
 pub mod acknowledge_external_generation_job_summaries_and_return_procedure;
 pub mod acknowledge_external_generation_jobs_and_return_procedure;
 pub mod acknowledge_quest_completion_reducer;
+pub mod admin_account_create_input_type;
+pub mod admin_account_credential_procedure_result_type;
+pub mod admin_account_credential_snapshot_type;
+pub mod admin_account_get_by_id_input_type;
+pub mod admin_account_get_by_username_input_type;
+pub mod admin_account_procedure_result_type;
+pub mod admin_account_snapshot_type;
+pub mod admin_account_table;
+pub mod admin_account_type;
+pub mod admin_account_update_input_type;
+pub mod admin_dashboard_breakdown_snapshot_type;
+pub mod admin_dashboard_daily_count_snapshot_type;
+pub mod admin_dashboard_payment_conversion_snapshot_type;
+pub mod admin_dashboard_retention_snapshot_type;
+pub mod admin_dashboard_stats_input_type;
+pub mod admin_dashboard_stats_procedure_result_type;
+pub mod admin_dashboard_stats_snapshot_type;
 pub mod admin_disable_profile_redeem_code_procedure;
 pub mod admin_disable_profile_task_config_procedure;
 pub mod admin_editor_asset_list_input_type;
@@ -245,6 +262,7 @@ pub mod compile_visual_novel_work_profile_procedure;
 pub mod compile_wooden_fish_draft_procedure;
 pub mod complete_ai_stage_and_return_procedure;
 pub mod complete_ai_task_and_return_procedure;
+pub mod complete_editor_asset_group_cohort_and_return_procedure;
 pub mod complete_external_generation_job_and_return_procedure;
 pub mod complete_profile_recharge_order_expiration_schedule_and_return_procedure;
 pub mod confirm_asset_object_and_return_procedure;
@@ -253,6 +271,7 @@ pub mod consume_inventory_item_input_type;
 pub mod consume_profile_wallet_points_and_return_procedure;
 pub mod continue_story_and_return_procedure;
 pub mod continue_story_reducer;
+pub mod create_admin_account_and_return_procedure;
 pub mod create_ai_task_and_return_procedure;
 pub mod create_ai_task_reducer;
 pub mod create_bark_battle_draft_procedure;
@@ -398,6 +417,12 @@ pub mod editor_asset_folder_snapshot_type;
 pub mod editor_asset_folder_table;
 pub mod editor_asset_folder_type;
 pub mod editor_asset_folder_update_input_type;
+pub mod editor_asset_group_cohort_complete_input_type;
+pub mod editor_asset_group_cohort_table;
+pub mod editor_asset_group_cohort_type;
+pub mod editor_asset_group_source_lookup_input_type;
+pub mod editor_asset_group_source_provenance_table;
+pub mod editor_asset_group_source_provenance_type;
 pub mod editor_asset_library_get_input_type;
 pub mod editor_asset_library_procedure_result_type;
 pub mod editor_asset_library_snapshot_type;
@@ -517,11 +542,15 @@ pub mod finalize_match_3_d_agent_message_turn_procedure;
 pub mod finalize_puzzle_agent_message_turn_procedure;
 pub mod finalize_square_hole_agent_message_turn_procedure;
 pub mod finalize_visual_novel_agent_message_turn_procedure;
+pub mod find_editor_asset_group_source_and_return_procedure;
 pub mod finish_bark_battle_run_procedure;
 pub mod finish_match_3_d_time_up_procedure;
 pub mod finish_square_hole_time_up_procedure;
 pub mod finish_wooden_fish_run_procedure;
 pub mod generate_big_fish_asset_procedure;
+pub mod get_admin_account_by_id_and_return_procedure;
+pub mod get_admin_account_by_username_and_return_procedure;
+pub mod get_admin_dashboard_stats_and_return_procedure;
 pub mod get_asset_object_by_id_and_return_procedure;
 pub mod get_asset_object_by_location_and_return_procedure;
 pub mod get_asset_read_access_by_location_and_return_procedure;
@@ -654,6 +683,7 @@ pub mod jump_hop_work_snapshot_type;
 pub mod jump_hop_work_update_input_type;
 pub mod jump_hop_works_list_input_type;
 pub mod jump_hop_works_procedure_result_type;
+pub mod list_admin_accounts_and_return_procedure;
 pub mod list_asset_history_and_return_procedure;
 pub mod list_big_fish_works_procedure;
 pub mod list_custom_world_gallery_entries_procedure;
@@ -1290,6 +1320,7 @@ pub mod turn_in_quest_reducer;
 pub mod unequip_inventory_item_input_type;
 pub mod unpublish_custom_world_profile_and_return_procedure;
 pub mod unpublish_custom_world_profile_reducer;
+pub mod update_admin_account_and_return_procedure;
 pub mod update_bark_battle_draft_config_procedure;
 pub mod update_editor_asset_and_return_procedure;
 pub mod update_editor_asset_folder_and_return_procedure;
@@ -1411,6 +1442,23 @@ pub use accept_quest_reducer::accept_quest;
 pub use acknowledge_external_generation_job_summaries_and_return_procedure::acknowledge_external_generation_job_summaries_and_return;
 pub use acknowledge_external_generation_jobs_and_return_procedure::acknowledge_external_generation_jobs_and_return;
 pub use acknowledge_quest_completion_reducer::acknowledge_quest_completion;
+pub use admin_account_create_input_type::AdminAccountCreateInput;
+pub use admin_account_credential_procedure_result_type::AdminAccountCredentialProcedureResult;
+pub use admin_account_credential_snapshot_type::AdminAccountCredentialSnapshot;
+pub use admin_account_get_by_id_input_type::AdminAccountGetByIdInput;
+pub use admin_account_get_by_username_input_type::AdminAccountGetByUsernameInput;
+pub use admin_account_procedure_result_type::AdminAccountProcedureResult;
+pub use admin_account_snapshot_type::AdminAccountSnapshot;
+pub use admin_account_table::*;
+pub use admin_account_type::AdminAccount;
+pub use admin_account_update_input_type::AdminAccountUpdateInput;
+pub use admin_dashboard_breakdown_snapshot_type::AdminDashboardBreakdownSnapshot;
+pub use admin_dashboard_daily_count_snapshot_type::AdminDashboardDailyCountSnapshot;
+pub use admin_dashboard_payment_conversion_snapshot_type::AdminDashboardPaymentConversionSnapshot;
+pub use admin_dashboard_retention_snapshot_type::AdminDashboardRetentionSnapshot;
+pub use admin_dashboard_stats_input_type::AdminDashboardStatsInput;
+pub use admin_dashboard_stats_procedure_result_type::AdminDashboardStatsProcedureResult;
+pub use admin_dashboard_stats_snapshot_type::AdminDashboardStatsSnapshot;
 pub use admin_disable_profile_redeem_code_procedure::admin_disable_profile_redeem_code;
 pub use admin_disable_profile_task_config_procedure::admin_disable_profile_task_config;
 pub use admin_editor_asset_list_input_type::AdminEditorAssetListInput;
@@ -1646,6 +1694,7 @@ pub use compile_visual_novel_work_profile_procedure::compile_visual_novel_work_p
 pub use compile_wooden_fish_draft_procedure::compile_wooden_fish_draft;
 pub use complete_ai_stage_and_return_procedure::complete_ai_stage_and_return;
 pub use complete_ai_task_and_return_procedure::complete_ai_task_and_return;
+pub use complete_editor_asset_group_cohort_and_return_procedure::complete_editor_asset_group_cohort_and_return;
 pub use complete_external_generation_job_and_return_procedure::complete_external_generation_job_and_return;
 pub use complete_profile_recharge_order_expiration_schedule_and_return_procedure::complete_profile_recharge_order_expiration_schedule_and_return;
 pub use confirm_asset_object_and_return_procedure::confirm_asset_object_and_return;
@@ -1654,6 +1703,7 @@ pub use consume_inventory_item_input_type::ConsumeInventoryItemInput;
 pub use consume_profile_wallet_points_and_return_procedure::consume_profile_wallet_points_and_return;
 pub use continue_story_and_return_procedure::continue_story_and_return;
 pub use continue_story_reducer::continue_story;
+pub use create_admin_account_and_return_procedure::create_admin_account_and_return;
 pub use create_ai_task_and_return_procedure::create_ai_task_and_return;
 pub use create_ai_task_reducer::create_ai_task;
 pub use create_bark_battle_draft_procedure::create_bark_battle_draft;
@@ -1799,6 +1849,12 @@ pub use editor_asset_folder_snapshot_type::EditorAssetFolderSnapshot;
 pub use editor_asset_folder_table::*;
 pub use editor_asset_folder_type::EditorAssetFolder;
 pub use editor_asset_folder_update_input_type::EditorAssetFolderUpdateInput;
+pub use editor_asset_group_cohort_complete_input_type::EditorAssetGroupCohortCompleteInput;
+pub use editor_asset_group_cohort_table::*;
+pub use editor_asset_group_cohort_type::EditorAssetGroupCohort;
+pub use editor_asset_group_source_lookup_input_type::EditorAssetGroupSourceLookupInput;
+pub use editor_asset_group_source_provenance_table::*;
+pub use editor_asset_group_source_provenance_type::EditorAssetGroupSourceProvenance;
 pub use editor_asset_library_get_input_type::EditorAssetLibraryGetInput;
 pub use editor_asset_library_procedure_result_type::EditorAssetLibraryProcedureResult;
 pub use editor_asset_library_snapshot_type::EditorAssetLibrarySnapshot;
@@ -1918,11 +1974,15 @@ pub use finalize_match_3_d_agent_message_turn_procedure::finalize_match_3_d_agen
 pub use finalize_puzzle_agent_message_turn_procedure::finalize_puzzle_agent_message_turn;
 pub use finalize_square_hole_agent_message_turn_procedure::finalize_square_hole_agent_message_turn;
 pub use finalize_visual_novel_agent_message_turn_procedure::finalize_visual_novel_agent_message_turn;
+pub use find_editor_asset_group_source_and_return_procedure::find_editor_asset_group_source_and_return;
 pub use finish_bark_battle_run_procedure::finish_bark_battle_run;
 pub use finish_match_3_d_time_up_procedure::finish_match_3_d_time_up;
 pub use finish_square_hole_time_up_procedure::finish_square_hole_time_up;
 pub use finish_wooden_fish_run_procedure::finish_wooden_fish_run;
 pub use generate_big_fish_asset_procedure::generate_big_fish_asset;
+pub use get_admin_account_by_id_and_return_procedure::get_admin_account_by_id_and_return;
+pub use get_admin_account_by_username_and_return_procedure::get_admin_account_by_username_and_return;
+pub use get_admin_dashboard_stats_and_return_procedure::get_admin_dashboard_stats_and_return;
 pub use get_asset_object_by_id_and_return_procedure::get_asset_object_by_id_and_return;
 pub use get_asset_object_by_location_and_return_procedure::get_asset_object_by_location_and_return;
 pub use get_asset_read_access_by_location_and_return_procedure::get_asset_read_access_by_location_and_return;
@@ -2055,6 +2115,7 @@ pub use jump_hop_work_snapshot_type::JumpHopWorkSnapshot;
 pub use jump_hop_work_update_input_type::JumpHopWorkUpdateInput;
 pub use jump_hop_works_list_input_type::JumpHopWorksListInput;
 pub use jump_hop_works_procedure_result_type::JumpHopWorksProcedureResult;
+pub use list_admin_accounts_and_return_procedure::list_admin_accounts_and_return;
 pub use list_asset_history_and_return_procedure::list_asset_history_and_return;
 pub use list_big_fish_works_procedure::list_big_fish_works;
 pub use list_custom_world_gallery_entries_procedure::list_custom_world_gallery_entries;
@@ -2691,6 +2752,7 @@ pub use turn_in_quest_reducer::turn_in_quest;
 pub use unequip_inventory_item_input_type::UnequipInventoryItemInput;
 pub use unpublish_custom_world_profile_and_return_procedure::unpublish_custom_world_profile_and_return;
 pub use unpublish_custom_world_profile_reducer::unpublish_custom_world_profile;
+pub use update_admin_account_and_return_procedure::update_admin_account_and_return;
 pub use update_bark_battle_draft_config_procedure::update_bark_battle_draft_config;
 pub use update_editor_asset_and_return_procedure::update_editor_asset_and_return;
 pub use update_editor_asset_folder_and_return_procedure::update_editor_asset_folder_and_return;
@@ -3091,6 +3153,7 @@ impl __sdk::Reducer for Reducer {
 #[allow(non_snake_case)]
 #[doc(hidden)]
 pub struct DbUpdate {
+    admin_account: __sdk::TableUpdate<AdminAccount>,
     ai_result_reference: __sdk::TableUpdate<AiResultReference>,
     ai_task: __sdk::TableUpdate<AiTask>,
     ai_task_event: __sdk::TableUpdate<AiTaskEvent>,
@@ -3133,6 +3196,8 @@ pub struct DbUpdate {
     editor_agent_conversation: __sdk::TableUpdate<EditorAgentConversation>,
     editor_asset: __sdk::TableUpdate<EditorAsset>,
     editor_asset_folder: __sdk::TableUpdate<EditorAssetFolder>,
+    editor_asset_group_cohort: __sdk::TableUpdate<EditorAssetGroupCohort>,
+    editor_asset_group_source_provenance: __sdk::TableUpdate<EditorAssetGroupSourceProvenance>,
     editor_canvas: __sdk::TableUpdate<EditorCanvas>,
     editor_generation_pricing_config: __sdk::TableUpdate<EditorGenerationPricingConfig>,
     editor_generation_runtime_identity_rotation:
@@ -3250,6 +3315,9 @@ impl TryFrom<__ws::v2::TransactionUpdate> for DbUpdate {
         let mut db_update = DbUpdate::default();
         for table_update in __sdk::transaction_update_iter_table_updates(raw) {
             match &table_update.table_name[..] {
+                "admin_account" => db_update
+                    .admin_account
+                    .append(admin_account_table::parse_table_update(table_update)?),
                 "ai_result_reference" => db_update
                     .ai_result_reference
                     .append(ai_result_reference_table::parse_table_update(table_update)?),
@@ -3386,6 +3454,16 @@ impl TryFrom<__ws::v2::TransactionUpdate> for DbUpdate {
                 "editor_asset_folder" => db_update
                     .editor_asset_folder
                     .append(editor_asset_folder_table::parse_table_update(table_update)?),
+                "editor_asset_group_cohort" => db_update.editor_asset_group_cohort.append(
+                    editor_asset_group_cohort_table::parse_table_update(table_update)?,
+                ),
+                "editor_asset_group_source_provenance" => {
+                    db_update.editor_asset_group_source_provenance.append(
+                        editor_asset_group_source_provenance_table::parse_table_update(
+                            table_update,
+                        )?,
+                    )
+                }
                 "editor_canvas" => db_update
                     .editor_canvas
                     .append(editor_canvas_table::parse_table_update(table_update)?),
@@ -3764,6 +3842,9 @@ impl __sdk::DbUpdate for DbUpdate {
     ) -> AppliedDiff<'_> {
         let mut diff = AppliedDiff::default();
 
+        diff.admin_account = cache
+            .apply_diff_to_table::<AdminAccount>("admin_account", &self.admin_account)
+            .with_updates_by_pk(|row| &row.account_id);
         diff.ai_result_reference = cache
             .apply_diff_to_table::<AiResultReference>(
                 "ai_result_reference",
@@ -3968,6 +4049,18 @@ impl __sdk::DbUpdate for DbUpdate {
                 &self.editor_asset_folder,
             )
             .with_updates_by_pk(|row| &row.folder_id);
+        diff.editor_asset_group_cohort = cache
+            .apply_diff_to_table::<EditorAssetGroupCohort>(
+                "editor_asset_group_cohort",
+                &self.editor_asset_group_cohort,
+            )
+            .with_updates_by_pk(|row| &row.cohort_id);
+        diff.editor_asset_group_source_provenance = cache
+            .apply_diff_to_table::<EditorAssetGroupSourceProvenance>(
+                "editor_asset_group_source_provenance",
+                &self.editor_asset_group_source_provenance,
+            )
+            .with_updates_by_pk(|row| &row.lookup_key);
         diff.editor_canvas = cache
             .apply_diff_to_table::<EditorCanvas>("editor_canvas", &self.editor_canvas)
             .with_updates_by_pk(|row| &row.canvas_id);
@@ -4519,6 +4612,9 @@ impl __sdk::DbUpdate for DbUpdate {
         let mut db_update = DbUpdate::default();
         for table_rows in raw.tables {
             match &table_rows.table[..] {
+                "admin_account" => db_update
+                    .admin_account
+                    .append(__sdk::parse_row_list_as_inserts(table_rows.rows)?),
                 "ai_result_reference" => db_update
                     .ai_result_reference
                     .append(__sdk::parse_row_list_as_inserts(table_rows.rows)?),
@@ -4645,6 +4741,12 @@ impl __sdk::DbUpdate for DbUpdate {
                 "editor_asset_folder" => db_update
                     .editor_asset_folder
                     .append(__sdk::parse_row_list_as_inserts(table_rows.rows)?),
+                "editor_asset_group_cohort" => db_update
+                    .editor_asset_group_cohort
+                    .append(__sdk::parse_row_list_as_inserts(table_rows.rows)?),
+                "editor_asset_group_source_provenance" => db_update
+                    .editor_asset_group_source_provenance
+                    .append(__sdk::parse_row_list_as_inserts(table_rows.rows)?),
                 "editor_canvas" => db_update
                     .editor_canvas
                     .append(__sdk::parse_row_list_as_inserts(table_rows.rows)?),
@@ -4970,6 +5072,9 @@ impl __sdk::DbUpdate for DbUpdate {
         let mut db_update = DbUpdate::default();
         for table_rows in raw.tables {
             match &table_rows.table[..] {
+                "admin_account" => db_update
+                    .admin_account
+                    .append(__sdk::parse_row_list_as_deletes(table_rows.rows)?),
                 "ai_result_reference" => db_update
                     .ai_result_reference
                     .append(__sdk::parse_row_list_as_deletes(table_rows.rows)?),
@@ -5096,6 +5201,12 @@ impl __sdk::DbUpdate for DbUpdate {
                 "editor_asset_folder" => db_update
                     .editor_asset_folder
                     .append(__sdk::parse_row_list_as_deletes(table_rows.rows)?),
+                "editor_asset_group_cohort" => db_update
+                    .editor_asset_group_cohort
+                    .append(__sdk::parse_row_list_as_deletes(table_rows.rows)?),
+                "editor_asset_group_source_provenance" => db_update
+                    .editor_asset_group_source_provenance
+                    .append(__sdk::parse_row_list_as_deletes(table_rows.rows)?),
                 "editor_canvas" => db_update
                     .editor_canvas
                     .append(__sdk::parse_row_list_as_deletes(table_rows.rows)?),
@@ -5423,6 +5534,7 @@ impl __sdk::DbUpdate for DbUpdate {
 #[allow(non_snake_case)]
 #[doc(hidden)]
 pub struct AppliedDiff<'r> {
+    admin_account: __sdk::TableAppliedDiff<'r, AdminAccount>,
     ai_result_reference: __sdk::TableAppliedDiff<'r, AiResultReference>,
     ai_task: __sdk::TableAppliedDiff<'r, AiTask>,
     ai_task_event: __sdk::TableAppliedDiff<'r, AiTaskEvent>,
@@ -5467,6 +5579,9 @@ pub struct AppliedDiff<'r> {
     editor_agent_conversation: __sdk::TableAppliedDiff<'r, EditorAgentConversation>,
     editor_asset: __sdk::TableAppliedDiff<'r, EditorAsset>,
     editor_asset_folder: __sdk::TableAppliedDiff<'r, EditorAssetFolder>,
+    editor_asset_group_cohort: __sdk::TableAppliedDiff<'r, EditorAssetGroupCohort>,
+    editor_asset_group_source_provenance:
+        __sdk::TableAppliedDiff<'r, EditorAssetGroupSourceProvenance>,
     editor_canvas: __sdk::TableAppliedDiff<'r, EditorCanvas>,
     editor_generation_pricing_config: __sdk::TableAppliedDiff<'r, EditorGenerationPricingConfig>,
     editor_generation_runtime_identity_rotation:
@@ -5591,6 +5706,11 @@ impl<'r> __sdk::AppliedDiff<'r> for AppliedDiff<'r> {
         event: &EventContext,
         callbacks: &mut __sdk::DbCallbacks<RemoteModule>,
     ) {
+        callbacks.invoke_table_row_callbacks::<AdminAccount>(
+            "admin_account",
+            &self.admin_account,
+            event,
+        );
         callbacks.invoke_table_row_callbacks::<AiResultReference>(
             "ai_result_reference",
             &self.ai_result_reference,
@@ -5793,6 +5913,16 @@ impl<'r> __sdk::AppliedDiff<'r> for AppliedDiff<'r> {
             &self.editor_asset_folder,
             event,
         );
+        callbacks.invoke_table_row_callbacks::<EditorAssetGroupCohort>(
+            "editor_asset_group_cohort",
+            &self.editor_asset_group_cohort,
+            event,
+        );
+        callbacks.invoke_table_row_callbacks::<EditorAssetGroupSourceProvenance>(
+            "editor_asset_group_source_provenance",
+            &self.editor_asset_group_source_provenance,
+            event,
+        );
         callbacks.invoke_table_row_callbacks::<EditorCanvas>(
             "editor_canvas",
             &self.editor_canvas,
@@ -6961,6 +7091,7 @@ impl __sdk::SpacetimeModule for RemoteModule {
     type QueryBuilder = __sdk::QueryBuilder;
 
     fn register_tables(client_cache: &mut __sdk::ClientCache<Self>) {
+        admin_account_table::register_table(client_cache);
         ai_result_reference_table::register_table(client_cache);
         ai_task_table::register_table(client_cache);
         ai_task_event_table::register_table(client_cache);
@@ -7003,6 +7134,8 @@ impl __sdk::SpacetimeModule for RemoteModule {
         editor_agent_conversation_table::register_table(client_cache);
         editor_asset_table::register_table(client_cache);
         editor_asset_folder_table::register_table(client_cache);
+        editor_asset_group_cohort_table::register_table(client_cache);
+        editor_asset_group_source_provenance_table::register_table(client_cache);
         editor_canvas_table::register_table(client_cache);
         editor_generation_pricing_config_table::register_table(client_cache);
         editor_generation_runtime_identity_rotation_table::register_table(client_cache);
@@ -7109,6 +7242,7 @@ impl __sdk::SpacetimeModule for RemoteModule {
         wooden_fish_work_profile_table::register_table(client_cache);
     }
     const ALL_TABLE_NAMES: &'static [&'static str] = &[
+        "admin_account",
         "ai_result_reference",
         "ai_task",
         "ai_task_event",
@@ -7151,6 +7285,8 @@ impl __sdk::SpacetimeModule for RemoteModule {
         "editor_agent_conversation",
         "editor_asset",
         "editor_asset_folder",
+        "editor_asset_group_cohort",
+        "editor_asset_group_source_provenance",
         "editor_canvas",
         "editor_generation_pricing_config",
         "editor_generation_runtime_identity_rotation",
diff --git a/server-rs/crates/spacetime-client/src/module_bindings/admin_account_create_input_type.rs b/server-rs/crates/spacetime-client/src/module_bindings/admin_account_create_input_type.rs
new file mode 100644
index 000000000..d37fef54a
--- /dev/null
+++ b/server-rs/crates/spacetime-client/src/module_bindings/admin_account_create_input_type.rs
@@ -0,0 +1,21 @@
+// THIS FILE IS AUTOMATICALLY GENERATED BY SPACETIMEDB. EDITS TO THIS FILE
+// WILL NOT BE SAVED. MODIFY TABLES IN YOUR MODULE SOURCE CODE INSTEAD.
+
+#![allow(unused, clippy::all)]
+use spacetimedb_sdk::__codegen::{self as __sdk, __lib, __sats, __ws};
+
+#[derive(__lib::ser::Serialize, __lib::de::Deserialize, Clone, PartialEq, Debug)]
+#[sats(crate = __lib)]
+pub struct AdminAccountCreateInput {
+    pub account_id: String,
+    pub username: String,
+    pub display_name: String,
+    pub password_hash: String,
+    pub tab_permissions_json: String,
+    pub enabled: bool,
+    pub created_by: String,
+}
+
+impl __sdk::InModule for AdminAccountCreateInput {
+    type Module = super::RemoteModule;
+}
diff --git a/server-rs/crates/spacetime-client/src/module_bindings/admin_account_credential_procedure_result_type.rs b/server-rs/crates/spacetime-client/src/module_bindings/admin_account_credential_procedure_result_type.rs
new file mode 100644
index 000000000..afa2b2de2
--- /dev/null
+++ b/server-rs/crates/spacetime-client/src/module_bindings/admin_account_credential_procedure_result_type.rs
@@ -0,0 +1,19 @@
+// THIS FILE IS AUTOMATICALLY GENERATED BY SPACETIMEDB. EDITS TO THIS FILE
+// WILL NOT BE SAVED. MODIFY TABLES IN YOUR MODULE SOURCE CODE INSTEAD.
+
+#![allow(unused, clippy::all)]
+use spacetimedb_sdk::__codegen::{self as __sdk, __lib, __sats, __ws};
+
+use super::admin_account_credential_snapshot_type::AdminAccountCredentialSnapshot;
+
+#[derive(__lib::ser::Serialize, __lib::de::Deserialize, Clone, PartialEq, Debug)]
+#[sats(crate = __lib)]
+pub struct AdminAccountCredentialProcedureResult {
+    pub ok: bool,
+    pub account: Option<AdminAccountCredentialSnapshot>,
+    pub error_message: Option<String>,
+}
+
+impl __sdk::InModule for AdminAccountCredentialProcedureResult {
+    type Module = super::RemoteModule;
+}
diff --git a/server-rs/crates/spacetime-client/src/module_bindings/admin_account_credential_snapshot_type.rs b/server-rs/crates/spacetime-client/src/module_bindings/admin_account_credential_snapshot_type.rs
new file mode 100644
index 000000000..731b23d86
--- /dev/null
+++ b/server-rs/crates/spacetime-client/src/module_bindings/admin_account_credential_snapshot_type.rs
@@ -0,0 +1,18 @@
+// THIS FILE IS AUTOMATICALLY GENERATED BY SPACETIMEDB. EDITS TO THIS FILE
+// WILL NOT BE SAVED. MODIFY TABLES IN YOUR MODULE SOURCE CODE INSTEAD.
+
+#![allow(unused, clippy::all)]
+use spacetimedb_sdk::__codegen::{self as __sdk, __lib, __sats, __ws};
+
+use super::admin_account_snapshot_type::AdminAccountSnapshot;
+
+#[derive(__lib::ser::Serialize, __lib::de::Deserialize, Clone, PartialEq, Debug)]
+#[sats(crate = __lib)]
+pub struct AdminAccountCredentialSnapshot {
+    pub account: AdminAccountSnapshot,
+    pub password_hash: String,
+}
+
+impl __sdk::InModule for AdminAccountCredentialSnapshot {
+    type Module = super::RemoteModule;
+}
diff --git a/server-rs/crates/spacetime-client/src/module_bindings/admin_account_get_by_id_input_type.rs b/server-rs/crates/spacetime-client/src/module_bindings/admin_account_get_by_id_input_type.rs
new file mode 100644
index 000000000..4c4d5989a
--- /dev/null
+++ b/server-rs/crates/spacetime-client/src/module_bindings/admin_account_get_by_id_input_type.rs
@@ -0,0 +1,15 @@
+// THIS FILE IS AUTOMATICALLY GENERATED BY SPACETIMEDB. EDITS TO THIS FILE
+// WILL NOT BE SAVED. MODIFY TABLES IN YOUR MODULE SOURCE CODE INSTEAD.
+
+#![allow(unused, clippy::all)]
+use spacetimedb_sdk::__codegen::{self as __sdk, __lib, __sats, __ws};
+
+#[derive(__lib::ser::Serialize, __lib::de::Deserialize, Clone, PartialEq, Debug)]
+#[sats(crate = __lib)]
+pub struct AdminAccountGetByIdInput {
+    pub account_id: String,
+}
+
+impl __sdk::InModule for AdminAccountGetByIdInput {
+    type Module = super::RemoteModule;
+}
diff --git a/server-rs/crates/spacetime-client/src/module_bindings/admin_account_get_by_username_input_type.rs b/server-rs/crates/spacetime-client/src/module_bindings/admin_account_get_by_username_input_type.rs
new file mode 100644
index 000000000..15465aa2c
--- /dev/null
+++ b/server-rs/crates/spacetime-client/src/module_bindings/admin_account_get_by_username_input_type.rs
@@ -0,0 +1,15 @@
+// THIS FILE IS AUTOMATICALLY GENERATED BY SPACETIMEDB. EDITS TO THIS FILE
+// WILL NOT BE SAVED. MODIFY TABLES IN YOUR MODULE SOURCE CODE INSTEAD.
+
+#![allow(unused, clippy::all)]
+use spacetimedb_sdk::__codegen::{self as __sdk, __lib, __sats, __ws};
+
+#[derive(__lib::ser::Serialize, __lib::de::Deserialize, Clone, PartialEq, Debug)]
+#[sats(crate = __lib)]
+pub struct AdminAccountGetByUsernameInput {
+    pub username: String,
+}
+
+impl __sdk::InModule for AdminAccountGetByUsernameInput {
+    type Module = super::RemoteModule;
+}
diff --git a/server-rs/crates/spacetime-client/src/module_bindings/admin_account_procedure_result_type.rs b/server-rs/crates/spacetime-client/src/module_bindings/admin_account_procedure_result_type.rs
new file mode 100644
index 000000000..71e94756d
--- /dev/null
+++ b/server-rs/crates/spacetime-client/src/module_bindings/admin_account_procedure_result_type.rs
@@ -0,0 +1,20 @@
+// THIS FILE IS AUTOMATICALLY GENERATED BY SPACETIMEDB. EDITS TO THIS FILE
+// WILL NOT BE SAVED. MODIFY TABLES IN YOUR MODULE SOURCE CODE INSTEAD.
+
+#![allow(unused, clippy::all)]
+use spacetimedb_sdk::__codegen::{self as __sdk, __lib, __sats, __ws};
+
+use super::admin_account_snapshot_type::AdminAccountSnapshot;
+
+#[derive(__lib::ser::Serialize, __lib::de::Deserialize, Clone, PartialEq, Debug)]
+#[sats(crate = __lib)]
+pub struct AdminAccountProcedureResult {
+    pub ok: bool,
+    pub account: Option<AdminAccountSnapshot>,
+    pub accounts: Vec<AdminAccountSnapshot>,
+    pub error_message: Option<String>,
+}
+
+impl __sdk::InModule for AdminAccountProcedureResult {
+    type Module = super::RemoteModule;
+}
diff --git a/server-rs/crates/spacetime-client/src/module_bindings/admin_account_snapshot_type.rs b/server-rs/crates/spacetime-client/src/module_bindings/admin_account_snapshot_type.rs
new file mode 100644
index 000000000..901e28029
--- /dev/null
+++ b/server-rs/crates/spacetime-client/src/module_bindings/admin_account_snapshot_type.rs
@@ -0,0 +1,24 @@
+// THIS FILE IS AUTOMATICALLY GENERATED BY SPACETIMEDB. EDITS TO THIS FILE
+// WILL NOT BE SAVED. MODIFY TABLES IN YOUR MODULE SOURCE CODE INSTEAD.
+
+#![allow(unused, clippy::all)]
+use spacetimedb_sdk::__codegen::{self as __sdk, __lib, __sats, __ws};
+
+#[derive(__lib::ser::Serialize, __lib::de::Deserialize, Clone, PartialEq, Debug)]
+#[sats(crate = __lib)]
+pub struct AdminAccountSnapshot {
+    pub account_id: String,
+    pub username: String,
+    pub display_name: String,
+    pub tab_permissions_json: String,
+    pub enabled: bool,
+    pub token_version: u64,
+    pub created_by: String,
+    pub updated_by: String,
+    pub created_at_micros: i64,
+    pub updated_at_micros: i64,
+}
+
+impl __sdk::InModule for AdminAccountSnapshot {
+    type Module = super::RemoteModule;
+}
diff --git a/server-rs/crates/spacetime-client/src/module_bindings/admin_account_table.rs b/server-rs/crates/spacetime-client/src/module_bindings/admin_account_table.rs
new file mode 100644
index 000000000..6b0ebcdff
--- /dev/null
+++ b/server-rs/crates/spacetime-client/src/module_bindings/admin_account_table.rs
@@ -0,0 +1,190 @@
+// THIS FILE IS AUTOMATICALLY GENERATED BY SPACETIMEDB. EDITS TO THIS FILE
+// WILL NOT BE SAVED. MODIFY TABLES IN YOUR MODULE SOURCE CODE INSTEAD.
+
+#![allow(unused, clippy::all)]
+use super::admin_account_type::AdminAccount;
+use spacetimedb_sdk::__codegen::{self as __sdk, __lib, __sats, __ws};
+
+/// Table handle for the table `admin_account`.
+///
+/// Obtain a handle from the [`AdminAccountTableAccess::admin_account`] method on [`super::RemoteTables`],
+/// like `ctx.db.admin_account()`.
+///
+/// Users are encouraged not to explicitly reference this type,
+/// but to directly chain method calls,
+/// like `ctx.db.admin_account().on_insert(...)`.
+pub struct AdminAccountTableHandle<'ctx> {
+    imp: __sdk::TableHandle<AdminAccount>,
+    ctx: std::marker::PhantomData<&'ctx super::RemoteTables>,
+}
+
+#[allow(non_camel_case_types)]
+/// Extension trait for access to the table `admin_account`.
+///
+/// Implemented for [`super::RemoteTables`].
+pub trait AdminAccountTableAccess {
+    #[allow(non_snake_case)]
+    /// Obtain a [`AdminAccountTableHandle`], which mediates access to the table `admin_account`.
+    fn admin_account(&self) -> AdminAccountTableHandle<'_>;
+}
+
+impl AdminAccountTableAccess for super::RemoteTables {
+    fn admin_account(&self) -> AdminAccountTableHandle<'_> {
+        AdminAccountTableHandle {
+            imp: self.imp.get_table::<AdminAccount>("admin_account"),
+            ctx: std::marker::PhantomData,
+        }
+    }
+}
+
+pub struct AdminAccountInsertCallbackId(__sdk::CallbackId);
+pub struct AdminAccountDeleteCallbackId(__sdk::CallbackId);
+
+impl<'ctx> __sdk::Table for AdminAccountTableHandle<'ctx> {
+    type Row = AdminAccount;
+    type EventContext = super::EventContext;
+
+    fn count(&self) -> u64 {
+        self.imp.count()
+    }
+    fn iter(&self) -> impl Iterator<Item = AdminAccount> + '_ {
+        self.imp.iter()
+    }
+
+    type InsertCallbackId = AdminAccountInsertCallbackId;
+
+    fn on_insert(
+        &self,
+        callback: impl FnMut(&Self::EventContext, &Self::Row) + Send + 'static,
+    ) -> AdminAccountInsertCallbackId {
+        AdminAccountInsertCallbackId(self.imp.on_insert(Box::new(callback)))
+    }
+
+    fn remove_on_insert(&self, callback: AdminAccountInsertCallbackId) {
+        self.imp.remove_on_insert(callback.0)
+    }
+
+    type DeleteCallbackId = AdminAccountDeleteCallbackId;
+
+    fn on_delete(
+        &self,
+        callback: impl FnMut(&Self::EventContext, &Self::Row) + Send + 'static,
+    ) -> AdminAccountDeleteCallbackId {
+        AdminAccountDeleteCallbackId(self.imp.on_delete(Box::new(callback)))
+    }
+
+    fn remove_on_delete(&self, callback: AdminAccountDeleteCallbackId) {
+        self.imp.remove_on_delete(callback.0)
+    }
+}
+
+pub struct AdminAccountUpdateCallbackId(__sdk::CallbackId);
+
+impl<'ctx> __sdk::TableWithPrimaryKey for AdminAccountTableHandle<'ctx> {
+    type UpdateCallbackId = AdminAccountUpdateCallbackId;
+
+    fn on_update(
+        &self,
+        callback: impl FnMut(&Self::EventContext, &Self::Row, &Self::Row) + Send + 'static,
+    ) -> AdminAccountUpdateCallbackId {
+        AdminAccountUpdateCallbackId(self.imp.on_update(Box::new(callback)))
+    }
+
+    fn remove_on_update(&self, callback: AdminAccountUpdateCallbackId) {
+        self.imp.remove_on_update(callback.0)
+    }
+}
+
+/// Access to the `account_id` unique index on the table `admin_account`,
+/// which allows point queries on the field of the same name
+/// via the [`AdminAccountAccountIdUnique::find`] method.
+///
+/// Users are encouraged not to explicitly reference this type,
+/// but to directly chain method calls,
+/// like `ctx.db.admin_account().account_id().find(...)`.
+pub struct AdminAccountAccountIdUnique<'ctx> {
+    imp: __sdk::UniqueConstraintHandle<AdminAccount, String>,
+    phantom: std::marker::PhantomData<&'ctx super::RemoteTables>,
+}
+
+impl<'ctx> AdminAccountTableHandle<'ctx> {
+    /// Get a handle on the `account_id` unique index on the table `admin_account`.
+    pub fn account_id(&self) -> AdminAccountAccountIdUnique<'ctx> {
+        AdminAccountAccountIdUnique {
+            imp: self.imp.get_unique_constraint::<String>("account_id"),
+            phantom: std::marker::PhantomData,
+        }
+    }
+}
+
+impl<'ctx> AdminAccountAccountIdUnique<'ctx> {
+    /// Find the subscribed row whose `account_id` column value is equal to `col_val`,
+    /// if such a row is present in the client cache.
+    pub fn find(&self, col_val: &String) -> Option<AdminAccount> {
+        self.imp.find(col_val)
+    }
+}
+
+/// Access to the `username` unique index on the table `admin_account`,
+/// which allows point queries on the field of the same name
+/// via the [`AdminAccountUsernameUnique::find`] method.
+///
+/// Users are encouraged not to explicitly reference this type,
+/// but to directly chain method calls,
+/// like `ctx.db.admin_account().username().find(...)`.
+pub struct AdminAccountUsernameUnique<'ctx> {
+    imp: __sdk::UniqueConstraintHandle<AdminAccount, String>,
+    phantom: std::marker::PhantomData<&'ctx super::RemoteTables>,
+}
+
+impl<'ctx> AdminAccountTableHandle<'ctx> {
+    /// Get a handle on the `username` unique index on the table `admin_account`.
+    pub fn username(&self) -> AdminAccountUsernameUnique<'ctx> {
+        AdminAccountUsernameUnique {
+            imp: self.imp.get_unique_constraint::<String>("username"),
+            phantom: std::marker::PhantomData,
+        }
+    }
+}
+
+impl<'ctx> AdminAccountUsernameUnique<'ctx> {
+    /// Find the subscribed row whose `username` column value is equal to `col_val`,
+    /// if such a row is present in the client cache.
+    pub fn find(&self, col_val: &String) -> Option<AdminAccount> {
+        self.imp.find(col_val)
+    }
+}
+
+#[doc(hidden)]
+pub(super) fn register_table(client_cache: &mut __sdk::ClientCache<super::RemoteModule>) {
+    let _table = client_cache.get_or_make_table::<AdminAccount>("admin_account");
+    _table.add_unique_constraint::<String>("account_id", |row| &row.account_id);
+    _table.add_unique_constraint::<String>("username", |row| &row.username);
+}
+
+#[doc(hidden)]
+pub(super) fn parse_table_update(
+    raw_updates: __ws::v2::TableUpdate,
+) -> __sdk::Result<__sdk::TableUpdate<AdminAccount>> {
+    __sdk::TableUpdate::parse_table_update(raw_updates).map_err(|e| {
+        __sdk::InternalError::failed_parse("TableUpdate<AdminAccount>", "TableUpdate")
+            .with_cause(e)
+            .into()
+    })
+}
+
+#[allow(non_camel_case_types)]
+/// Extension trait for query builder access to the table `AdminAccount`.
+///
+/// Implemented for [`__sdk::QueryTableAccessor`].
+pub trait admin_accountQueryTableAccess {
+    #[allow(non_snake_case)]
+    /// Get a query builder for the table `AdminAccount`.
+    fn admin_account(&self) -> __sdk::__query_builder::Table<AdminAccount>;
+}
+
+impl admin_accountQueryTableAccess for __sdk::QueryTableAccessor {
+    fn admin_account(&self) -> __sdk::__query_builder::Table<AdminAccount> {
+        __sdk::__query_builder::Table::new("admin_account")
+    }
+}
diff --git a/server-rs/crates/spacetime-client/src/module_bindings/admin_account_type.rs b/server-rs/crates/spacetime-client/src/module_bindings/admin_account_type.rs
new file mode 100644
index 000000000..d48fbac0f
--- /dev/null
+++ b/server-rs/crates/spacetime-client/src/module_bindings/admin_account_type.rs
@@ -0,0 +1,84 @@
+// THIS FILE IS AUTOMATICALLY GENERATED BY SPACETIMEDB. EDITS TO THIS FILE
+// WILL NOT BE SAVED. MODIFY TABLES IN YOUR MODULE SOURCE CODE INSTEAD.
+
+#![allow(unused, clippy::all)]
+use spacetimedb_sdk::__codegen::{self as __sdk, __lib, __sats, __ws};
+
+#[derive(__lib::ser::Serialize, __lib::de::Deserialize, Clone, PartialEq, Debug)]
+#[sats(crate = __lib)]
+pub struct AdminAccount {
+    pub account_id: String,
+    pub username: String,
+    pub display_name: String,
+    pub password_hash: String,
+    pub tab_permissions_json: String,
+    pub enabled: bool,
+    pub token_version: u64,
+    pub created_by: String,
+    pub updated_by: String,
+    pub created_at: __sdk::Timestamp,
+    pub updated_at: __sdk::Timestamp,
+}
+
+impl __sdk::InModule for AdminAccount {
+    type Module = super::RemoteModule;
+}
+
+/// Column accessor struct for the table `AdminAccount`.
+///
+/// Provides typed access to columns for query building.
+pub struct AdminAccountCols {
+    pub account_id: __sdk::__query_builder::Col<AdminAccount, String>,
+    pub username: __sdk::__query_builder::Col<AdminAccount, String>,
+    pub display_name: __sdk::__query_builder::Col<AdminAccount, String>,
+    pub password_hash: __sdk::__query_builder::Col<AdminAccount, String>,
+    pub tab_permissions_json: __sdk::__query_builder::Col<AdminAccount, String>,
+    pub enabled: __sdk::__query_builder::Col<AdminAccount, bool>,
+    pub token_version: __sdk::__query_builder::Col<AdminAccount, u64>,
+    pub created_by: __sdk::__query_builder::Col<AdminAccount, String>,
+    pub updated_by: __sdk::__query_builder::Col<AdminAccount, String>,
+    pub created_at: __sdk::__query_builder::Col<AdminAccount, __sdk::Timestamp>,
+    pub updated_at: __sdk::__query_builder::Col<AdminAccount, __sdk::Timestamp>,
+}
+
+impl __sdk::__query_builder::HasCols for AdminAccount {
+    type Cols = AdminAccountCols;
+    fn cols(table_name: &'static str) -> Self::Cols {
+        AdminAccountCols {
+            account_id: __sdk::__query_builder::Col::new(table_name, "account_id"),
+            username: __sdk::__query_builder::Col::new(table_name, "username"),
+            display_name: __sdk::__query_builder::Col::new(table_name, "display_name"),
+            password_hash: __sdk::__query_builder::Col::new(table_name, "password_hash"),
+            tab_permissions_json: __sdk::__query_builder::Col::new(
+                table_name,
+                "tab_permissions_json",
+            ),
+            enabled: __sdk::__query_builder::Col::new(table_name, "enabled"),
+            token_version: __sdk::__query_builder::Col::new(table_name, "token_version"),
+            created_by: __sdk::__query_builder::Col::new(table_name, "created_by"),
+            updated_by: __sdk::__query_builder::Col::new(table_name, "updated_by"),
+            created_at: __sdk::__query_builder::Col::new(table_name, "created_at"),
+            updated_at: __sdk::__query_builder::Col::new(table_name, "updated_at"),
+        }
+    }
+}
+
+/// Indexed column accessor struct for the table `AdminAccount`.
+///
+/// Provides typed access to indexed columns for query building.
+pub struct AdminAccountIxCols {
+    pub account_id: __sdk::__query_builder::IxCol<AdminAccount, String>,
+    pub username: __sdk::__query_builder::IxCol<AdminAccount, String>,
+}
+
+impl __sdk::__query_builder::HasIxCols for AdminAccount {
+    type IxCols = AdminAccountIxCols;
+    fn ix_cols(table_name: &'static str) -> Self::IxCols {
+        AdminAccountIxCols {
+            account_id: __sdk::__query_builder::IxCol::new(table_name, "account_id"),
+            username: __sdk::__query_builder::IxCol::new(table_name, "username"),
+        }
+    }
+}
+
+impl __sdk::__query_builder::CanBeLookupTable for AdminAccount {}
diff --git a/server-rs/crates/spacetime-client/src/module_bindings/admin_account_update_input_type.rs b/server-rs/crates/spacetime-client/src/module_bindings/admin_account_update_input_type.rs
new file mode 100644
index 000000000..48f1196d3
--- /dev/null
+++ b/server-rs/crates/spacetime-client/src/module_bindings/admin_account_update_input_type.rs
@@ -0,0 +1,20 @@
+// THIS FILE IS AUTOMATICALLY GENERATED BY SPACETIMEDB. EDITS TO THIS FILE
+// WILL NOT BE SAVED. MODIFY TABLES IN YOUR MODULE SOURCE CODE INSTEAD.
+
+#![allow(unused, clippy::all)]
+use spacetimedb_sdk::__codegen::{self as __sdk, __lib, __sats, __ws};
+
+#[derive(__lib::ser::Serialize, __lib::de::Deserialize, Clone, PartialEq, Debug)]
+#[sats(crate = __lib)]
+pub struct AdminAccountUpdateInput {
+    pub account_id: String,
+    pub display_name: String,
+    pub password_hash: Option<String>,
+    pub tab_permissions_json: String,
+    pub enabled: bool,
+    pub updated_by: String,
+}
+
+impl __sdk::InModule for AdminAccountUpdateInput {
+    type Module = super::RemoteModule;
+}
diff --git a/server-rs/crates/spacetime-client/src/module_bindings/admin_dashboard_breakdown_snapshot_type.rs b/server-rs/crates/spacetime-client/src/module_bindings/admin_dashboard_breakdown_snapshot_type.rs
new file mode 100644
index 000000000..14262ccf6
--- /dev/null
+++ b/server-rs/crates/spacetime-client/src/module_bindings/admin_dashboard_breakdown_snapshot_type.rs
@@ -0,0 +1,16 @@
+// THIS FILE IS AUTOMATICALLY GENERATED BY SPACETIMEDB. EDITS TO THIS FILE
+// WILL NOT BE SAVED. MODIFY TABLES IN YOUR MODULE SOURCE CODE INSTEAD.
+
+#![allow(unused, clippy::all)]
+use spacetimedb_sdk::__codegen::{self as __sdk, __lib, __sats, __ws};
+
+#[derive(__lib::ser::Serialize, __lib::de::Deserialize, Clone, PartialEq, Debug)]
+#[sats(crate = __lib)]
+pub struct AdminDashboardBreakdownSnapshot {
+    pub key: String,
+    pub count: u64,
+}
+
+impl __sdk::InModule for AdminDashboardBreakdownSnapshot {
+    type Module = super::RemoteModule;
+}
diff --git a/server-rs/crates/spacetime-client/src/module_bindings/admin_dashboard_daily_count_snapshot_type.rs b/server-rs/crates/spacetime-client/src/module_bindings/admin_dashboard_daily_count_snapshot_type.rs
new file mode 100644
index 000000000..383ebe911
--- /dev/null
+++ b/server-rs/crates/spacetime-client/src/module_bindings/admin_dashboard_daily_count_snapshot_type.rs
@@ -0,0 +1,16 @@
+// THIS FILE IS AUTOMATICALLY GENERATED BY SPACETIMEDB. EDITS TO THIS FILE
+// WILL NOT BE SAVED. MODIFY TABLES IN YOUR MODULE SOURCE CODE INSTEAD.
+
+#![allow(unused, clippy::all)]
+use spacetimedb_sdk::__codegen::{self as __sdk, __lib, __sats, __ws};
+
+#[derive(__lib::ser::Serialize, __lib::de::Deserialize, Clone, PartialEq, Debug)]
+#[sats(crate = __lib)]
+pub struct AdminDashboardDailyCountSnapshot {
+    pub day_key: i64,
+    pub count: u64,
+}
+
+impl __sdk::InModule for AdminDashboardDailyCountSnapshot {
+    type Module = super::RemoteModule;
+}
diff --git a/server-rs/crates/spacetime-client/src/module_bindings/admin_dashboard_payment_conversion_snapshot_type.rs b/server-rs/crates/spacetime-client/src/module_bindings/admin_dashboard_payment_conversion_snapshot_type.rs
new file mode 100644
index 000000000..40a4f35aa
--- /dev/null
+++ b/server-rs/crates/spacetime-client/src/module_bindings/admin_dashboard_payment_conversion_snapshot_type.rs
@@ -0,0 +1,17 @@
+// THIS FILE IS AUTOMATICALLY GENERATED BY SPACETIMEDB. EDITS TO THIS FILE
+// WILL NOT BE SAVED. MODIFY TABLES IN YOUR MODULE SOURCE CODE INSTEAD.
+
+#![allow(unused, clippy::all)]
+use spacetimedb_sdk::__codegen::{self as __sdk, __lib, __sats, __ws};
+
+#[derive(__lib::ser::Serialize, __lib::de::Deserialize, Clone, PartialEq, Debug)]
+#[sats(crate = __lib)]
+pub struct AdminDashboardPaymentConversionSnapshot {
+    pub paid_users: u64,
+    pub new_registered_users: u64,
+    pub rate_basis_points: u32,
+}
+
+impl __sdk::InModule for AdminDashboardPaymentConversionSnapshot {
+    type Module = super::RemoteModule;
+}
diff --git a/server-rs/crates/spacetime-client/src/module_bindings/admin_dashboard_retention_snapshot_type.rs b/server-rs/crates/spacetime-client/src/module_bindings/admin_dashboard_retention_snapshot_type.rs
new file mode 100644
index 000000000..f99b2d7ca
--- /dev/null
+++ b/server-rs/crates/spacetime-client/src/module_bindings/admin_dashboard_retention_snapshot_type.rs
@@ -0,0 +1,17 @@
+// THIS FILE IS AUTOMATICALLY GENERATED BY SPACETIMEDB. EDITS TO THIS FILE
+// WILL NOT BE SAVED. MODIFY TABLES IN YOUR MODULE SOURCE CODE INSTEAD.
+
+#![allow(unused, clippy::all)]
+use spacetimedb_sdk::__codegen::{self as __sdk, __lib, __sats, __ws};
+
+#[derive(__lib::ser::Serialize, __lib::de::Deserialize, Clone, PartialEq, Debug)]
+#[sats(crate = __lib)]
+pub struct AdminDashboardRetentionSnapshot {
+    pub eligible_users: u64,
+    pub retained_users: u64,
+    pub rate_basis_points: u32,
+}
+
+impl __sdk::InModule for AdminDashboardRetentionSnapshot {
+    type Module = super::RemoteModule;
+}
diff --git a/server-rs/crates/spacetime-client/src/module_bindings/admin_dashboard_stats_input_type.rs b/server-rs/crates/spacetime-client/src/module_bindings/admin_dashboard_stats_input_type.rs
new file mode 100644
index 000000000..52d80f576
--- /dev/null
+++ b/server-rs/crates/spacetime-client/src/module_bindings/admin_dashboard_stats_input_type.rs
@@ -0,0 +1,17 @@
+// THIS FILE IS AUTOMATICALLY GENERATED BY SPACETIMEDB. EDITS TO THIS FILE
+// WILL NOT BE SAVED. MODIFY TABLES IN YOUR MODULE SOURCE CODE INSTEAD.
+
+#![allow(unused, clippy::all)]
+use spacetimedb_sdk::__codegen::{self as __sdk, __lib, __sats, __ws};
+
+#[derive(__lib::ser::Serialize, __lib::de::Deserialize, Clone, PartialEq, Debug)]
+#[sats(crate = __lib)]
+pub struct AdminDashboardStatsInput {
+    pub start_day_key: i64,
+    pub end_day_key: i64,
+    pub now_micros: i64,
+}
+
+impl __sdk::InModule for AdminDashboardStatsInput {
+    type Module = super::RemoteModule;
+}
diff --git a/server-rs/crates/spacetime-client/src/module_bindings/admin_dashboard_stats_procedure_result_type.rs b/server-rs/crates/spacetime-client/src/module_bindings/admin_dashboard_stats_procedure_result_type.rs
new file mode 100644
index 000000000..b6dd77a61
--- /dev/null
+++ b/server-rs/crates/spacetime-client/src/module_bindings/admin_dashboard_stats_procedure_result_type.rs
@@ -0,0 +1,19 @@
+// THIS FILE IS AUTOMATICALLY GENERATED BY SPACETIMEDB. EDITS TO THIS FILE
+// WILL NOT BE SAVED. MODIFY TABLES IN YOUR MODULE SOURCE CODE INSTEAD.
+
+#![allow(unused, clippy::all)]
+use spacetimedb_sdk::__codegen::{self as __sdk, __lib, __sats, __ws};
+
+use super::admin_dashboard_stats_snapshot_type::AdminDashboardStatsSnapshot;
+
+#[derive(__lib::ser::Serialize, __lib::de::Deserialize, Clone, PartialEq, Debug)]
+#[sats(crate = __lib)]
+pub struct AdminDashboardStatsProcedureResult {
+    pub ok: bool,
+    pub snapshot: Option<AdminDashboardStatsSnapshot>,
+    pub error_message: Option<String>,
+}
+
+impl __sdk::InModule for AdminDashboardStatsProcedureResult {
+    type Module = super::RemoteModule;
+}
diff --git a/server-rs/crates/spacetime-client/src/module_bindings/admin_dashboard_stats_snapshot_type.rs b/server-rs/crates/spacetime-client/src/module_bindings/admin_dashboard_stats_snapshot_type.rs
new file mode 100644
index 000000000..5fe8d3a2b
--- /dev/null
+++ b/server-rs/crates/spacetime-client/src/module_bindings/admin_dashboard_stats_snapshot_type.rs
@@ -0,0 +1,31 @@
+// THIS FILE IS AUTOMATICALLY GENERATED BY SPACETIMEDB. EDITS TO THIS FILE
+// WILL NOT BE SAVED. MODIFY TABLES IN YOUR MODULE SOURCE CODE INSTEAD.
+
+#![allow(unused, clippy::all)]
+use spacetimedb_sdk::__codegen::{self as __sdk, __lib, __sats, __ws};
+
+use super::admin_dashboard_breakdown_snapshot_type::AdminDashboardBreakdownSnapshot;
+use super::admin_dashboard_daily_count_snapshot_type::AdminDashboardDailyCountSnapshot;
+use super::admin_dashboard_payment_conversion_snapshot_type::AdminDashboardPaymentConversionSnapshot;
+use super::admin_dashboard_retention_snapshot_type::AdminDashboardRetentionSnapshot;
+
+#[derive(__lib::ser::Serialize, __lib::de::Deserialize, Clone, PartialEq, Debug)]
+#[sats(crate = __lib)]
+pub struct AdminDashboardStatsSnapshot {
+    pub total_registered_users: u64,
+    pub new_registered_users: Vec<AdminDashboardDailyCountSnapshot>,
+    pub visit_count: Vec<AdminDashboardDailyCountSnapshot>,
+    pub visit_users_by_day: Vec<AdminDashboardDailyCountSnapshot>,
+    pub visit_users: u64,
+    pub total_visit_count: u64,
+    pub total_visit_users: u64,
+    pub current_users: u64,
+    pub day_1_retention: AdminDashboardRetentionSnapshot,
+    pub day_7_retention: AdminDashboardRetentionSnapshot,
+    pub module_visit_breakdown: Vec<AdminDashboardBreakdownSnapshot>,
+    pub new_user_payment_conversion: AdminDashboardPaymentConversionSnapshot,
+}
+
+impl __sdk::InModule for AdminDashboardStatsSnapshot {
+    type Module = super::RemoteModule;
+}
diff --git a/server-rs/crates/spacetime-client/src/module_bindings/admin_editor_asset_snapshot_type.rs b/server-rs/crates/spacetime-client/src/module_bindings/admin_editor_asset_snapshot_type.rs
index b62f47a4a..1631748e8 100644
--- a/server-rs/crates/spacetime-client/src/module_bindings/admin_editor_asset_snapshot_type.rs
+++ b/server-rs/crates/spacetime-client/src/module_bindings/admin_editor_asset_snapshot_type.rs
@@ -29,6 +29,7 @@ pub struct AdminEditorAssetSnapshot {
     pub generation_cost_mud_points: u64,
     pub created_at_micros: i64,
     pub updated_at_micros: i64,
+    pub group_task_id: Option<String>,
 }
 
 impl __sdk::InModule for AdminEditorAssetSnapshot {
diff --git a/server-rs/crates/spacetime-client/src/module_bindings/complete_editor_asset_group_cohort_and_return_procedure.rs b/server-rs/crates/spacetime-client/src/module_bindings/complete_editor_asset_group_cohort_and_return_procedure.rs
new file mode 100644
index 000000000..189f54bd5
--- /dev/null
+++ b/server-rs/crates/spacetime-client/src/module_bindings/complete_editor_asset_group_cohort_and_return_procedure.rs
@@ -0,0 +1,62 @@
+// THIS FILE IS AUTOMATICALLY GENERATED BY SPACETIMEDB. EDITS TO THIS FILE
+// WILL NOT BE SAVED. MODIFY TABLES IN YOUR MODULE SOURCE CODE INSTEAD.
+
+#![allow(unused, clippy::all)]
+use spacetimedb_sdk::__codegen::{self as __sdk, __lib, __sats, __ws};
+
+use super::editor_asset_group_cohort_complete_input_type::EditorAssetGroupCohortCompleteInput;
+use super::editor_asset_procedure_result_type::EditorAssetProcedureResult;
+
+#[derive(__lib::ser::Serialize, __lib::de::Deserialize, Clone, PartialEq, Debug)]
+#[sats(crate = __lib)]
+struct CompleteEditorAssetGroupCohortAndReturnArgs {
+    pub input: EditorAssetGroupCohortCompleteInput,
+}
+
+impl __sdk::InModule for CompleteEditorAssetGroupCohortAndReturnArgs {
+    type Module = super::RemoteModule;
+}
+
+#[allow(non_camel_case_types)]
+/// Extension trait for access to the procedure `complete_editor_asset_group_cohort_and_return`.
+///
+/// Implemented for [`super::RemoteProcedures`].
+pub trait complete_editor_asset_group_cohort_and_return {
+    fn complete_editor_asset_group_cohort_and_return(
+        &self,
+        input: EditorAssetGroupCohortCompleteInput,
+    ) {
+        self.complete_editor_asset_group_cohort_and_return_then(input, |_, _| {});
+    }
+
+    fn complete_editor_asset_group_cohort_and_return_then(
+        &self,
+        input: EditorAssetGroupCohortCompleteInput,
+
+        __callback: impl FnOnce(
+                &super::ProcedureEventContext,
+                Result<EditorAssetProcedureResult, __sdk::InternalError>,
+            ) + Send
+            + 'static,
+    );
+}
+
+impl complete_editor_asset_group_cohort_and_return for super::RemoteProcedures {
+    fn complete_editor_asset_group_cohort_and_return_then(
+        &self,
+        input: EditorAssetGroupCohortCompleteInput,
+
+        __callback: impl FnOnce(
+                &super::ProcedureEventContext,
+                Result<EditorAssetProcedureResult, __sdk::InternalError>,
+            ) + Send
+            + 'static,
+    ) {
+        self.imp
+            .invoke_procedure_with_callback::<_, EditorAssetProcedureResult>(
+                "complete_editor_asset_group_cohort_and_return",
+                CompleteEditorAssetGroupCohortAndReturnArgs { input },
+                __callback,
+            );
+    }
+}
diff --git a/server-rs/crates/spacetime-client/src/module_bindings/create_admin_account_and_return_procedure.rs b/server-rs/crates/spacetime-client/src/module_bindings/create_admin_account_and_return_procedure.rs
new file mode 100644
index 000000000..0271d730c
--- /dev/null
+++ b/server-rs/crates/spacetime-client/src/module_bindings/create_admin_account_and_return_procedure.rs
@@ -0,0 +1,59 @@
+// THIS FILE IS AUTOMATICALLY GENERATED BY SPACETIMEDB. EDITS TO THIS FILE
+// WILL NOT BE SAVED. MODIFY TABLES IN YOUR MODULE SOURCE CODE INSTEAD.
+
+#![allow(unused, clippy::all)]
+use spacetimedb_sdk::__codegen::{self as __sdk, __lib, __sats, __ws};
+
+use super::admin_account_create_input_type::AdminAccountCreateInput;
+use super::admin_account_procedure_result_type::AdminAccountProcedureResult;
+
+#[derive(__lib::ser::Serialize, __lib::de::Deserialize, Clone, PartialEq, Debug)]
+#[sats(crate = __lib)]
+struct CreateAdminAccountAndReturnArgs {
+    pub input: AdminAccountCreateInput,
+}
+
+impl __sdk::InModule for CreateAdminAccountAndReturnArgs {
+    type Module = super::RemoteModule;
+}
+
+#[allow(non_camel_case_types)]
+/// Extension trait for access to the procedure `create_admin_account_and_return`.
+///
+/// Implemented for [`super::RemoteProcedures`].
+pub trait create_admin_account_and_return {
+    fn create_admin_account_and_return(&self, input: AdminAccountCreateInput) {
+        self.create_admin_account_and_return_then(input, |_, _| {});
+    }
+
+    fn create_admin_account_and_return_then(
+        &self,
+        input: AdminAccountCreateInput,
+
+        __callback: impl FnOnce(
+                &super::ProcedureEventContext,
+                Result<AdminAccountProcedureResult, __sdk::InternalError>,
+            ) + Send
+            + 'static,
+    );
+}
+
+impl create_admin_account_and_return for super::RemoteProcedures {
+    fn create_admin_account_and_return_then(
+        &self,
+        input: AdminAccountCreateInput,
+
+        __callback: impl FnOnce(
+                &super::ProcedureEventContext,
+                Result<AdminAccountProcedureResult, __sdk::InternalError>,
+            ) + Send
+            + 'static,
+    ) {
+        self.imp
+            .invoke_procedure_with_callback::<_, AdminAccountProcedureResult>(
+                "create_admin_account_and_return",
+                CreateAdminAccountAndReturnArgs { input },
+                __callback,
+            );
+    }
+}
diff --git a/server-rs/crates/spacetime-client/src/module_bindings/editor_asset_create_input_type.rs b/server-rs/crates/spacetime-client/src/module_bindings/editor_asset_create_input_type.rs
index a1f296c1f..1984b7e75 100644
--- a/server-rs/crates/spacetime-client/src/module_bindings/editor_asset_create_input_type.rs
+++ b/server-rs/crates/spacetime-client/src/module_bindings/editor_asset_create_input_type.rs
@@ -28,6 +28,8 @@ pub struct EditorAssetCreateInput {
     pub now_micros: i64,
     pub thumbnail_src: Option<String>,
     pub generation_cost_mud_points: u64,
+    pub group_task_id: Option<String>,
+    pub group_task_expected_asset_count: Option<u32>,
 }
 
 impl __sdk::InModule for EditorAssetCreateInput {
diff --git a/server-rs/crates/spacetime-client/src/module_bindings/editor_asset_group_cohort_complete_input_type.rs b/server-rs/crates/spacetime-client/src/module_bindings/editor_asset_group_cohort_complete_input_type.rs
new file mode 100644
index 000000000..07e242191
--- /dev/null
+++ b/server-rs/crates/spacetime-client/src/module_bindings/editor_asset_group_cohort_complete_input_type.rs
@@ -0,0 +1,20 @@
+// THIS FILE IS AUTOMATICALLY GENERATED BY SPACETIMEDB. EDITS TO THIS FILE
+// WILL NOT BE SAVED. MODIFY TABLES IN YOUR MODULE SOURCE CODE INSTEAD.
+
+#![allow(unused, clippy::all)]
+use spacetimedb_sdk::__codegen::{self as __sdk, __lib, __sats, __ws};
+
+#[derive(__lib::ser::Serialize, __lib::de::Deserialize, Clone, PartialEq, Debug)]
+#[sats(crate = __lib)]
+pub struct EditorAssetGroupCohortCompleteInput {
+    pub owner_user_id: String,
+    pub task_id: String,
+    pub group_task_id: String,
+    pub expected_asset_count: u32,
+    pub asset_ids: Vec<String>,
+    pub completed_at_micros: i64,
+}
+
+impl __sdk::InModule for EditorAssetGroupCohortCompleteInput {
+    type Module = super::RemoteModule;
+}
diff --git a/server-rs/crates/spacetime-client/src/module_bindings/editor_asset_group_cohort_table.rs b/server-rs/crates/spacetime-client/src/module_bindings/editor_asset_group_cohort_table.rs
new file mode 100644
index 000000000..787eb2d5d
--- /dev/null
+++ b/server-rs/crates/spacetime-client/src/module_bindings/editor_asset_group_cohort_table.rs
@@ -0,0 +1,162 @@
+// THIS FILE IS AUTOMATICALLY GENERATED BY SPACETIMEDB. EDITS TO THIS FILE
+// WILL NOT BE SAVED. MODIFY TABLES IN YOUR MODULE SOURCE CODE INSTEAD.
+
+#![allow(unused, clippy::all)]
+use super::editor_asset_group_cohort_type::EditorAssetGroupCohort;
+use spacetimedb_sdk::__codegen::{self as __sdk, __lib, __sats, __ws};
+
+/// Table handle for the table `editor_asset_group_cohort`.
+///
+/// Obtain a handle from the [`EditorAssetGroupCohortTableAccess::editor_asset_group_cohort`] method on [`super::RemoteTables`],
+/// like `ctx.db.editor_asset_group_cohort()`.
+///
+/// Users are encouraged not to explicitly reference this type,
+/// but to directly chain method calls,
+/// like `ctx.db.editor_asset_group_cohort().on_insert(...)`.
+pub struct EditorAssetGroupCohortTableHandle<'ctx> {
+    imp: __sdk::TableHandle<EditorAssetGroupCohort>,
+    ctx: std::marker::PhantomData<&'ctx super::RemoteTables>,
+}
+
+#[allow(non_camel_case_types)]
+/// Extension trait for access to the table `editor_asset_group_cohort`.
+///
+/// Implemented for [`super::RemoteTables`].
+pub trait EditorAssetGroupCohortTableAccess {
+    #[allow(non_snake_case)]
+    /// Obtain a [`EditorAssetGroupCohortTableHandle`], which mediates access to the table `editor_asset_group_cohort`.
+    fn editor_asset_group_cohort(&self) -> EditorAssetGroupCohortTableHandle<'_>;
+}
+
+impl EditorAssetGroupCohortTableAccess for super::RemoteTables {
+    fn editor_asset_group_cohort(&self) -> EditorAssetGroupCohortTableHandle<'_> {
+        EditorAssetGroupCohortTableHandle {
+            imp: self
+                .imp
+                .get_table::<EditorAssetGroupCohort>("editor_asset_group_cohort"),
+            ctx: std::marker::PhantomData,
+        }
+    }
+}
+
+pub struct EditorAssetGroupCohortInsertCallbackId(__sdk::CallbackId);
+pub struct EditorAssetGroupCohortDeleteCallbackId(__sdk::CallbackId);
+
+impl<'ctx> __sdk::Table for EditorAssetGroupCohortTableHandle<'ctx> {
+    type Row = EditorAssetGroupCohort;
+    type EventContext = super::EventContext;
+
+    fn count(&self) -> u64 {
+        self.imp.count()
+    }
+    fn iter(&self) -> impl Iterator<Item = EditorAssetGroupCohort> + '_ {
+        self.imp.iter()
+    }
+
+    type InsertCallbackId = EditorAssetGroupCohortInsertCallbackId;
+
+    fn on_insert(
+        &self,
+        callback: impl FnMut(&Self::EventContext, &Self::Row) + Send + 'static,
+    ) -> EditorAssetGroupCohortInsertCallbackId {
+        EditorAssetGroupCohortInsertCallbackId(self.imp.on_insert(Box::new(callback)))
+    }
+
+    fn remove_on_insert(&self, callback: EditorAssetGroupCohortInsertCallbackId) {
+        self.imp.remove_on_insert(callback.0)
+    }
+
+    type DeleteCallbackId = EditorAssetGroupCohortDeleteCallbackId;
+
+    fn on_delete(
+        &self,
+        callback: impl FnMut(&Self::EventContext, &Self::Row) + Send + 'static,
+    ) -> EditorAssetGroupCohortDeleteCallbackId {
+        EditorAssetGroupCohortDeleteCallbackId(self.imp.on_delete(Box::new(callback)))
+    }
+
+    fn remove_on_delete(&self, callback: EditorAssetGroupCohortDeleteCallbackId) {
+        self.imp.remove_on_delete(callback.0)
+    }
+}
+
+pub struct EditorAssetGroupCohortUpdateCallbackId(__sdk::CallbackId);
+
+impl<'ctx> __sdk::TableWithPrimaryKey for EditorAssetGroupCohortTableHandle<'ctx> {
+    type UpdateCallbackId = EditorAssetGroupCohortUpdateCallbackId;
+
+    fn on_update(
+        &self,
+        callback: impl FnMut(&Self::EventContext, &Self::Row, &Self::Row) + Send + 'static,
+    ) -> EditorAssetGroupCohortUpdateCallbackId {
+        EditorAssetGroupCohortUpdateCallbackId(self.imp.on_update(Box::new(callback)))
+    }
+
+    fn remove_on_update(&self, callback: EditorAssetGroupCohortUpdateCallbackId) {
+        self.imp.remove_on_update(callback.0)
+    }
+}
+
+/// Access to the `cohort_id` unique index on the table `editor_asset_group_cohort`,
+/// which allows point queries on the field of the same name
+/// via the [`EditorAssetGroupCohortCohortIdUnique::find`] method.
+///
+/// Users are encouraged not to explicitly reference this type,
+/// but to directly chain method calls,
+/// like `ctx.db.editor_asset_group_cohort().cohort_id().find(...)`.
+pub struct EditorAssetGroupCohortCohortIdUnique<'ctx> {
+    imp: __sdk::UniqueConstraintHandle<EditorAssetGroupCohort, String>,
+    phantom: std::marker::PhantomData<&'ctx super::RemoteTables>,
+}
+
+impl<'ctx> EditorAssetGroupCohortTableHandle<'ctx> {
+    /// Get a handle on the `cohort_id` unique index on the table `editor_asset_group_cohort`.
+    pub fn cohort_id(&self) -> EditorAssetGroupCohortCohortIdUnique<'ctx> {
+        EditorAssetGroupCohortCohortIdUnique {
+            imp: self.imp.get_unique_constraint::<String>("cohort_id"),
+            phantom: std::marker::PhantomData,
+        }
+    }
+}
+
+impl<'ctx> EditorAssetGroupCohortCohortIdUnique<'ctx> {
+    /// Find the subscribed row whose `cohort_id` column value is equal to `col_val`,
+    /// if such a row is present in the client cache.
+    pub fn find(&self, col_val: &String) -> Option<EditorAssetGroupCohort> {
+        self.imp.find(col_val)
+    }
+}
+
+#[doc(hidden)]
+pub(super) fn register_table(client_cache: &mut __sdk::ClientCache<super::RemoteModule>) {
+    let _table =
+        client_cache.get_or_make_table::<EditorAssetGroupCohort>("editor_asset_group_cohort");
+    _table.add_unique_constraint::<String>("cohort_id", |row| &row.cohort_id);
+}
+
+#[doc(hidden)]
+pub(super) fn parse_table_update(
+    raw_updates: __ws::v2::TableUpdate,
+) -> __sdk::Result<__sdk::TableUpdate<EditorAssetGroupCohort>> {
+    __sdk::TableUpdate::parse_table_update(raw_updates).map_err(|e| {
+        __sdk::InternalError::failed_parse("TableUpdate<EditorAssetGroupCohort>", "TableUpdate")
+            .with_cause(e)
+            .into()
+    })
+}
+
+#[allow(non_camel_case_types)]
+/// Extension trait for query builder access to the table `EditorAssetGroupCohort`.
+///
+/// Implemented for [`__sdk::QueryTableAccessor`].
+pub trait editor_asset_group_cohortQueryTableAccess {
+    #[allow(non_snake_case)]
+    /// Get a query builder for the table `EditorAssetGroupCohort`.
+    fn editor_asset_group_cohort(&self) -> __sdk::__query_builder::Table<EditorAssetGroupCohort>;
+}
+
+impl editor_asset_group_cohortQueryTableAccess for __sdk::QueryTableAccessor {
+    fn editor_asset_group_cohort(&self) -> __sdk::__query_builder::Table<EditorAssetGroupCohort> {
+        __sdk::__query_builder::Table::new("editor_asset_group_cohort")
+    }
+}
diff --git a/server-rs/crates/spacetime-client/src/module_bindings/editor_asset_group_cohort_type.rs b/server-rs/crates/spacetime-client/src/module_bindings/editor_asset_group_cohort_type.rs
new file mode 100644
index 000000000..4755bbe30
--- /dev/null
+++ b/server-rs/crates/spacetime-client/src/module_bindings/editor_asset_group_cohort_type.rs
@@ -0,0 +1,67 @@
+// THIS FILE IS AUTOMATICALLY GENERATED BY SPACETIMEDB. EDITS TO THIS FILE
+// WILL NOT BE SAVED. MODIFY TABLES IN YOUR MODULE SOURCE CODE INSTEAD.
+
+#![allow(unused, clippy::all)]
+use spacetimedb_sdk::__codegen::{self as __sdk, __lib, __sats, __ws};
+
+#[derive(__lib::ser::Serialize, __lib::de::Deserialize, Clone, PartialEq, Debug)]
+#[sats(crate = __lib)]
+pub struct EditorAssetGroupCohort {
+    pub cohort_id: String,
+    pub owner_user_id: String,
+    pub task_id: String,
+    pub group_task_id: String,
+    pub expected_asset_count: u32,
+    pub completed_at: __sdk::Timestamp,
+}
+
+impl __sdk::InModule for EditorAssetGroupCohort {
+    type Module = super::RemoteModule;
+}
+
+/// Column accessor struct for the table `EditorAssetGroupCohort`.
+///
+/// Provides typed access to columns for query building.
+pub struct EditorAssetGroupCohortCols {
+    pub cohort_id: __sdk::__query_builder::Col<EditorAssetGroupCohort, String>,
+    pub owner_user_id: __sdk::__query_builder::Col<EditorAssetGroupCohort, String>,
+    pub task_id: __sdk::__query_builder::Col<EditorAssetGroupCohort, String>,
+    pub group_task_id: __sdk::__query_builder::Col<EditorAssetGroupCohort, String>,
+    pub expected_asset_count: __sdk::__query_builder::Col<EditorAssetGroupCohort, u32>,
+    pub completed_at: __sdk::__query_builder::Col<EditorAssetGroupCohort, __sdk::Timestamp>,
+}
+
+impl __sdk::__query_builder::HasCols for EditorAssetGroupCohort {
+    type Cols = EditorAssetGroupCohortCols;
+    fn cols(table_name: &'static str) -> Self::Cols {
+        EditorAssetGroupCohortCols {
+            cohort_id: __sdk::__query_builder::Col::new(table_name, "cohort_id"),
+            owner_user_id: __sdk::__query_builder::Col::new(table_name, "owner_user_id"),
+            task_id: __sdk::__query_builder::Col::new(table_name, "task_id"),
+            group_task_id: __sdk::__query_builder::Col::new(table_name, "group_task_id"),
+            expected_asset_count: __sdk::__query_builder::Col::new(
+                table_name,
+                "expected_asset_count",
+            ),
+            completed_at: __sdk::__query_builder::Col::new(table_name, "completed_at"),
+        }
+    }
+}
+
+/// Indexed column accessor struct for the table `EditorAssetGroupCohort`.
+///
+/// Provides typed access to indexed columns for query building.
+pub struct EditorAssetGroupCohortIxCols {
+    pub cohort_id: __sdk::__query_builder::IxCol<EditorAssetGroupCohort, String>,
+}
+
+impl __sdk::__query_builder::HasIxCols for EditorAssetGroupCohort {
+    type IxCols = EditorAssetGroupCohortIxCols;
+    fn ix_cols(table_name: &'static str) -> Self::IxCols {
+        EditorAssetGroupCohortIxCols {
+            cohort_id: __sdk::__query_builder::IxCol::new(table_name, "cohort_id"),
+        }
+    }
+}
+
+impl __sdk::__query_builder::CanBeLookupTable for EditorAssetGroupCohort {}
diff --git a/server-rs/crates/spacetime-client/src/module_bindings/editor_asset_group_source_lookup_input_type.rs b/server-rs/crates/spacetime-client/src/module_bindings/editor_asset_group_source_lookup_input_type.rs
new file mode 100644
index 000000000..6e6ca5bcc
--- /dev/null
+++ b/server-rs/crates/spacetime-client/src/module_bindings/editor_asset_group_source_lookup_input_type.rs
@@ -0,0 +1,18 @@
+// THIS FILE IS AUTOMATICALLY GENERATED BY SPACETIMEDB. EDITS TO THIS FILE
+// WILL NOT BE SAVED. MODIFY TABLES IN YOUR MODULE SOURCE CODE INSTEAD.
+
+#![allow(unused, clippy::all)]
+use spacetimedb_sdk::__codegen::{self as __sdk, __lib, __sats, __ws};
+
+#[derive(__lib::ser::Serialize, __lib::de::Deserialize, Clone, PartialEq, Debug)]
+#[sats(crate = __lib)]
+pub struct EditorAssetGroupSourceLookupInput {
+    pub owner_user_id: String,
+    pub source_resource_ids: Vec<String>,
+    pub asset_object_id: Option<String>,
+    pub object_key: Option<String>,
+}
+
+impl __sdk::InModule for EditorAssetGroupSourceLookupInput {
+    type Module = super::RemoteModule;
+}
diff --git a/server-rs/crates/spacetime-client/src/module_bindings/editor_asset_group_source_provenance_table.rs b/server-rs/crates/spacetime-client/src/module_bindings/editor_asset_group_source_provenance_table.rs
new file mode 100644
index 000000000..cc67c43e8
--- /dev/null
+++ b/server-rs/crates/spacetime-client/src/module_bindings/editor_asset_group_source_provenance_table.rs
@@ -0,0 +1,174 @@
+// THIS FILE IS AUTOMATICALLY GENERATED BY SPACETIMEDB. EDITS TO THIS FILE
+// WILL NOT BE SAVED. MODIFY TABLES IN YOUR MODULE SOURCE CODE INSTEAD.
+
+#![allow(unused, clippy::all)]
+use super::editor_asset_group_source_provenance_type::EditorAssetGroupSourceProvenance;
+use spacetimedb_sdk::__codegen::{self as __sdk, __lib, __sats, __ws};
+
+/// Table handle for the table `editor_asset_group_source_provenance`.
+///
+/// Obtain a handle from the [`EditorAssetGroupSourceProvenanceTableAccess::editor_asset_group_source_provenance`] method on [`super::RemoteTables`],
+/// like `ctx.db.editor_asset_group_source_provenance()`.
+///
+/// Users are encouraged not to explicitly reference this type,
+/// but to directly chain method calls,
+/// like `ctx.db.editor_asset_group_source_provenance().on_insert(...)`.
+pub struct EditorAssetGroupSourceProvenanceTableHandle<'ctx> {
+    imp: __sdk::TableHandle<EditorAssetGroupSourceProvenance>,
+    ctx: std::marker::PhantomData<&'ctx super::RemoteTables>,
+}
+
+#[allow(non_camel_case_types)]
+/// Extension trait for access to the table `editor_asset_group_source_provenance`.
+///
+/// Implemented for [`super::RemoteTables`].
+pub trait EditorAssetGroupSourceProvenanceTableAccess {
+    #[allow(non_snake_case)]
+    /// Obtain a [`EditorAssetGroupSourceProvenanceTableHandle`], which mediates access to the table `editor_asset_group_source_provenance`.
+    fn editor_asset_group_source_provenance(
+        &self,
+    ) -> EditorAssetGroupSourceProvenanceTableHandle<'_>;
+}
+
+impl EditorAssetGroupSourceProvenanceTableAccess for super::RemoteTables {
+    fn editor_asset_group_source_provenance(
+        &self,
+    ) -> EditorAssetGroupSourceProvenanceTableHandle<'_> {
+        EditorAssetGroupSourceProvenanceTableHandle {
+            imp: self.imp.get_table::<EditorAssetGroupSourceProvenance>(
+                "editor_asset_group_source_provenance",
+            ),
+            ctx: std::marker::PhantomData,
+        }
+    }
+}
+
+pub struct EditorAssetGroupSourceProvenanceInsertCallbackId(__sdk::CallbackId);
+pub struct EditorAssetGroupSourceProvenanceDeleteCallbackId(__sdk::CallbackId);
+
+impl<'ctx> __sdk::Table for EditorAssetGroupSourceProvenanceTableHandle<'ctx> {
+    type Row = EditorAssetGroupSourceProvenance;
+    type EventContext = super::EventContext;
+
+    fn count(&self) -> u64 {
+        self.imp.count()
+    }
+    fn iter(&self) -> impl Iterator<Item = EditorAssetGroupSourceProvenance> + '_ {
+        self.imp.iter()
+    }
+
+    type InsertCallbackId = EditorAssetGroupSourceProvenanceInsertCallbackId;
+
+    fn on_insert(
+        &self,
+        callback: impl FnMut(&Self::EventContext, &Self::Row) + Send + 'static,
+    ) -> EditorAssetGroupSourceProvenanceInsertCallbackId {
+        EditorAssetGroupSourceProvenanceInsertCallbackId(self.imp.on_insert(Box::new(callback)))
+    }
+
+    fn remove_on_insert(&self, callback: EditorAssetGroupSourceProvenanceInsertCallbackId) {
+        self.imp.remove_on_insert(callback.0)
+    }
+
+    type DeleteCallbackId = EditorAssetGroupSourceProvenanceDeleteCallbackId;
+
+    fn on_delete(
+        &self,
+        callback: impl FnMut(&Self::EventContext, &Self::Row) + Send + 'static,
+    ) -> EditorAssetGroupSourceProvenanceDeleteCallbackId {
+        EditorAssetGroupSourceProvenanceDeleteCallbackId(self.imp.on_delete(Box::new(callback)))
+    }
+
+    fn remove_on_delete(&self, callback: EditorAssetGroupSourceProvenanceDeleteCallbackId) {
+        self.imp.remove_on_delete(callback.0)
+    }
+}
+
+pub struct EditorAssetGroupSourceProvenanceUpdateCallbackId(__sdk::CallbackId);
+
+impl<'ctx> __sdk::TableWithPrimaryKey for EditorAssetGroupSourceProvenanceTableHandle<'ctx> {
+    type UpdateCallbackId = EditorAssetGroupSourceProvenanceUpdateCallbackId;
+
+    fn on_update(
+        &self,
+        callback: impl FnMut(&Self::EventContext, &Self::Row, &Self::Row) + Send + 'static,
+    ) -> EditorAssetGroupSourceProvenanceUpdateCallbackId {
+        EditorAssetGroupSourceProvenanceUpdateCallbackId(self.imp.on_update(Box::new(callback)))
+    }
+
+    fn remove_on_update(&self, callback: EditorAssetGroupSourceProvenanceUpdateCallbackId) {
+        self.imp.remove_on_update(callback.0)
+    }
+}
+
+/// Access to the `lookup_key` unique index on the table `editor_asset_group_source_provenance`,
+/// which allows point queries on the field of the same name
+/// via the [`EditorAssetGroupSourceProvenanceLookupKeyUnique::find`] method.
+///
+/// Users are encouraged not to explicitly reference this type,
+/// but to directly chain method calls,
+/// like `ctx.db.editor_asset_group_source_provenance().lookup_key().find(...)`.
+pub struct EditorAssetGroupSourceProvenanceLookupKeyUnique<'ctx> {
+    imp: __sdk::UniqueConstraintHandle<EditorAssetGroupSourceProvenance, String>,
+    phantom: std::marker::PhantomData<&'ctx super::RemoteTables>,
+}
+
+impl<'ctx> EditorAssetGroupSourceProvenanceTableHandle<'ctx> {
+    /// Get a handle on the `lookup_key` unique index on the table `editor_asset_group_source_provenance`.
+    pub fn lookup_key(&self) -> EditorAssetGroupSourceProvenanceLookupKeyUnique<'ctx> {
+        EditorAssetGroupSourceProvenanceLookupKeyUnique {
+            imp: self.imp.get_unique_constraint::<String>("lookup_key"),
+            phantom: std::marker::PhantomData,
+        }
+    }
+}
+
+impl<'ctx> EditorAssetGroupSourceProvenanceLookupKeyUnique<'ctx> {
+    /// Find the subscribed row whose `lookup_key` column value is equal to `col_val`,
+    /// if such a row is present in the client cache.
+    pub fn find(&self, col_val: &String) -> Option<EditorAssetGroupSourceProvenance> {
+        self.imp.find(col_val)
+    }
+}
+
+#[doc(hidden)]
+pub(super) fn register_table(client_cache: &mut __sdk::ClientCache<super::RemoteModule>) {
+    let _table = client_cache.get_or_make_table::<EditorAssetGroupSourceProvenance>(
+        "editor_asset_group_source_provenance",
+    );
+    _table.add_unique_constraint::<String>("lookup_key", |row| &row.lookup_key);
+}
+
+#[doc(hidden)]
+pub(super) fn parse_table_update(
+    raw_updates: __ws::v2::TableUpdate,
+) -> __sdk::Result<__sdk::TableUpdate<EditorAssetGroupSourceProvenance>> {
+    __sdk::TableUpdate::parse_table_update(raw_updates).map_err(|e| {
+        __sdk::InternalError::failed_parse(
+            "TableUpdate<EditorAssetGroupSourceProvenance>",
+            "TableUpdate",
+        )
+        .with_cause(e)
+        .into()
+    })
+}
+
+#[allow(non_camel_case_types)]
+/// Extension trait for query builder access to the table `EditorAssetGroupSourceProvenance`.
+///
+/// Implemented for [`__sdk::QueryTableAccessor`].
+pub trait editor_asset_group_source_provenanceQueryTableAccess {
+    #[allow(non_snake_case)]
+    /// Get a query builder for the table `EditorAssetGroupSourceProvenance`.
+    fn editor_asset_group_source_provenance(
+        &self,
+    ) -> __sdk::__query_builder::Table<EditorAssetGroupSourceProvenance>;
+}
+
+impl editor_asset_group_source_provenanceQueryTableAccess for __sdk::QueryTableAccessor {
+    fn editor_asset_group_source_provenance(
+        &self,
+    ) -> __sdk::__query_builder::Table<EditorAssetGroupSourceProvenance> {
+        __sdk::__query_builder::Table::new("editor_asset_group_source_provenance")
+    }
+}
diff --git a/server-rs/crates/spacetime-client/src/module_bindings/editor_asset_group_source_provenance_type.rs b/server-rs/crates/spacetime-client/src/module_bindings/editor_asset_group_source_provenance_type.rs
new file mode 100644
index 000000000..e9cbcb044
--- /dev/null
+++ b/server-rs/crates/spacetime-client/src/module_bindings/editor_asset_group_source_provenance_type.rs
@@ -0,0 +1,64 @@
+// THIS FILE IS AUTOMATICALLY GENERATED BY SPACETIMEDB. EDITS TO THIS FILE
+// WILL NOT BE SAVED. MODIFY TABLES IN YOUR MODULE SOURCE CODE INSTEAD.
+
+#![allow(unused, clippy::all)]
+use spacetimedb_sdk::__codegen::{self as __sdk, __lib, __sats, __ws};
+
+#[derive(__lib::ser::Serialize, __lib::de::Deserialize, Clone, PartialEq, Debug)]
+#[sats(crate = __lib)]
+pub struct EditorAssetGroupSourceProvenance {
+    pub lookup_key: String,
+    pub owner_user_id: String,
+    pub asset_id: String,
+    pub task_id: String,
+    pub source_resource_id: String,
+    pub created_at: __sdk::Timestamp,
+}
+
+impl __sdk::InModule for EditorAssetGroupSourceProvenance {
+    type Module = super::RemoteModule;
+}
+
+/// Column accessor struct for the table `EditorAssetGroupSourceProvenance`.
+///
+/// Provides typed access to columns for query building.
+pub struct EditorAssetGroupSourceProvenanceCols {
+    pub lookup_key: __sdk::__query_builder::Col<EditorAssetGroupSourceProvenance, String>,
+    pub owner_user_id: __sdk::__query_builder::Col<EditorAssetGroupSourceProvenance, String>,
+    pub asset_id: __sdk::__query_builder::Col<EditorAssetGroupSourceProvenance, String>,
+    pub task_id: __sdk::__query_builder::Col<EditorAssetGroupSourceProvenance, String>,
+    pub source_resource_id: __sdk::__query_builder::Col<EditorAssetGroupSourceProvenance, String>,
+    pub created_at: __sdk::__query_builder::Col<EditorAssetGroupSourceProvenance, __sdk::Timestamp>,
+}
+
+impl __sdk::__query_builder::HasCols for EditorAssetGroupSourceProvenance {
+    type Cols = EditorAssetGroupSourceProvenanceCols;
+    fn cols(table_name: &'static str) -> Self::Cols {
+        EditorAssetGroupSourceProvenanceCols {
+            lookup_key: __sdk::__query_builder::Col::new(table_name, "lookup_key"),
+            owner_user_id: __sdk::__query_builder::Col::new(table_name, "owner_user_id"),
+            asset_id: __sdk::__query_builder::Col::new(table_name, "asset_id"),
+            task_id: __sdk::__query_builder::Col::new(table_name, "task_id"),
+            source_resource_id: __sdk::__query_builder::Col::new(table_name, "source_resource_id"),
+            created_at: __sdk::__query_builder::Col::new(table_name, "created_at"),
+        }
+    }
+}
+
+/// Indexed column accessor struct for the table `EditorAssetGroupSourceProvenance`.
+///
+/// Provides typed access to indexed columns for query building.
+pub struct EditorAssetGroupSourceProvenanceIxCols {
+    pub lookup_key: __sdk::__query_builder::IxCol<EditorAssetGroupSourceProvenance, String>,
+}
+
+impl __sdk::__query_builder::HasIxCols for EditorAssetGroupSourceProvenance {
+    type IxCols = EditorAssetGroupSourceProvenanceIxCols;
+    fn ix_cols(table_name: &'static str) -> Self::IxCols {
+        EditorAssetGroupSourceProvenanceIxCols {
+            lookup_key: __sdk::__query_builder::IxCol::new(table_name, "lookup_key"),
+        }
+    }
+}
+
+impl __sdk::__query_builder::CanBeLookupTable for EditorAssetGroupSourceProvenance {}
diff --git a/server-rs/crates/spacetime-client/src/module_bindings/editor_asset_snapshot_type.rs b/server-rs/crates/spacetime-client/src/module_bindings/editor_asset_snapshot_type.rs
index 4967bcb71..c39d1d015 100644
--- a/server-rs/crates/spacetime-client/src/module_bindings/editor_asset_snapshot_type.rs
+++ b/server-rs/crates/spacetime-client/src/module_bindings/editor_asset_snapshot_type.rs
@@ -33,6 +33,7 @@ pub struct EditorAssetSnapshot {
     pub showcase_review_status: Option<String>,
     pub showcase_display_enabled: Option<bool>,
     pub showcase_like_count: Option<u64>,
+    pub group_task_id: Option<String>,
 }
 
 impl __sdk::InModule for EditorAssetSnapshot {
diff --git a/server-rs/crates/spacetime-client/src/module_bindings/editor_asset_type.rs b/server-rs/crates/spacetime-client/src/module_bindings/editor_asset_type.rs
index 48cbbae26..34f4046be 100644
--- a/server-rs/crates/spacetime-client/src/module_bindings/editor_asset_type.rs
+++ b/server-rs/crates/spacetime-client/src/module_bindings/editor_asset_type.rs
@@ -29,6 +29,8 @@ pub struct EditorAsset {
     pub source_resource_id: Option<String>,
     pub thumbnail_src: Option<String>,
     pub generation_cost_mud_points: u64,
+    pub group_task_id: Option<String>,
+    pub group_task_expected_asset_count: Option<u32>,
 }
 
 impl __sdk::InModule for EditorAsset {
@@ -61,6 +63,8 @@ pub struct EditorAssetCols {
     pub source_resource_id: __sdk::__query_builder::Col<EditorAsset, Option<String>>,
     pub thumbnail_src: __sdk::__query_builder::Col<EditorAsset, Option<String>>,
     pub generation_cost_mud_points: __sdk::__query_builder::Col<EditorAsset, u64>,
+    pub group_task_id: __sdk::__query_builder::Col<EditorAsset, Option<String>>,
+    pub group_task_expected_asset_count: __sdk::__query_builder::Col<EditorAsset, Option<u32>>,
 }
 
 impl __sdk::__query_builder::HasCols for EditorAsset {
@@ -95,6 +99,11 @@ impl __sdk::__query_builder::HasCols for EditorAsset {
                 table_name,
                 "generation_cost_mud_points",
             ),
+            group_task_id: __sdk::__query_builder::Col::new(table_name, "group_task_id"),
+            group_task_expected_asset_count: __sdk::__query_builder::Col::new(
+                table_name,
+                "group_task_expected_asset_count",
+            ),
         }
     }
 }
diff --git a/server-rs/crates/spacetime-client/src/module_bindings/find_editor_asset_group_source_and_return_procedure.rs b/server-rs/crates/spacetime-client/src/module_bindings/find_editor_asset_group_source_and_return_procedure.rs
new file mode 100644
index 000000000..7b8d7dbd0
--- /dev/null
+++ b/server-rs/crates/spacetime-client/src/module_bindings/find_editor_asset_group_source_and_return_procedure.rs
@@ -0,0 +1,59 @@
+// THIS FILE IS AUTOMATICALLY GENERATED BY SPACETIMEDB. EDITS TO THIS FILE
+// WILL NOT BE SAVED. MODIFY TABLES IN YOUR MODULE SOURCE CODE INSTEAD.
+
+#![allow(unused, clippy::all)]
+use spacetimedb_sdk::__codegen::{self as __sdk, __lib, __sats, __ws};
+
+use super::editor_asset_group_source_lookup_input_type::EditorAssetGroupSourceLookupInput;
+use super::editor_asset_procedure_result_type::EditorAssetProcedureResult;
+
+#[derive(__lib::ser::Serialize, __lib::de::Deserialize, Clone, PartialEq, Debug)]
+#[sats(crate = __lib)]
+struct FindEditorAssetGroupSourceAndReturnArgs {
+    pub input: EditorAssetGroupSourceLookupInput,
+}
+
+impl __sdk::InModule for FindEditorAssetGroupSourceAndReturnArgs {
+    type Module = super::RemoteModule;
+}
+
+#[allow(non_camel_case_types)]
+/// Extension trait for access to the procedure `find_editor_asset_group_source_and_return`.
+///
+/// Implemented for [`super::RemoteProcedures`].
+pub trait find_editor_asset_group_source_and_return {
+    fn find_editor_asset_group_source_and_return(&self, input: EditorAssetGroupSourceLookupInput) {
+        self.find_editor_asset_group_source_and_return_then(input, |_, _| {});
+    }
+
+    fn find_editor_asset_group_source_and_return_then(
+        &self,
+        input: EditorAssetGroupSourceLookupInput,
+
+        __callback: impl FnOnce(
+                &super::ProcedureEventContext,
+                Result<EditorAssetProcedureResult, __sdk::InternalError>,
+            ) + Send
+            + 'static,
+    );
+}
+
+impl find_editor_asset_group_source_and_return for super::RemoteProcedures {
+    fn find_editor_asset_group_source_and_return_then(
+        &self,
+        input: EditorAssetGroupSourceLookupInput,
+
+        __callback: impl FnOnce(
+                &super::ProcedureEventContext,
+                Result<EditorAssetProcedureResult, __sdk::InternalError>,
+            ) + Send
+            + 'static,
+    ) {
+        self.imp
+            .invoke_procedure_with_callback::<_, EditorAssetProcedureResult>(
+                "find_editor_asset_group_source_and_return",
+                FindEditorAssetGroupSourceAndReturnArgs { input },
+                __callback,
+            );
+    }
+}
diff --git a/server-rs/crates/spacetime-client/src/module_bindings/get_admin_account_by_id_and_return_procedure.rs b/server-rs/crates/spacetime-client/src/module_bindings/get_admin_account_by_id_and_return_procedure.rs
new file mode 100644
index 000000000..7dccc1606
--- /dev/null
+++ b/server-rs/crates/spacetime-client/src/module_bindings/get_admin_account_by_id_and_return_procedure.rs
@@ -0,0 +1,59 @@
+// THIS FILE IS AUTOMATICALLY GENERATED BY SPACETIMEDB. EDITS TO THIS FILE
+// WILL NOT BE SAVED. MODIFY TABLES IN YOUR MODULE SOURCE CODE INSTEAD.
+
+#![allow(unused, clippy::all)]
+use spacetimedb_sdk::__codegen::{self as __sdk, __lib, __sats, __ws};
+
+use super::admin_account_get_by_id_input_type::AdminAccountGetByIdInput;
+use super::admin_account_procedure_result_type::AdminAccountProcedureResult;
+
+#[derive(__lib::ser::Serialize, __lib::de::Deserialize, Clone, PartialEq, Debug)]
+#[sats(crate = __lib)]
+struct GetAdminAccountByIdAndReturnArgs {
+    pub input: AdminAccountGetByIdInput,
+}
+
+impl __sdk::InModule for GetAdminAccountByIdAndReturnArgs {
+    type Module = super::RemoteModule;
+}
+
+#[allow(non_camel_case_types)]
+/// Extension trait for access to the procedure `get_admin_account_by_id_and_return`.
+///
+/// Implemented for [`super::RemoteProcedures`].
+pub trait get_admin_account_by_id_and_return {
+    fn get_admin_account_by_id_and_return(&self, input: AdminAccountGetByIdInput) {
+        self.get_admin_account_by_id_and_return_then(input, |_, _| {});
+    }
+
+    fn get_admin_account_by_id_and_return_then(
+        &self,
+        input: AdminAccountGetByIdInput,
+
+        __callback: impl FnOnce(
+                &super::ProcedureEventContext,
+                Result<AdminAccountProcedureResult, __sdk::InternalError>,
+            ) + Send
+            + 'static,
+    );
+}
+
+impl get_admin_account_by_id_and_return for super::RemoteProcedures {
+    fn get_admin_account_by_id_and_return_then(
+        &self,
+        input: AdminAccountGetByIdInput,
+
+        __callback: impl FnOnce(
+                &super::ProcedureEventContext,
+                Result<AdminAccountProcedureResult, __sdk::InternalError>,
+            ) + Send
+            + 'static,
+    ) {
+        self.imp
+            .invoke_procedure_with_callback::<_, AdminAccountProcedureResult>(
+                "get_admin_account_by_id_and_return",
+                GetAdminAccountByIdAndReturnArgs { input },
+                __callback,
+            );
+    }
+}
diff --git a/server-rs/crates/spacetime-client/src/module_bindings/get_admin_account_by_username_and_return_procedure.rs b/server-rs/crates/spacetime-client/src/module_bindings/get_admin_account_by_username_and_return_procedure.rs
new file mode 100644
index 000000000..a441962e4
--- /dev/null
+++ b/server-rs/crates/spacetime-client/src/module_bindings/get_admin_account_by_username_and_return_procedure.rs
@@ -0,0 +1,59 @@
+// THIS FILE IS AUTOMATICALLY GENERATED BY SPACETIMEDB. EDITS TO THIS FILE
+// WILL NOT BE SAVED. MODIFY TABLES IN YOUR MODULE SOURCE CODE INSTEAD.
+
+#![allow(unused, clippy::all)]
+use spacetimedb_sdk::__codegen::{self as __sdk, __lib, __sats, __ws};
+
+use super::admin_account_credential_procedure_result_type::AdminAccountCredentialProcedureResult;
+use super::admin_account_get_by_username_input_type::AdminAccountGetByUsernameInput;
+
+#[derive(__lib::ser::Serialize, __lib::de::Deserialize, Clone, PartialEq, Debug)]
+#[sats(crate = __lib)]
+struct GetAdminAccountByUsernameAndReturnArgs {
+    pub input: AdminAccountGetByUsernameInput,
+}
+
+impl __sdk::InModule for GetAdminAccountByUsernameAndReturnArgs {
+    type Module = super::RemoteModule;
+}
+
+#[allow(non_camel_case_types)]
+/// Extension trait for access to the procedure `get_admin_account_by_username_and_return`.
+///
+/// Implemented for [`super::RemoteProcedures`].
+pub trait get_admin_account_by_username_and_return {
+    fn get_admin_account_by_username_and_return(&self, input: AdminAccountGetByUsernameInput) {
+        self.get_admin_account_by_username_and_return_then(input, |_, _| {});
+    }
+
+    fn get_admin_account_by_username_and_return_then(
+        &self,
+        input: AdminAccountGetByUsernameInput,
+
+        __callback: impl FnOnce(
+                &super::ProcedureEventContext,
+                Result<AdminAccountCredentialProcedureResult, __sdk::InternalError>,
+            ) + Send
+            + 'static,
+    );
+}
+
+impl get_admin_account_by_username_and_return for super::RemoteProcedures {
+    fn get_admin_account_by_username_and_return_then(
+        &self,
+        input: AdminAccountGetByUsernameInput,
+
+        __callback: impl FnOnce(
+                &super::ProcedureEventContext,
+                Result<AdminAccountCredentialProcedureResult, __sdk::InternalError>,
+            ) + Send
+            + 'static,
+    ) {
+        self.imp
+            .invoke_procedure_with_callback::<_, AdminAccountCredentialProcedureResult>(
+                "get_admin_account_by_username_and_return",
+                GetAdminAccountByUsernameAndReturnArgs { input },
+                __callback,
+            );
+    }
+}
diff --git a/server-rs/crates/spacetime-client/src/module_bindings/get_admin_dashboard_stats_and_return_procedure.rs b/server-rs/crates/spacetime-client/src/module_bindings/get_admin_dashboard_stats_and_return_procedure.rs
new file mode 100644
index 000000000..ec663a6d4
--- /dev/null
+++ b/server-rs/crates/spacetime-client/src/module_bindings/get_admin_dashboard_stats_and_return_procedure.rs
@@ -0,0 +1,59 @@
+// THIS FILE IS AUTOMATICALLY GENERATED BY SPACETIMEDB. EDITS TO THIS FILE
+// WILL NOT BE SAVED. MODIFY TABLES IN YOUR MODULE SOURCE CODE INSTEAD.
+
+#![allow(unused, clippy::all)]
+use spacetimedb_sdk::__codegen::{self as __sdk, __lib, __sats, __ws};
+
+use super::admin_dashboard_stats_input_type::AdminDashboardStatsInput;
+use super::admin_dashboard_stats_procedure_result_type::AdminDashboardStatsProcedureResult;
+
+#[derive(__lib::ser::Serialize, __lib::de::Deserialize, Clone, PartialEq, Debug)]
+#[sats(crate = __lib)]
+struct GetAdminDashboardStatsAndReturnArgs {
+    pub input: AdminDashboardStatsInput,
+}
+
+impl __sdk::InModule for GetAdminDashboardStatsAndReturnArgs {
+    type Module = super::RemoteModule;
+}
+
+#[allow(non_camel_case_types)]
+/// Extension trait for access to the procedure `get_admin_dashboard_stats_and_return`.
+///
+/// Implemented for [`super::RemoteProcedures`].
+pub trait get_admin_dashboard_stats_and_return {
+    fn get_admin_dashboard_stats_and_return(&self, input: AdminDashboardStatsInput) {
+        self.get_admin_dashboard_stats_and_return_then(input, |_, _| {});
+    }
+
+    fn get_admin_dashboard_stats_and_return_then(
+        &self,
+        input: AdminDashboardStatsInput,
+
+        __callback: impl FnOnce(
+                &super::ProcedureEventContext,
+                Result<AdminDashboardStatsProcedureResult, __sdk::InternalError>,
+            ) + Send
+            + 'static,
+    );
+}
+
+impl get_admin_dashboard_stats_and_return for super::RemoteProcedures {
+    fn get_admin_dashboard_stats_and_return_then(
+        &self,
+        input: AdminDashboardStatsInput,
+
+        __callback: impl FnOnce(
+                &super::ProcedureEventContext,
+                Result<AdminDashboardStatsProcedureResult, __sdk::InternalError>,
+            ) + Send
+            + 'static,
+    ) {
+        self.imp
+            .invoke_procedure_with_callback::<_, AdminDashboardStatsProcedureResult>(
+                "get_admin_dashboard_stats_and_return",
+                GetAdminDashboardStatsAndReturnArgs { input },
+                __callback,
+            );
+    }
+}
diff --git a/server-rs/crates/spacetime-client/src/module_bindings/list_admin_accounts_and_return_procedure.rs b/server-rs/crates/spacetime-client/src/module_bindings/list_admin_accounts_and_return_procedure.rs
new file mode 100644
index 000000000..0594f17b3
--- /dev/null
+++ b/server-rs/crates/spacetime-client/src/module_bindings/list_admin_accounts_and_return_procedure.rs
@@ -0,0 +1,54 @@
+// THIS FILE IS AUTOMATICALLY GENERATED BY SPACETIMEDB. EDITS TO THIS FILE
+// WILL NOT BE SAVED. MODIFY TABLES IN YOUR MODULE SOURCE CODE INSTEAD.
+
+#![allow(unused, clippy::all)]
+use spacetimedb_sdk::__codegen::{self as __sdk, __lib, __sats, __ws};
+
+use super::admin_account_procedure_result_type::AdminAccountProcedureResult;
+
+#[derive(__lib::ser::Serialize, __lib::de::Deserialize, Clone, PartialEq, Debug)]
+#[sats(crate = __lib)]
+struct ListAdminAccountsAndReturnArgs {}
+
+impl __sdk::InModule for ListAdminAccountsAndReturnArgs {
+    type Module = super::RemoteModule;
+}
+
+#[allow(non_camel_case_types)]
+/// Extension trait for access to the procedure `list_admin_accounts_and_return`.
+///
+/// Implemented for [`super::RemoteProcedures`].
+pub trait list_admin_accounts_and_return {
+    fn list_admin_accounts_and_return(&self) {
+        self.list_admin_accounts_and_return_then(|_, _| {});
+    }
+
+    fn list_admin_accounts_and_return_then(
+        &self,
+
+        __callback: impl FnOnce(
+                &super::ProcedureEventContext,
+                Result<AdminAccountProcedureResult, __sdk::InternalError>,
+            ) + Send
+            + 'static,
+    );
+}
+
+impl list_admin_accounts_and_return for super::RemoteProcedures {
+    fn list_admin_accounts_and_return_then(
+        &self,
+
+        __callback: impl FnOnce(
+                &super::ProcedureEventContext,
+                Result<AdminAccountProcedureResult, __sdk::InternalError>,
+            ) + Send
+            + 'static,
+    ) {
+        self.imp
+            .invoke_procedure_with_callback::<_, AdminAccountProcedureResult>(
+                "list_admin_accounts_and_return",
+                ListAdminAccountsAndReturnArgs {},
+                __callback,
+            );
+    }
+}
diff --git a/server-rs/crates/spacetime-client/src/module_bindings/profile_recharge_refund_type.rs b/server-rs/crates/spacetime-client/src/module_bindings/profile_recharge_refund_type.rs
index b71253bba..9eeba7cd5 100644
--- a/server-rs/crates/spacetime-client/src/module_bindings/profile_recharge_refund_type.rs
+++ b/server-rs/crates/spacetime-client/src/module_bindings/profile_recharge_refund_type.rs
@@ -36,6 +36,7 @@ pub struct ProfileRechargeRefund {
     pub manual_review_resolved_by_admin_user_id: Option<String>,
     pub manual_review_resolution_reason: Option<String>,
     pub manual_review_resolved_at: Option<__sdk::Timestamp>,
+    pub manual_review_resolved_error_code: Option<String>,
 }
 
 impl __sdk::InModule for ProfileRechargeRefund {
@@ -82,6 +83,8 @@ pub struct ProfileRechargeRefundCols {
         __sdk::__query_builder::Col<ProfileRechargeRefund, Option<String>>,
     pub manual_review_resolved_at:
         __sdk::__query_builder::Col<ProfileRechargeRefund, Option<__sdk::Timestamp>>,
+    pub manual_review_resolved_error_code:
+        __sdk::__query_builder::Col<ProfileRechargeRefund, Option<String>>,
 }
 
 impl __sdk::__query_builder::HasCols for ProfileRechargeRefund {
@@ -137,6 +140,10 @@ impl __sdk::__query_builder::HasCols for ProfileRechargeRefund {
                 table_name,
                 "manual_review_resolved_at",
             ),
+            manual_review_resolved_error_code: __sdk::__query_builder::Col::new(
+                table_name,
+                "manual_review_resolved_error_code",
+            ),
         }
     }
 }
diff --git a/server-rs/crates/spacetime-client/src/module_bindings/runtime_profile_recharge_refund_manual_review_resolve_input_type.rs b/server-rs/crates/spacetime-client/src/module_bindings/runtime_profile_recharge_refund_manual_review_resolve_input_type.rs
index 18005a48b..92e59ae73 100644
--- a/server-rs/crates/spacetime-client/src/module_bindings/runtime_profile_recharge_refund_manual_review_resolve_input_type.rs
+++ b/server-rs/crates/spacetime-client/src/module_bindings/runtime_profile_recharge_refund_manual_review_resolve_input_type.rs
@@ -10,6 +10,7 @@ pub struct RuntimeProfileRechargeRefundManualReviewResolveInput {
     pub out_refund_no: String,
     pub admin_user_id: String,
     pub reason: String,
+    pub expected_error_code: String,
 }
 
 impl __sdk::InModule for RuntimeProfileRechargeRefundManualReviewResolveInput {
diff --git a/server-rs/crates/spacetime-client/src/module_bindings/runtime_profile_recharge_refund_snapshot_type.rs b/server-rs/crates/spacetime-client/src/module_bindings/runtime_profile_recharge_refund_snapshot_type.rs
index 98620a9f4..b5064a5ee 100644
--- a/server-rs/crates/spacetime-client/src/module_bindings/runtime_profile_recharge_refund_snapshot_type.rs
+++ b/server-rs/crates/spacetime-client/src/module_bindings/runtime_profile_recharge_refund_snapshot_type.rs
@@ -36,6 +36,7 @@ pub struct RuntimeProfileRechargeRefundSnapshot {
     pub manual_review_resolved_by_admin_user_id: Option<String>,
     pub manual_review_resolution_reason: Option<String>,
     pub manual_review_resolved_at_micros: Option<i64>,
+    pub manual_review_resolved_error_code: Option<String>,
 }
 
 impl __sdk::InModule for RuntimeProfileRechargeRefundSnapshot {
diff --git a/server-rs/crates/spacetime-client/src/module_bindings/update_admin_account_and_return_procedure.rs b/server-rs/crates/spacetime-client/src/module_bindings/update_admin_account_and_return_procedure.rs
new file mode 100644
index 000000000..1eb839663
--- /dev/null
+++ b/server-rs/crates/spacetime-client/src/module_bindings/update_admin_account_and_return_procedure.rs
@@ -0,0 +1,59 @@
+// THIS FILE IS AUTOMATICALLY GENERATED BY SPACETIMEDB. EDITS TO THIS FILE
+// WILL NOT BE SAVED. MODIFY TABLES IN YOUR MODULE SOURCE CODE INSTEAD.
+
+#![allow(unused, clippy::all)]
+use spacetimedb_sdk::__codegen::{self as __sdk, __lib, __sats, __ws};
+
+use super::admin_account_procedure_result_type::AdminAccountProcedureResult;
+use super::admin_account_update_input_type::AdminAccountUpdateInput;
+
+#[derive(__lib::ser::Serialize, __lib::de::Deserialize, Clone, PartialEq, Debug)]
+#[sats(crate = __lib)]
+struct UpdateAdminAccountAndReturnArgs {
+    pub input: AdminAccountUpdateInput,
+}
+
+impl __sdk::InModule for UpdateAdminAccountAndReturnArgs {
+    type Module = super::RemoteModule;
+}
+
+#[allow(non_camel_case_types)]
+/// Extension trait for access to the procedure `update_admin_account_and_return`.
+///
+/// Implemented for [`super::RemoteProcedures`].
+pub trait update_admin_account_and_return {
+    fn update_admin_account_and_return(&self, input: AdminAccountUpdateInput) {
+        self.update_admin_account_and_return_then(input, |_, _| {});
+    }
+
+    fn update_admin_account_and_return_then(
+        &self,
+        input: AdminAccountUpdateInput,
+
+        __callback: impl FnOnce(
+                &super::ProcedureEventContext,
+                Result<AdminAccountProcedureResult, __sdk::InternalError>,
+            ) + Send
+            + 'static,
+    );
+}
+
+impl update_admin_account_and_return for super::RemoteProcedures {
+    fn update_admin_account_and_return_then(
+        &self,
+        input: AdminAccountUpdateInput,
+
+        __callback: impl FnOnce(
+                &super::ProcedureEventContext,
+                Result<AdminAccountProcedureResult, __sdk::InternalError>,
+            ) + Send
+            + 'static,
+    ) {
+        self.imp
+            .invoke_procedure_with_callback::<_, AdminAccountProcedureResult>(
+                "update_admin_account_and_return",
+                UpdateAdminAccountAndReturnArgs { input },
+                __callback,
+            );
+    }
+}
diff --git a/server-rs/crates/spacetime-client/src/profile_recharge_expiration.rs b/server-rs/crates/spacetime-client/src/profile_recharge_expiration.rs
index 7bab87ddc..593f634f2 100644
--- a/server-rs/crates/spacetime-client/src/profile_recharge_expiration.rs
+++ b/server-rs/crates/spacetime-client/src/profile_recharge_expiration.rs
@@ -67,12 +67,10 @@ impl SpacetimeClient {
                         send_connect_once(&connect_sender, Ok(()));
                     })
                     .on_disconnect(move |_, error| {
-                        let message = error
-                            .map(|error| error.to_string())
-                            .unwrap_or_else(|| {
-                                "SpacetimeDB profile recharge expiration subscription disconnected"
-                                    .to_string()
-                            });
+                        let message = error.map(|error| error.to_string()).unwrap_or_else(|| {
+                            "SpacetimeDB profile recharge expiration subscription disconnected"
+                                .to_string()
+                        });
                         send_connect_once(
                             &disconnect_sender,
                             Err(SpacetimeClientError::Procedure(message)),
diff --git a/server-rs/crates/spacetime-module/src/admin_account_storage.rs b/server-rs/crates/spacetime-module/src/admin_account_storage.rs
new file mode 100644
index 000000000..243a9d135
--- /dev/null
+++ b/server-rs/crates/spacetime-module/src/admin_account_storage.rs
@@ -0,0 +1,596 @@
+use std::collections::HashSet;
+
+use crate::*;
+use shared_contracts::admin::ADMIN_TAB_PERMISSIONS;
+
+const ADMIN_ACCOUNT_MAX_ID_CHARS: usize = 128;
+const ADMIN_ACCOUNT_MAX_USERNAME_CHARS: usize = 64;
+const ADMIN_ACCOUNT_MAX_DISPLAY_NAME_CHARS: usize = 64;
+const ADMIN_ACCOUNT_MAX_ACTOR_CHARS: usize = 128;
+const ADMIN_ACCOUNT_MAX_PASSWORD_HASH_CHARS: usize = 512;
+
+#[spacetimedb::table(accessor = admin_account)]
+#[derive(Clone)]
+pub struct AdminAccount {
+    #[primary_key]
+    pub account_id: String,
+    #[unique]
+    pub username: String,
+    pub display_name: String,
+    pub password_hash: String,
+    pub tab_permissions_json: String,
+    pub enabled: bool,
+    pub token_version: u64,
+    pub created_by: String,
+    pub updated_by: String,
+    pub created_at: Timestamp,
+    pub updated_at: Timestamp,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, SpacetimeType)]
+pub struct AdminAccountGetByUsernameInput {
+    pub username: String,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, SpacetimeType)]
+pub struct AdminAccountGetByIdInput {
+    pub account_id: String,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, SpacetimeType)]
+pub struct AdminAccountCreateInput {
+    pub account_id: String,
+    pub username: String,
+    pub display_name: String,
+    pub password_hash: String,
+    pub tab_permissions_json: String,
+    pub enabled: bool,
+    pub created_by: String,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, SpacetimeType)]
+pub struct AdminAccountUpdateInput {
+    pub account_id: String,
+    pub display_name: String,
+    pub password_hash: Option<String>,
+    pub tab_permissions_json: String,
+    pub enabled: bool,
+    pub updated_by: String,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, SpacetimeType)]
+pub struct AdminAccountSnapshot {
+    pub account_id: String,
+    pub username: String,
+    pub display_name: String,
+    pub tab_permissions_json: String,
+    pub enabled: bool,
+    pub token_version: u64,
+    pub created_by: String,
+    pub updated_by: String,
+    pub created_at_micros: i64,
+    pub updated_at_micros: i64,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, SpacetimeType)]
+pub struct AdminAccountCredentialSnapshot {
+    pub account: AdminAccountSnapshot,
+    pub password_hash: String,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, SpacetimeType)]
+pub struct AdminAccountProcedureResult {
+    pub ok: bool,
+    pub account: Option<AdminAccountSnapshot>,
+    pub accounts: Vec<AdminAccountSnapshot>,
+    pub error_message: Option<String>,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, SpacetimeType)]
+pub struct AdminAccountCredentialProcedureResult {
+    pub ok: bool,
+    pub account: Option<AdminAccountCredentialSnapshot>,
+    pub error_message: Option<String>,
+}
+
+#[spacetimedb::procedure]
+pub fn get_admin_account_by_username_and_return(
+    ctx: &mut ProcedureContext,
+    input: AdminAccountGetByUsernameInput,
+) -> AdminAccountCredentialProcedureResult {
+    let caller = ctx.sender();
+    match ctx.try_with_tx(|tx| {
+        require_admin_account_service_identity(tx, caller)?;
+        get_admin_account_by_username(tx, input.clone())
+    }) {
+        Ok(account) => admin_account_credential_ok(account),
+        Err(message) => admin_account_credential_error(message),
+    }
+}
+
+#[spacetimedb::procedure]
+pub fn get_admin_account_by_id_and_return(
+    ctx: &mut ProcedureContext,
+    input: AdminAccountGetByIdInput,
+) -> AdminAccountProcedureResult {
+    let caller = ctx.sender();
+    match ctx.try_with_tx(|tx| {
+        require_admin_account_service_identity(tx, caller)?;
+        get_admin_account_by_id(tx, input.clone())
+    }) {
+        Ok(account) => admin_account_single_ok(account),
+        Err(message) => admin_account_error(message),
+    }
+}
+
+#[spacetimedb::procedure]
+pub fn list_admin_accounts_and_return(ctx: &mut ProcedureContext) -> AdminAccountProcedureResult {
+    let caller = ctx.sender();
+    match ctx.try_with_tx(|tx| {
+        require_admin_account_service_identity(tx, caller)?;
+        Ok(list_admin_accounts(tx))
+    }) {
+        Ok(accounts) => admin_account_list_ok(accounts),
+        Err(message) => admin_account_error(message),
+    }
+}
+
+#[spacetimedb::procedure]
+pub fn create_admin_account_and_return(
+    ctx: &mut ProcedureContext,
+    input: AdminAccountCreateInput,
+) -> AdminAccountProcedureResult {
+    let caller = ctx.sender();
+    match ctx.try_with_tx(|tx| {
+        require_admin_account_service_identity(tx, caller)?;
+        create_admin_account(tx, input.clone())
+    }) {
+        Ok(account) => admin_account_single_ok(account),
+        Err(message) => admin_account_error(message),
+    }
+}
+
+#[spacetimedb::procedure]
+pub fn update_admin_account_and_return(
+    ctx: &mut ProcedureContext,
+    input: AdminAccountUpdateInput,
+) -> AdminAccountProcedureResult {
+    let caller = ctx.sender();
+    match ctx.try_with_tx(|tx| {
+        require_admin_account_service_identity(tx, caller)?;
+        update_admin_account(tx, input.clone())
+    }) {
+        Ok(account) => admin_account_single_ok(account),
+        Err(message) => admin_account_error(message),
+    }
+}
+
+fn require_admin_account_service_identity(
+    ctx: &ReducerContext,
+    caller: Identity,
+) -> Result<(), String> {
+    crate::editor_project_storage::require_editor_generation_runtime_service_identity(ctx, caller)
+}
+
+fn get_admin_account_by_username(
+    ctx: &ReducerContext,
+    input: AdminAccountGetByUsernameInput,
+) -> Result<AdminAccountCredentialSnapshot, String> {
+    let username = normalize_username(&input.username)?;
+    ctx.db
+        .admin_account()
+        .username()
+        .find(&username)
+        .map(admin_account_credential_snapshot_from_row)
+        .ok_or_else(|| "后台账号不存在".to_string())
+}
+
+fn get_admin_account_by_id(
+    ctx: &ReducerContext,
+    input: AdminAccountGetByIdInput,
+) -> Result<AdminAccountSnapshot, String> {
+    let account_id = normalize_required(
+        &input.account_id,
+        "admin_account.account_id",
+        ADMIN_ACCOUNT_MAX_ID_CHARS,
+    )?;
+    ctx.db
+        .admin_account()
+        .account_id()
+        .find(&account_id)
+        .map(admin_account_snapshot_from_row)
+        .ok_or_else(|| "后台账号不存在".to_string())
+}
+
+fn list_admin_accounts(ctx: &ReducerContext) -> Vec<AdminAccountSnapshot> {
+    let mut accounts = ctx
+        .db
+        .admin_account()
+        .iter()
+        .map(admin_account_snapshot_from_row)
+        .collect::<Vec<_>>();
+    accounts.sort_by(|left, right| {
+        left.username
+            .cmp(&right.username)
+            .then_with(|| left.account_id.cmp(&right.account_id))
+    });
+    accounts
+}
+
+fn create_admin_account(
+    ctx: &ReducerContext,
+    input: AdminAccountCreateInput,
+) -> Result<AdminAccountSnapshot, String> {
+    let account_id = normalize_required(
+        &input.account_id,
+        "admin_account.account_id",
+        ADMIN_ACCOUNT_MAX_ID_CHARS,
+    )?;
+    let username = normalize_username(&input.username)?;
+    ensure_admin_account_available(
+        ctx.db
+            .admin_account()
+            .account_id()
+            .find(&account_id)
+            .is_some(),
+        ctx.db.admin_account().username().find(&username).is_some(),
+    )?;
+    let display_name = normalize_required(
+        &input.display_name,
+        "admin_account.display_name",
+        ADMIN_ACCOUNT_MAX_DISPLAY_NAME_CHARS,
+    )?;
+    let password_hash = normalize_password_hash(&input.password_hash)?;
+    let tab_permissions_json = normalize_tab_permissions_json(&input.tab_permissions_json)?;
+    let created_by = normalize_required(
+        &input.created_by,
+        "admin_account.created_by",
+        ADMIN_ACCOUNT_MAX_ACTOR_CHARS,
+    )?;
+
+    ctx.db.admin_account().try_insert(AdminAccount {
+        account_id: account_id.clone(),
+        username,
+        display_name,
+        password_hash,
+        tab_permissions_json,
+        enabled: input.enabled,
+        token_version: 1,
+        created_by: created_by.clone(),
+        updated_by: created_by,
+        created_at: ctx.timestamp,
+        updated_at: ctx.timestamp,
+    })?;
+
+    ctx.db
+        .admin_account()
+        .account_id()
+        .find(&account_id)
+        .map(admin_account_snapshot_from_row)
+        .ok_or_else(|| "后台账号创建失败".to_string())
+}
+
+fn update_admin_account(
+    ctx: &ReducerContext,
+    input: AdminAccountUpdateInput,
+) -> Result<AdminAccountSnapshot, String> {
+    let account_id = normalize_required(
+        &input.account_id,
+        "admin_account.account_id",
+        ADMIN_ACCOUNT_MAX_ID_CHARS,
+    )?;
+    let row = ctx
+        .db
+        .admin_account()
+        .account_id()
+        .find(&account_id)
+        .ok_or_else(|| "后台账号不存在".to_string())?;
+    let display_name = normalize_required(
+        &input.display_name,
+        "admin_account.display_name",
+        ADMIN_ACCOUNT_MAX_DISPLAY_NAME_CHARS,
+    )?;
+    let password_hash = input
+        .password_hash
+        .as_deref()
+        .map(normalize_password_hash)
+        .transpose()?;
+    let tab_permissions_json = normalize_tab_permissions_json(&input.tab_permissions_json)?;
+    let updated_by = normalize_required(
+        &input.updated_by,
+        "admin_account.updated_by",
+        ADMIN_ACCOUNT_MAX_ACTOR_CHARS,
+    )?;
+    let updated = build_updated_admin_account(
+        row,
+        display_name,
+        password_hash,
+        tab_permissions_json,
+        input.enabled,
+        updated_by,
+        ctx.timestamp,
+    )?;
+    ctx.db.admin_account().account_id().update(updated);
+
+    ctx.db
+        .admin_account()
+        .account_id()
+        .find(&account_id)
+        .map(admin_account_snapshot_from_row)
+        .ok_or_else(|| "后台账号更新失败".to_string())
+}
+
+fn build_updated_admin_account(
+    row: AdminAccount,
+    display_name: String,
+    password_hash: Option<String>,
+    tab_permissions_json: String,
+    enabled: bool,
+    updated_by: String,
+    updated_at: Timestamp,
+) -> Result<AdminAccount, String> {
+    let invalidates_session = password_hash.is_some()
+        || row.tab_permissions_json != tab_permissions_json
+        || row.enabled != enabled;
+    let token_version = if invalidates_session {
+        row.token_version
+            .checked_add(1)
+            .ok_or_else(|| "后台账号 token_version 已达上限".to_string())?
+    } else {
+        row.token_version
+    };
+    Ok(AdminAccount {
+        display_name,
+        password_hash: password_hash.unwrap_or(row.password_hash),
+        tab_permissions_json,
+        enabled,
+        token_version,
+        updated_by,
+        updated_at,
+        ..row
+    })
+}
+
+fn admin_account_snapshot_from_row(row: AdminAccount) -> AdminAccountSnapshot {
+    AdminAccountSnapshot {
+        account_id: row.account_id,
+        username: row.username,
+        display_name: row.display_name,
+        tab_permissions_json: row.tab_permissions_json,
+        enabled: row.enabled,
+        token_version: row.token_version,
+        created_by: row.created_by,
+        updated_by: row.updated_by,
+        created_at_micros: row.created_at.to_micros_since_unix_epoch(),
+        updated_at_micros: row.updated_at.to_micros_since_unix_epoch(),
+    }
+}
+
+fn admin_account_credential_snapshot_from_row(row: AdminAccount) -> AdminAccountCredentialSnapshot {
+    AdminAccountCredentialSnapshot {
+        password_hash: row.password_hash.clone(),
+        account: admin_account_snapshot_from_row(row),
+    }
+}
+
+fn normalize_username(value: &str) -> Result<String, String> {
+    normalize_required(
+        value,
+        "admin_account.username",
+        ADMIN_ACCOUNT_MAX_USERNAME_CHARS,
+    )
+    .map(|value| value.to_ascii_lowercase())
+}
+
+fn normalize_password_hash(value: &str) -> Result<String, String> {
+    normalize_required(
+        value,
+        "admin_account.password_hash",
+        ADMIN_ACCOUNT_MAX_PASSWORD_HASH_CHARS,
+    )
+}
+
+fn normalize_required(value: &str, field: &str, max_chars: usize) -> Result<String, String> {
+    let normalized = value.trim();
+    if normalized.is_empty() {
+        return Err(format!("{field} 不能为空"));
+    }
+    if normalized.chars().count() > max_chars {
+        return Err(format!("{field} 长度不能超过 {max_chars} 个字符"));
+    }
+    Ok(normalized.to_string())
+}
+
+fn normalize_tab_permissions_json(value: &str) -> Result<String, String> {
+    let permissions = serde_json::from_str::<Vec<String>>(value.trim())
+        .map_err(|_| "admin_account.tab_permissions_json 必须是字符串数组 JSON".to_string())?;
+    let requested = permissions
+        .into_iter()
+        .map(|permission| permission.trim().to_string())
+        .collect::<HashSet<_>>();
+    if let Some(permission) = requested
+        .iter()
+        .find(|permission| !ADMIN_TAB_PERMISSIONS.contains(&permission.as_str()))
+    {
+        return Err(format!("未知后台 Tab 权限: {permission}"));
+    }
+    let normalized = ADMIN_TAB_PERMISSIONS
+        .iter()
+        .filter(|permission| requested.contains(**permission))
+        .copied()
+        .collect::<Vec<_>>();
+    serde_json::to_string(&normalized).map_err(|_| "后台 Tab 权限序列化失败".to_string())
+}
+
+fn ensure_admin_account_available(
+    account_id_exists: bool,
+    username_exists: bool,
+) -> Result<(), String> {
+    if account_id_exists {
+        return Err("后台账号 ID 已存在".to_string());
+    }
+    if username_exists {
+        return Err("后台账号用户名已存在".to_string());
+    }
+    Ok(())
+}
+
+fn admin_account_single_ok(account: AdminAccountSnapshot) -> AdminAccountProcedureResult {
+    AdminAccountProcedureResult {
+        ok: true,
+        account: Some(account),
+        accounts: Vec::new(),
+        error_message: None,
+    }
+}
+
+fn admin_account_credential_ok(
+    account: AdminAccountCredentialSnapshot,
+) -> AdminAccountCredentialProcedureResult {
+    AdminAccountCredentialProcedureResult {
+        ok: true,
+        account: Some(account),
+        error_message: None,
+    }
+}
+
+fn admin_account_list_ok(accounts: Vec<AdminAccountSnapshot>) -> AdminAccountProcedureResult {
+    AdminAccountProcedureResult {
+        ok: true,
+        account: None,
+        accounts,
+        error_message: None,
+    }
+}
+
+fn admin_account_error(message: String) -> AdminAccountProcedureResult {
+    AdminAccountProcedureResult {
+        ok: false,
+        account: None,
+        accounts: Vec::new(),
+        error_message: Some(message),
+    }
+}
+
+fn admin_account_credential_error(message: String) -> AdminAccountCredentialProcedureResult {
+    AdminAccountCredentialProcedureResult {
+        ok: false,
+        account: None,
+        error_message: Some(message),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn tab_permissions_are_deduplicated_in_stable_route_order() {
+        let normalized = normalize_tab_permissions_json(
+            r#"["work-visibility","dashboard","dashboard","tracking"]"#,
+        )
+        .expect("permissions should normalize");
+
+        assert_eq!(normalized, r#"["dashboard","tracking","work-visibility"]"#);
+    }
+
+    #[test]
+    fn unknown_tab_permission_is_rejected() {
+        let error = normalize_tab_permissions_json(r#"["dashboard","accounts"]"#)
+            .expect_err("owner-only accounts permission must be rejected");
+
+        assert!(error.contains("accounts"));
+    }
+
+    #[test]
+    fn duplicate_username_is_rejected() {
+        let error = ensure_admin_account_available(false, true)
+            .expect_err("duplicate username must be rejected");
+
+        assert_eq!(error, "后台账号用户名已存在");
+    }
+
+    #[test]
+    fn update_state_increments_token_version_and_preserves_username() {
+        let row = AdminAccount {
+            account_id: "member-1".to_string(),
+            username: "operator".to_string(),
+            display_name: "运营".to_string(),
+            password_hash: "$argon2id$old".to_string(),
+            tab_permissions_json: r#"["dashboard"]"#.to_string(),
+            enabled: true,
+            token_version: 7,
+            created_by: "owner".to_string(),
+            updated_by: "owner".to_string(),
+            created_at: Timestamp::from_micros_since_unix_epoch(10),
+            updated_at: Timestamp::from_micros_since_unix_epoch(10),
+        };
+        let updated = build_updated_admin_account(
+            row,
+            "禁用运营".to_string(),
+            None,
+            r#"["dashboard"]"#.to_string(),
+            false,
+            "owner".to_string(),
+            Timestamp::from_micros_since_unix_epoch(20),
+        )
+        .expect("account should update");
+
+        assert_eq!(updated.username, "operator");
+        assert_eq!(updated.token_version, 8);
+        assert!(!updated.enabled);
+    }
+
+    #[test]
+    fn display_name_only_update_keeps_token_version() {
+        let row = AdminAccount {
+            account_id: "member-1".to_string(),
+            username: "operator".to_string(),
+            display_name: "运营".to_string(),
+            password_hash: "$argon2id$old".to_string(),
+            tab_permissions_json: r#"["dashboard"]"#.to_string(),
+            enabled: true,
+            token_version: 7,
+            created_by: "owner".to_string(),
+            updated_by: "owner".to_string(),
+            created_at: Timestamp::from_micros_since_unix_epoch(10),
+            updated_at: Timestamp::from_micros_since_unix_epoch(10),
+        };
+        let updated = build_updated_admin_account(
+            row,
+            "运营二组".to_string(),
+            None,
+            r#"["dashboard"]"#.to_string(),
+            true,
+            "owner".to_string(),
+            Timestamp::from_micros_since_unix_epoch(20),
+        )
+        .expect("display name should update");
+
+        assert_eq!(updated.display_name, "运营二组");
+        assert_eq!(updated.token_version, 7);
+    }
+
+    #[test]
+    fn public_and_credential_account_snapshots_are_type_separated() {
+        let row = AdminAccount {
+            account_id: "member-1".to_string(),
+            username: "operator".to_string(),
+            display_name: "运营".to_string(),
+            password_hash: "$argon2id$secret".to_string(),
+            tab_permissions_json: "[]".to_string(),
+            enabled: true,
+            token_version: 1,
+            created_by: "owner".to_string(),
+            updated_by: "owner".to_string(),
+            created_at: Timestamp::from_micros_since_unix_epoch(10),
+            updated_at: Timestamp::from_micros_since_unix_epoch(10),
+        };
+        let public_snapshot = admin_account_snapshot_from_row(row.clone());
+        let credential_snapshot = admin_account_credential_snapshot_from_row(row);
+
+        assert_eq!(public_snapshot.account_id, "member-1");
+        assert_eq!(credential_snapshot.account, public_snapshot);
+        assert_eq!(credential_snapshot.password_hash, "$argon2id$secret");
+    }
+}
diff --git a/server-rs/crates/spacetime-module/src/admin_dashboard.rs b/server-rs/crates/spacetime-module/src/admin_dashboard.rs
new file mode 100644
index 000000000..d5d1bfa1a
--- /dev/null
+++ b/server-rs/crates/spacetime-module/src/admin_dashboard.rs
@@ -0,0 +1,584 @@
+use std::collections::{BTreeMap, BTreeSet, HashSet};
+
+use crate::*;
+
+const ADMIN_DASHBOARD_MAX_RANGE_DAYS: i64 = 366;
+const ADMIN_DASHBOARD_ACTIVE_WINDOW_MICROS: i64 = 5 * 60 * 1_000_000;
+
+#[derive(Clone, Debug, PartialEq, Eq, SpacetimeType)]
+pub struct AdminDashboardStatsInput {
+    pub start_day_key: i64,
+    pub end_day_key: i64,
+    pub now_micros: i64,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, SpacetimeType)]
+pub struct AdminDashboardDailyCountSnapshot {
+    pub day_key: i64,
+    pub count: u64,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, SpacetimeType)]
+pub struct AdminDashboardBreakdownSnapshot {
+    pub key: String,
+    pub count: u64,
+}
+
+#[derive(Clone, Debug, Default, PartialEq, Eq, SpacetimeType)]
+pub struct AdminDashboardRetentionSnapshot {
+    pub eligible_users: u64,
+    pub retained_users: u64,
+    pub rate_basis_points: u32,
+}
+
+#[derive(Clone, Debug, Default, PartialEq, Eq, SpacetimeType)]
+pub struct AdminDashboardPaymentConversionSnapshot {
+    pub paid_users: u64,
+    pub new_registered_users: u64,
+    pub rate_basis_points: u32,
+}
+
+#[derive(Clone, Debug, Default, PartialEq, Eq, SpacetimeType)]
+pub struct AdminDashboardStatsSnapshot {
+    pub total_registered_users: u64,
+    pub new_registered_users: Vec<AdminDashboardDailyCountSnapshot>,
+    pub visit_count: Vec<AdminDashboardDailyCountSnapshot>,
+    pub visit_users_by_day: Vec<AdminDashboardDailyCountSnapshot>,
+    pub visit_users: u64,
+    pub total_visit_count: u64,
+    pub total_visit_users: u64,
+    pub current_users: u64,
+    pub day1_retention: AdminDashboardRetentionSnapshot,
+    pub day7_retention: AdminDashboardRetentionSnapshot,
+    pub module_visit_breakdown: Vec<AdminDashboardBreakdownSnapshot>,
+    pub new_user_payment_conversion: AdminDashboardPaymentConversionSnapshot,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, SpacetimeType)]
+pub struct AdminDashboardStatsProcedureResult {
+    pub ok: bool,
+    pub snapshot: Option<AdminDashboardStatsSnapshot>,
+    pub error_message: Option<String>,
+}
+
+struct AdminDashboardDailyStatsAccumulator<'a> {
+    start_day_key: i64,
+    end_day_key: i64,
+    selected_registrations: &'a BTreeMap<String, i64>,
+    visit_count: BTreeMap<i64, u64>,
+    visit_users_by_day: BTreeMap<i64, BTreeSet<String>>,
+    period_visit_users: BTreeSet<String>,
+    total_visit_users: BTreeSet<String>,
+    total_visit_count: u64,
+    retained_activity_days: HashSet<(String, i64)>,
+}
+
+impl<'a> AdminDashboardDailyStatsAccumulator<'a> {
+    fn new(
+        start_day_key: i64,
+        end_day_key: i64,
+        selected_registrations: &'a BTreeMap<String, i64>,
+    ) -> Self {
+        Self {
+            start_day_key,
+            end_day_key,
+            selected_registrations,
+            visit_count: BTreeMap::new(),
+            visit_users_by_day: BTreeMap::new(),
+            period_visit_users: BTreeSet::new(),
+            total_visit_users: BTreeSet::new(),
+            total_visit_count: 0,
+            retained_activity_days: HashSet::new(),
+        }
+    }
+
+    fn apply(
+        &mut self,
+        scope_kind: RuntimeTrackingScopeKind,
+        scope_id: &str,
+        day_key: i64,
+        count: u32,
+    ) {
+        if count == 0 {
+            return;
+        }
+        match scope_kind {
+            RuntimeTrackingScopeKind::Site => {
+                let count = u64::from(count);
+                self.total_visit_count = self.total_visit_count.saturating_add(count);
+                if day_key_is_in_range(day_key, self.start_day_key, self.end_day_key) {
+                    increment_count(&mut self.visit_count, day_key, count);
+                }
+            }
+            RuntimeTrackingScopeKind::User => {
+                let user_id = scope_id.trim();
+                if user_id.is_empty() || user_id == "anonymous" {
+                    return;
+                }
+                self.total_visit_users.insert(user_id.to_string());
+                if day_key_is_in_range(day_key, self.start_day_key, self.end_day_key) {
+                    self.period_visit_users.insert(user_id.to_string());
+                    self.visit_users_by_day
+                        .entry(day_key)
+                        .or_default()
+                        .insert(user_id.to_string());
+                }
+                if self
+                    .selected_registrations
+                    .get(user_id)
+                    .is_some_and(|registration_day_key| {
+                        day_key == registration_day_key.saturating_add(1)
+                            || day_key == registration_day_key.saturating_add(7)
+                    })
+                {
+                    self.retained_activity_days
+                        .insert((user_id.to_string(), day_key));
+                }
+            }
+            RuntimeTrackingScopeKind::Work | RuntimeTrackingScopeKind::Module => {}
+        }
+    }
+}
+
+struct AdminDashboardEventAccumulator {
+    start_day_key: i64,
+    end_day_key: i64,
+    active_since_micros: i64,
+    now_micros: i64,
+    current_users: BTreeSet<String>,
+    module_visit_breakdown: BTreeMap<String, u64>,
+}
+
+struct AdminDashboardPaymentConversionAccumulator<'a> {
+    selected_registrations: &'a BTreeMap<String, i64>,
+    now_micros: i64,
+    paid_users: BTreeSet<String>,
+}
+
+impl<'a> AdminDashboardPaymentConversionAccumulator<'a> {
+    fn new(selected_registrations: &'a BTreeMap<String, i64>, now_micros: i64) -> Self {
+        Self {
+            selected_registrations,
+            now_micros,
+            paid_users: BTreeSet::new(),
+        }
+    }
+
+    fn apply(&mut self, user_id: &str, paid_at_micros: Option<i64>) {
+        let Some(paid_at_micros) = paid_at_micros else {
+            return;
+        };
+        if !self.selected_registrations.contains_key(user_id) {
+            return;
+        }
+        if paid_at_micros > self.now_micros {
+            return;
+        }
+        self.paid_users.insert(user_id.to_string());
+    }
+
+    fn snapshot(self) -> AdminDashboardPaymentConversionSnapshot {
+        let paid_users = self.paid_users.len() as u64;
+        let new_registered_users = self.selected_registrations.len() as u64;
+        AdminDashboardPaymentConversionSnapshot {
+            paid_users,
+            new_registered_users,
+            rate_basis_points: payment_conversion_rate_basis_points(
+                paid_users,
+                new_registered_users,
+            ),
+        }
+    }
+}
+
+impl AdminDashboardEventAccumulator {
+    fn new(start_day_key: i64, end_day_key: i64, now_micros: i64) -> Self {
+        Self {
+            start_day_key,
+            end_day_key,
+            active_since_micros: now_micros.saturating_sub(ADMIN_DASHBOARD_ACTIVE_WINDOW_MICROS),
+            now_micros,
+            current_users: BTreeSet::new(),
+            module_visit_breakdown: BTreeMap::new(),
+        }
+    }
+
+    fn apply(
+        &mut self,
+        user_id: Option<&str>,
+        module_key: Option<&str>,
+        day_key: i64,
+        occurred_at_micros: i64,
+    ) {
+        if day_key_is_in_range(day_key, self.start_day_key, self.end_day_key) {
+            let module_key = module_key
+                .map(str::trim)
+                .filter(|value| !value.is_empty())
+                .unwrap_or("unknown");
+            increment_string_count(&mut self.module_visit_breakdown, module_key, 1);
+        }
+
+        if occurred_at_micros < self.active_since_micros || occurred_at_micros > self.now_micros {
+            return;
+        }
+        if let Some(user_id) = user_id
+            .map(str::trim)
+            .filter(|value| !value.is_empty() && *value != "anonymous")
+        {
+            self.current_users.insert(user_id.to_string());
+        }
+    }
+}
+
+#[spacetimedb::procedure]
+pub fn get_admin_dashboard_stats_and_return(
+    ctx: &mut ProcedureContext,
+    input: AdminDashboardStatsInput,
+) -> AdminDashboardStatsProcedureResult {
+    let caller = ctx.sender();
+    match ctx.try_with_tx(|tx| {
+        crate::editor_project_storage::require_editor_generation_runtime_service_identity(
+            tx, caller,
+        )?;
+        build_admin_dashboard_stats(tx, &input)
+    }) {
+        Ok(snapshot) => AdminDashboardStatsProcedureResult {
+            ok: true,
+            snapshot: Some(snapshot),
+            error_message: None,
+        },
+        Err(message) => AdminDashboardStatsProcedureResult {
+            ok: false,
+            snapshot: None,
+            error_message: Some(message),
+        },
+    }
+}
+
+fn build_admin_dashboard_stats(
+    ctx: &ReducerContext,
+    input: &AdminDashboardStatsInput,
+) -> Result<AdminDashboardStatsSnapshot, String> {
+    validate_admin_dashboard_stats_input(input)?;
+
+    let current_day_key = runtime_profile_beijing_day_key(input.now_micros);
+    let mut new_registered_users = BTreeMap::new();
+    let mut selected_registrations = BTreeMap::new();
+    let mut total_registered_users = 0u64;
+
+    for row in ctx.db.profile_dashboard_state().iter() {
+        total_registered_users = total_registered_users.saturating_add(1);
+        let registration_micros = row.created_at.to_micros_since_unix_epoch();
+        let registration_day_key = runtime_profile_beijing_day_key(registration_micros);
+        if day_key_is_in_range(registration_day_key, input.start_day_key, input.end_day_key) {
+            increment_count(&mut new_registered_users, registration_day_key, 1);
+            selected_registrations.insert(row.user_id, registration_day_key);
+        }
+    }
+
+    let mut payment_conversion =
+        AdminDashboardPaymentConversionAccumulator::new(&selected_registrations, input.now_micros);
+    for user_id in selected_registrations.keys() {
+        for row in ctx
+            .db
+            .profile_recharge_order()
+            .by_profile_recharge_order_user_id()
+            .filter(user_id.as_str())
+        {
+            payment_conversion.apply(
+                &row.user_id,
+                row.paid_at.map(|value| value.to_micros_since_unix_epoch()),
+            );
+        }
+    }
+
+    let mut daily_stats = AdminDashboardDailyStatsAccumulator::new(
+        input.start_day_key,
+        input.end_day_key,
+        &selected_registrations,
+    );
+    for row in ctx.db.tracking_daily_stat().iter() {
+        daily_stats.apply(row.scope_kind, &row.scope_id, row.day_key, row.count);
+    }
+
+    let mut event_stats = AdminDashboardEventAccumulator::new(
+        input.start_day_key,
+        input.end_day_key,
+        input.now_micros,
+    );
+    for row in ctx.db.tracking_event().iter() {
+        event_stats.apply(
+            row.user_id.as_deref(),
+            row.module_key.as_deref(),
+            row.day_key,
+            row.occurred_at.to_micros_since_unix_epoch(),
+        );
+    }
+
+    Ok(AdminDashboardStatsSnapshot {
+        total_registered_users,
+        new_registered_users: daily_counts(new_registered_users),
+        visit_count: daily_counts(daily_stats.visit_count),
+        visit_users_by_day: daily_unique_counts(daily_stats.visit_users_by_day),
+        visit_users: daily_stats.period_visit_users.len() as u64,
+        total_visit_count: daily_stats.total_visit_count,
+        total_visit_users: daily_stats.total_visit_users.len() as u64,
+        current_users: event_stats.current_users.len() as u64,
+        day1_retention: calculate_admin_dashboard_retention(
+            &selected_registrations,
+            &daily_stats.retained_activity_days,
+            current_day_key,
+            1,
+        ),
+        day7_retention: calculate_admin_dashboard_retention(
+            &selected_registrations,
+            &daily_stats.retained_activity_days,
+            current_day_key,
+            7,
+        ),
+        module_visit_breakdown: event_stats
+            .module_visit_breakdown
+            .into_iter()
+            .map(|(key, count)| AdminDashboardBreakdownSnapshot { key, count })
+            .collect(),
+        new_user_payment_conversion: payment_conversion.snapshot(),
+    })
+}
+
+fn validate_admin_dashboard_stats_input(input: &AdminDashboardStatsInput) -> Result<(), String> {
+    if input.start_day_key > input.end_day_key {
+        return Err("dashboard start_day_key 不能晚于 end_day_key".to_string());
+    }
+    if input.end_day_key.saturating_sub(input.start_day_key) + 1 > ADMIN_DASHBOARD_MAX_RANGE_DAYS {
+        return Err(format!(
+            "dashboard 查询范围最多支持 {ADMIN_DASHBOARD_MAX_RANGE_DAYS} 天"
+        ));
+    }
+    if input.now_micros <= 0 {
+        return Err("dashboard now_micros 必须大于 0".to_string());
+    }
+    let current_day_key = runtime_profile_beijing_day_key(input.now_micros);
+    if input.end_day_key > current_day_key {
+        return Err("dashboard end_day_key 不能晚于今天".to_string());
+    }
+    Ok(())
+}
+
+fn calculate_admin_dashboard_retention(
+    registrations: &BTreeMap<String, i64>,
+    active_user_days: &HashSet<(String, i64)>,
+    current_day_key: i64,
+    retention_days: i64,
+) -> AdminDashboardRetentionSnapshot {
+    let mut eligible_users = 0u64;
+    let mut retained_users = 0u64;
+    for (user_id, registration_day_key) in registrations {
+        let retention_day_key = registration_day_key.saturating_add(retention_days);
+        // 今天仍是进行中的业务日，只把目标日已完整结束的 cohort 纳入分母。
+        if retention_day_key >= current_day_key {
+            continue;
+        }
+        eligible_users = eligible_users.saturating_add(1);
+        if active_user_days.contains(&(user_id.clone(), retention_day_key)) {
+            retained_users = retained_users.saturating_add(1);
+        }
+    }
+    AdminDashboardRetentionSnapshot {
+        eligible_users,
+        retained_users,
+        rate_basis_points: retention_rate_basis_points(retained_users, eligible_users),
+    }
+}
+
+fn retention_rate_basis_points(retained_users: u64, eligible_users: u64) -> u32 {
+    if eligible_users == 0 {
+        return 0;
+    }
+    let numerator = u128::from(retained_users)
+        .saturating_mul(10_000)
+        .saturating_add(u128::from(eligible_users) / 2);
+    (numerator / u128::from(eligible_users)).min(10_000) as u32
+}
+
+fn payment_conversion_rate_basis_points(paid_users: u64, new_registered_users: u64) -> u32 {
+    if new_registered_users == 0 {
+        return 0;
+    }
+    ((u128::from(paid_users) * 10_000 + u128::from(new_registered_users) / 2)
+        / u128::from(new_registered_users))
+    .min(10_000) as u32
+}
+
+fn day_key_is_in_range(day_key: i64, start_day_key: i64, end_day_key: i64) -> bool {
+    day_key >= start_day_key && day_key <= end_day_key
+}
+
+fn increment_count(counts: &mut BTreeMap<i64, u64>, key: i64, amount: u64) {
+    let next = counts
+        .get(&key)
+        .copied()
+        .unwrap_or(0)
+        .saturating_add(amount);
+    counts.insert(key, next);
+}
+
+fn increment_string_count(counts: &mut BTreeMap<String, u64>, key: &str, amount: u64) {
+    let next = counts.get(key).copied().unwrap_or(0).saturating_add(amount);
+    counts.insert(key.to_string(), next);
+}
+
+fn daily_counts(counts: BTreeMap<i64, u64>) -> Vec<AdminDashboardDailyCountSnapshot> {
+    counts
+        .into_iter()
+        .map(|(day_key, count)| AdminDashboardDailyCountSnapshot { day_key, count })
+        .collect()
+}
+
+fn daily_unique_counts(
+    users_by_day: BTreeMap<i64, BTreeSet<String>>,
+) -> Vec<AdminDashboardDailyCountSnapshot> {
+    users_by_day
+        .into_iter()
+        .map(|(day_key, users)| AdminDashboardDailyCountSnapshot {
+            day_key,
+            count: users.len() as u64,
+        })
+        .collect()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{
+        AdminDashboardDailyStatsAccumulator, AdminDashboardEventAccumulator,
+        AdminDashboardPaymentConversionAccumulator, AdminDashboardStatsInput,
+        RuntimeTrackingScopeKind, calculate_admin_dashboard_retention, daily_unique_counts,
+        payment_conversion_rate_basis_points, retention_rate_basis_points,
+        validate_admin_dashboard_stats_input,
+    };
+    use std::collections::{BTreeMap, BTreeSet, HashSet};
+
+    #[test]
+    fn retention_only_counts_mature_cohorts_and_exact_return_day() {
+        let registrations = BTreeMap::from([
+            ("day1-returned".to_string(), 100),
+            ("day1-missed".to_string(), 100),
+            ("day7-returned".to_string(), 94),
+            ("not-mature".to_string(), 101),
+        ]);
+        let active_user_days = HashSet::from([
+            ("day1-returned".to_string(), 101),
+            ("day1-missed".to_string(), 102),
+            ("day7-returned".to_string(), 101),
+            ("not-mature".to_string(), 101),
+        ]);
+
+        let day1 = calculate_admin_dashboard_retention(&registrations, &active_user_days, 102, 1);
+        let day7 = calculate_admin_dashboard_retention(&registrations, &active_user_days, 102, 7);
+
+        assert_eq!(day1.eligible_users, 3);
+        assert_eq!(day1.retained_users, 1);
+        assert_eq!(day1.rate_basis_points, 3_333);
+        assert_eq!(day7.eligible_users, 1);
+        assert_eq!(day7.retained_users, 1);
+        assert_eq!(day7.rate_basis_points, 10_000);
+    }
+
+    #[test]
+    fn retention_rate_is_zero_without_eligible_users_and_rounds_to_basis_points() {
+        assert_eq!(retention_rate_basis_points(0, 0), 0);
+        assert_eq!(retention_rate_basis_points(2, 3), 6_667);
+        assert_eq!(retention_rate_basis_points(4, 3), 10_000);
+    }
+
+    #[test]
+    fn new_user_payment_conversion_deduplicates_paid_users_through_query_time() {
+        let registrations = BTreeMap::from([
+            ("paid".to_string(), 100),
+            ("refunded-with-paid-at".to_string(), 100),
+            ("pending".to_string(), 100),
+            ("paid-late".to_string(), 200),
+        ]);
+        let mut conversion = AdminDashboardPaymentConversionAccumulator::new(&registrations, 500);
+
+        conversion.apply("paid", Some(99));
+        conversion.apply("paid", Some(150));
+        conversion.apply("paid", Some(160));
+        conversion.apply("refunded-with-paid-at", Some(180));
+        conversion.apply("pending", None);
+        conversion.apply("paid-late", Some(501));
+        conversion.apply("outside-cohort", Some(150));
+
+        let snapshot = conversion.snapshot();
+        assert_eq!(snapshot.paid_users, 2);
+        assert_eq!(snapshot.new_registered_users, 4);
+        assert_eq!(snapshot.rate_basis_points, 5_000);
+    }
+
+    #[test]
+    fn new_user_payment_conversion_rate_is_zero_without_new_users_and_rounds() {
+        assert_eq!(payment_conversion_rate_basis_points(0, 0), 0);
+        assert_eq!(payment_conversion_rate_basis_points(2, 3), 6_667);
+        assert_eq!(payment_conversion_rate_basis_points(4, 3), 10_000);
+    }
+
+    #[test]
+    fn daily_visit_users_are_deduplicated_per_day_without_cross_day_collapsing() {
+        let counts = daily_unique_counts(BTreeMap::from([
+            (
+                100,
+                BTreeSet::from(["user-a".to_string(), "user-b".to_string()]),
+            ),
+            (101, BTreeSet::from(["user-a".to_string()])),
+        ]));
+
+        assert_eq!(counts.len(), 2);
+        assert_eq!(counts[0].day_key, 100);
+        assert_eq!(counts[0].count, 2);
+        assert_eq!(counts[1].day_key, 101);
+        assert_eq!(counts[1].count, 1);
+    }
+
+    #[test]
+    fn dashboard_tracking_aggregation_stays_exact_past_legacy_row_limit() {
+        let registrations = BTreeMap::new();
+        let mut daily = AdminDashboardDailyStatsAccumulator::new(100, 100, &registrations);
+        let mut events = AdminDashboardEventAccumulator::new(100, 100, 1_000_000);
+
+        for index in 0..50_001 {
+            daily.apply(RuntimeTrackingScopeKind::Site, "site", 100, 1);
+            daily.apply(
+                RuntimeTrackingScopeKind::User,
+                &format!("user-{index}"),
+                100,
+                1,
+            );
+            events.apply(Some("current-user"), Some("profile"), 100, 999_999);
+        }
+
+        assert_eq!(daily.total_visit_count, 50_001);
+        assert_eq!(daily.total_visit_users.len(), 50_001);
+        assert_eq!(daily.period_visit_users.len(), 50_001);
+        assert_eq!(daily.visit_count[&100], 50_001);
+        assert_eq!(events.module_visit_breakdown["profile"], 50_001);
+        assert_eq!(events.current_users.len(), 1);
+    }
+
+    #[test]
+    fn dashboard_stats_input_rejects_future_and_oversized_ranges() {
+        const DAY_MICROS: i64 = 86_400_000_000;
+        let now_micros = 200 * DAY_MICROS;
+        let future = validate_admin_dashboard_stats_input(&AdminDashboardStatsInput {
+            start_day_key: 200,
+            end_day_key: 201,
+            now_micros,
+        });
+        let oversized = validate_admin_dashboard_stats_input(&AdminDashboardStatsInput {
+            start_day_key: 1,
+            end_day_key: 367,
+            now_micros: 500 * DAY_MICROS,
+        });
+
+        assert!(future.is_err());
+        assert!(oversized.is_err());
+    }
+}
diff --git a/server-rs/crates/spacetime-module/src/asset_metadata/objects.rs b/server-rs/crates/spacetime-module/src/asset_metadata/objects.rs
index f5c14f6e2..e4fae51d8 100644
--- a/server-rs/crates/spacetime-module/src/asset_metadata/objects.rs
+++ b/server-rs/crates/spacetime-module/src/asset_metadata/objects.rs
@@ -136,6 +136,10 @@ pub fn get_asset_read_access_by_location_and_return(
         let record = find_asset_object_by_location(tx, &input)?;
         let public_work_granted = record.as_ref().is_some_and(|asset_object| {
             crate::public_asset_access::asset_object_has_public_work_read_grant(tx, asset_object)
+                || crate::editor_project_storage::asset_object_has_public_showcase_read_grant(
+                    tx,
+                    asset_object,
+                )
         });
         Ok((record, public_work_granted))
     }) {
diff --git a/server-rs/crates/spacetime-module/src/editor_project_storage.rs b/server-rs/crates/spacetime-module/src/editor_project_storage.rs
index d54fde3af..70cfc7cea 100644
--- a/server-rs/crates/spacetime-module/src/editor_project_storage.rs
+++ b/server-rs/crates/spacetime-module/src/editor_project_storage.rs
@@ -17,6 +17,8 @@ const EDITOR_GENERATION_PRICING_CONFIG_ID: &str = "global";
 const EDITOR_SHOWCASE_CATEGORIES: [&str; 4] = ["characters", "ui", "music", "marketing"];
 const EDITOR_GENERATION_PRICING_UNIT_PER_GENERATION: &str = "perGeneration";
 const EDITOR_GENERATION_PRICING_UNIT_PER_SECOND: &str = "perSecond";
+const EDITOR_LEGACY_GREEN_SCREEN_SOURCE_ASSET_KIND: &str = "editor_green_screen_source";
+const EDITOR_MANUAL_ATLAS_SPLIT_TASK_PREFIX: &str = "editor-atlas-split-";
 const EDITOR_GENERATION_IMAGE_MODEL_NANOBANANA2: &str = "gemini-3.1-flash-image-preview";
 const EDITOR_GENERATION_IMAGE_MODEL_GPT_IMAGE_2: &str = "gpt-image-2";
 const EDITOR_GENERATION_SOUND_EFFECT_MODEL: &str = "audio1.0";
@@ -165,6 +167,32 @@ pub struct EditorAsset {
     thumbnail_src: Option<String>,
     #[default(0u64)]
     generation_cost_mud_points: u64,
+    #[default(None::<String>)]
+    group_task_id: Option<String>,
+    #[default(None::<u32>)]
+    group_task_expected_asset_count: Option<u32>,
+}
+
+#[spacetimedb::table(accessor = editor_asset_group_source_provenance)]
+pub struct EditorAssetGroupSourceProvenance {
+    #[primary_key]
+    lookup_key: String,
+    owner_user_id: String,
+    asset_id: String,
+    task_id: String,
+    source_resource_id: String,
+    created_at: Timestamp,
+}
+
+#[spacetimedb::table(accessor = editor_asset_group_cohort)]
+pub struct EditorAssetGroupCohort {
+    #[primary_key]
+    cohort_id: String,
+    owner_user_id: String,
+    task_id: String,
+    group_task_id: String,
+    expected_asset_count: u32,
+    completed_at: Timestamp,
 }
 
 #[spacetimedb::table(
@@ -432,6 +460,7 @@ pub struct EditorAssetSnapshot {
     pub showcase_review_status: Option<String>,
     pub showcase_display_enabled: Option<bool>,
     pub showcase_like_count: Option<u64>,
+    pub group_task_id: Option<String>,
 }
 
 #[derive(Clone, Debug, PartialEq, Eq, SpacetimeType)]
@@ -468,6 +497,7 @@ pub struct AdminEditorAssetSnapshot {
     pub generation_cost_mud_points: u64,
     pub created_at_micros: i64,
     pub updated_at_micros: i64,
+    pub group_task_id: Option<String>,
 }
 
 #[derive(Clone, Debug, PartialEq, Eq, SpacetimeType)]
@@ -592,6 +622,26 @@ pub struct EditorAssetCreateInput {
     pub now_micros: i64,
     pub thumbnail_src: Option<String>,
     pub generation_cost_mud_points: u64,
+    pub group_task_id: Option<String>,
+    pub group_task_expected_asset_count: Option<u32>,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, SpacetimeType)]
+pub struct EditorAssetGroupSourceLookupInput {
+    pub owner_user_id: String,
+    pub source_resource_ids: Vec<String>,
+    pub asset_object_id: Option<String>,
+    pub object_key: Option<String>,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, SpacetimeType)]
+pub struct EditorAssetGroupCohortCompleteInput {
+    pub owner_user_id: String,
+    pub task_id: String,
+    pub group_task_id: String,
+    pub expected_asset_count: u32,
+    pub asset_ids: Vec<String>,
+    pub completed_at_micros: i64,
 }
 
 #[derive(Clone, Debug, PartialEq, Eq, SpacetimeType)]
@@ -1040,6 +1090,17 @@ pub fn admin_list_editor_assets_and_return(
     }
 }
 
+#[spacetimedb::procedure]
+pub fn find_editor_asset_group_source_and_return(
+    ctx: &mut ProcedureContext,
+    input: EditorAssetGroupSourceLookupInput,
+) -> EditorAssetProcedureResult {
+    match ctx.try_with_tx(|tx| find_editor_asset_group_source(tx, input.clone())) {
+        Ok(asset) => editor_asset_ok(asset),
+        Err(message) => editor_asset_error(message),
+    }
+}
+
 #[spacetimedb::procedure]
 pub fn create_editor_asset_folder_and_return(
     ctx: &mut ProcedureContext,
@@ -1084,6 +1145,17 @@ pub fn create_editor_asset_and_return(
     }
 }
 
+#[spacetimedb::procedure]
+pub fn complete_editor_asset_group_cohort_and_return(
+    ctx: &mut ProcedureContext,
+    input: EditorAssetGroupCohortCompleteInput,
+) -> EditorAssetProcedureResult {
+    match ctx.try_with_tx(|tx| complete_editor_asset_group_cohort(tx, input.clone())) {
+        Ok(asset) => editor_asset_ok(Some(asset)),
+        Err(message) => editor_asset_error(message),
+    }
+}
+
 #[spacetimedb::procedure]
 pub fn update_editor_asset_and_return(
     ctx: &mut ProcedureContext,
@@ -1155,7 +1227,10 @@ pub fn admin_review_editor_showcase_asset_and_return(
     ctx: &mut ProcedureContext,
     input: EditorShowcaseAssetAdminReviewInput,
 ) -> EditorShowcaseAssetProcedureResult {
-    match ctx.try_with_tx(|tx| admin_review_editor_showcase_asset(tx, input.clone())) {
+    match ctx.try_with_tx(|tx| {
+        let asset = admin_review_editor_showcase_asset(tx, input.clone())?;
+        refund_approved_editor_showcase_asset(tx, asset, input.updated_at_micros)
+    }) {
         Ok(asset) => editor_showcase_asset_ok(Some(asset)),
         Err(message) => editor_showcase_asset_error(message),
     }
@@ -1410,6 +1485,11 @@ fn delete_editor_project(
         .filter(&project_key)
         .map(|resource| resource.resource_id)
         .collect::<Vec<_>>();
+    persist_missing_editor_asset_group_task_ids(
+        ctx,
+        owner_user_id.as_str(),
+        resource_ids.as_slice(),
+    );
 
     for canvas_id in canvas_ids {
         ctx.db.editor_canvas().canvas_id().delete(&canvas_id);
@@ -1662,16 +1742,67 @@ fn admin_list_editor_assets(
     let cursor = parse_public_showcase_cursor(input.cursor.as_deref());
     let owner_user_id = normalize_optional(input.owner_user_id);
     let keyword = normalize_optional(input.keyword).map(|value| value.to_lowercase());
-    let mut assets = ctx
-        .db
-        .editor_asset()
+    let mut grouped = BTreeMap::<String, (Option<String>, Vec<EditorAsset>)>::new();
+    let mut task_id_aliases = BTreeMap::<String, String>::new();
+    let assets = select_admin_editor_asset_rows(
+        owner_user_id.as_deref(),
+        |owner_user_id| {
+            let owner_key = owner_user_id.to_string();
+            ctx.db
+                .editor_asset()
+                .by_editor_asset_owner_user_id()
+                .filter(&owner_key)
+                .filter(|asset| asset.source_type == "generated")
+                .collect::<Vec<_>>()
+        },
+        || {
+            ctx.db
+                .editor_asset()
+                .iter()
+                .filter(|asset| asset.source_type == "generated")
+                .collect::<Vec<_>>()
+        },
+    );
+    seed_admin_editor_asset_task_aliases(assets.iter(), &mut task_id_aliases);
+    let resolved_assets = assets
+        .into_iter()
+        .map(|asset| {
+            let group_task_id = admin_editor_asset_group_task_id(ctx, &asset, &mut task_id_aliases);
+            (asset, group_task_id)
+        })
+        .collect::<Vec<_>>();
+    let completed_cohort_ids = resolved_assets
         .iter()
-        .filter(|asset| {
-            let created_at_micros = asset.created_at.to_micros_since_unix_epoch();
-            asset.source_type == "generated"
-                && owner_user_id
-                    .as_ref()
-                    .is_none_or(|value| asset.owner_user_id == *value)
+        .filter_map(|(asset, _)| {
+            let task_id = normalize_optional(asset.task_id.clone())?;
+            let cohort_id = editor_asset_group_cohort_id(&asset.owner_user_id, &task_id);
+            ctx.db
+                .editor_asset_group_cohort()
+                .cohort_id()
+                .find(&cohort_id)
+                .map(|_| cohort_id)
+        })
+        .collect::<BTreeSet<_>>();
+    for (asset, group_task_id) in
+        bound_admin_editor_asset_groups(resolved_assets, &completed_cohort_ids)
+    {
+        let group_key = editor_asset_task_group_key_with_task_id(&asset, group_task_id.as_deref());
+        grouped
+            .entry(group_key)
+            .or_insert_with(|| (group_task_id, Vec::new()))
+            .1
+            .push(asset);
+    }
+
+    let mut groups = grouped
+        .into_values()
+        .filter_map(|(group_task_id, mut assets)| {
+            let primary_index = editor_asset_primary_index(&assets)?;
+            let primary = assets.get(primary_index)?;
+            let created_at_micros = primary.created_at.to_micros_since_unix_epoch();
+            let matches = owner_user_id
+                .as_ref()
+                .is_none_or(|value| primary.owner_user_id == *value)
                 && input
                     .created_after_micros
                     .is_none_or(|value| created_at_micros >= value)
@@ -1680,22 +1811,193 @@ fn admin_list_editor_assets(
                     .is_none_or(|value| created_at_micros <= value)
                 && is_after_public_showcase_cursor(
                     created_at_micros,
-                    asset.asset_id.as_str(),
+                    primary.asset_id.as_str(),
                     cursor.as_ref(),
                 )
-                && matches_admin_editor_asset_keyword(asset, keyword.as_deref())
+                && matches_admin_editor_asset_group_keyword(
+                    assets.as_slice(),
+                    group_task_id.as_deref(),
+                    keyword.as_deref(),
+                );
+            if !matches {
+                return None;
+            }
+            normalize_legacy_editor_source_costs(&mut assets);
+            let primary = assets.swap_remove(primary_index.min(assets.len().saturating_sub(1)));
+            assets.sort_by(|left, right| {
+                editor_asset_child_rank(left)
+                    .cmp(&editor_asset_child_rank(right))
+                    .then_with(|| left.created_at.cmp(&right.created_at))
+                    .then_with(|| left.asset_id.cmp(&right.asset_id))
+            });
+            let sort_key = (
+                primary.created_at.to_micros_since_unix_epoch(),
+                primary.asset_id.clone(),
+            );
+            let mut ordered = Vec::with_capacity(assets.len() + 1);
+            ordered.push(primary);
+            ordered.extend(assets);
+            Some((sort_key, group_task_id, ordered))
         })
-        .map(admin_asset_snapshot_from_row)
         .collect::<Vec<_>>();
 
-    assets.sort_by(|left, right| {
-        right
-            .created_at_micros
-            .cmp(&left.created_at_micros)
-            .then_with(|| right.asset_id.cmp(&left.asset_id))
-    });
-    assets.truncate(limit);
-    Ok(assets)
+    groups.sort_by(|left, right| right.0.cmp(&left.0));
+    groups.truncate(limit);
+    Ok(groups
+        .into_iter()
+        .flat_map(|(_, group_task_id, assets)| {
+            assets
+                .into_iter()
+                .map(move |row| admin_asset_snapshot_from_row(row, group_task_id.clone()))
+        })
+        .collect())
+}
+
+fn find_editor_asset_group_source(
+    ctx: &ReducerContext,
+    input: EditorAssetGroupSourceLookupInput,
+) -> Result<Option<EditorAssetSnapshot>, String> {
+    require_editor_generation_runtime_service_identity(ctx, ctx.sender())?;
+    let owner_user_id = normalize_required(&input.owner_user_id, "owner_user_id")?;
+    let source_resource_ids = input
+        .source_resource_ids
+        .into_iter()
+        .filter_map(|value| normalize_optional(Some(value)))
+        .collect::<BTreeSet<_>>();
+    let asset_object_id = normalize_optional(input.asset_object_id);
+    let object_key = normalize_optional(input.object_key);
+    let lookup_keys = editor_asset_group_source_lookup_keys(
+        owner_user_id.as_str(),
+        source_resource_ids.iter().map(String::as_str),
+        asset_object_id.as_deref(),
+        object_key.as_deref(),
+    );
+
+    for lookup_key in &lookup_keys {
+        let Some(provenance) = ctx
+            .db
+            .editor_asset_group_source_provenance()
+            .lookup_key()
+            .find(lookup_key)
+        else {
+            continue;
+        };
+        if provenance.owner_user_id != owner_user_id {
+            continue;
+        }
+        if let Some(asset) = ctx
+            .db
+            .editor_asset()
+            .asset_id()
+            .find(&provenance.asset_id)
+            .filter(|asset| editor_asset_is_trusted_group_source(asset, owner_user_id.as_str()))
+        {
+            return Ok(Some(asset_snapshot_from_row(ctx, asset)));
+        }
+    }
+
+    let owner_key = owner_user_id.clone();
+    let asset = ctx
+        .db
+        .editor_asset()
+        .by_editor_asset_owner_user_id()
+        .filter(&owner_key)
+        .find(|asset| {
+            editor_asset_is_trusted_group_source(asset, owner_user_id.as_str())
+                && (asset
+                    .source_resource_id
+                    .as_ref()
+                    .is_some_and(|value| source_resource_ids.contains(value))
+                    || asset_object_id
+                        .as_ref()
+                        .is_some_and(|value| asset.asset_object_id.as_ref() == Some(value))
+                    || object_key
+                        .as_ref()
+                        .is_some_and(|value| asset.object_key.as_ref() == Some(value)))
+        });
+    if let Some(asset) = asset {
+        register_editor_asset_group_source_provenance(ctx, &asset);
+        return Ok(Some(asset_snapshot_from_row(ctx, asset)));
+    }
+    Ok(None)
+}
+
+fn complete_editor_asset_group_cohort(
+    ctx: &ReducerContext,
+    input: EditorAssetGroupCohortCompleteInput,
+) -> Result<EditorAssetSnapshot, String> {
+    require_editor_generation_runtime_service_identity(ctx, ctx.sender())?;
+    let owner_user_id = normalize_required(&input.owner_user_id, "owner_user_id")?;
+    let task_id = normalize_required(&input.task_id, "task_id")?;
+    let group_task_id = normalize_required(&input.group_task_id, "group_task_id")?;
+    if input.expected_asset_count == 0
+        || input.asset_ids.len() != input.expected_asset_count as usize
+    {
+        return Err("素材拆分批次产物数量与预期不一致".to_string());
+    }
+    let asset_ids = input.asset_ids.into_iter().collect::<BTreeSet<_>>();
+    if asset_ids.len() != input.expected_asset_count as usize {
+        return Err("素材拆分批次包含重复产物".to_string());
+    }
+    let mut assets = Vec::with_capacity(asset_ids.len());
+    for asset_id in asset_ids {
+        let asset = ctx
+            .db
+            .editor_asset()
+            .asset_id()
+            .find(&asset_id)
+            .ok_or_else(|| "素材拆分批次产物不存在".to_string())?;
+        if asset.owner_user_id != owner_user_id
+            || normalize_optional(asset.task_id.clone()).as_deref() != Some(task_id.as_str())
+            || normalize_optional(asset.group_task_id.clone()).as_deref()
+                != Some(group_task_id.as_str())
+            || asset.group_task_expected_asset_count != Some(input.expected_asset_count)
+        {
+            return Err("素材拆分批次产物归组信息不一致".to_string());
+        }
+        assets.push(asset);
+    }
+
+    let cohort_id = editor_asset_group_cohort_id(owner_user_id.as_str(), task_id.as_str());
+    if let Some(existing) = ctx
+        .db
+        .editor_asset_group_cohort()
+        .cohort_id()
+        .find(&cohort_id)
+    {
+        if existing.group_task_id != group_task_id
+            || existing.expected_asset_count != input.expected_asset_count
+        {
+            return Err("素材拆分批次完成事实冲突".to_string());
+        }
+    } else {
+        ctx.db
+            .editor_asset_group_cohort()
+            .insert(EditorAssetGroupCohort {
+                cohort_id,
+                owner_user_id,
+                task_id,
+                group_task_id,
+                expected_asset_count: input.expected_asset_count,
+                completed_at: Timestamp::from_micros_since_unix_epoch(input.completed_at_micros),
+            });
+    }
+    let asset = assets
+        .into_iter()
+        .next()
+        .ok_or_else(|| "素材拆分批次没有产物".to_string())?;
+    Ok(asset_snapshot_from_row(ctx, asset))
+}
+
+fn select_admin_editor_asset_rows<T>(
+    owner_user_id: Option<&str>,
+    by_owner: impl FnOnce(&str) -> Vec<T>,
+    all_rows: impl FnOnce() -> Vec<T>,
+) -> Vec<T> {
+    match owner_user_id {
+        Some(owner_user_id) => by_owner(owner_user_id),
+        None => all_rows(),
+    }
 }
 
 fn create_editor_asset_folder(
@@ -1818,6 +2120,19 @@ fn create_editor_asset(
     let now = Timestamp::from_micros_since_unix_epoch(input.now_micros);
     ensure_default_asset_folder(ctx, owner_user_id.as_str(), now)?;
     require_owned_asset_folder(ctx, folder_id.as_str(), owner_user_id.as_str())?;
+    let task_id = normalize_optional(input.task_id);
+    let source_resource_id = normalize_optional(input.source_resource_id);
+    let group_task_id = normalize_optional(input.group_task_id);
+    let group_task_expected_asset_count = input.group_task_expected_asset_count;
+    if group_task_expected_asset_count == Some(0) {
+        return Err("素材任务预期产物数量必须大于 0".to_string());
+    }
+    if group_task_id.is_none() && group_task_expected_asset_count.is_some() {
+        return Err("素材任务预期产物数量必须与归组 Task ID 一起提供".to_string());
+    }
+    if group_task_id.is_some() {
+        require_editor_generation_runtime_service_identity(ctx, ctx.sender())?;
+    }
     ctx.db.editor_asset().insert(EditorAsset {
         asset_id: asset_id.clone(),
         owner_user_id,
@@ -1833,21 +2148,25 @@ fn create_editor_asset(
         actual_prompt: normalize_optional(input.actual_prompt),
         model: normalize_optional(input.model),
         provider: normalize_optional(input.provider),
-        task_id: normalize_optional(input.task_id),
+        task_id,
         created_at: now,
         updated_at: now,
         asset_kind: normalize_optional(input.asset_kind),
         generation_inputs_json: normalize_optional(input.generation_inputs_json),
-        source_resource_id: normalize_optional(input.source_resource_id),
+        source_resource_id,
         thumbnail_src: normalize_optional(input.thumbnail_src),
         generation_cost_mud_points: input.generation_cost_mud_points,
+        group_task_id,
+        group_task_expected_asset_count,
     });
-    ctx.db
+    let asset = ctx
+        .db
         .editor_asset()
         .asset_id()
         .find(&asset_id)
-        .map(|asset| asset_snapshot_from_row(ctx, asset))
-        .ok_or_else(|| "素材创建失败".to_string())
+        .ok_or_else(|| "素材创建失败".to_string())?;
+    register_editor_asset_group_source_provenance(ctx, &asset);
+    Ok(asset_snapshot_from_row(ctx, asset))
 }
 
 fn update_editor_asset(
@@ -1891,6 +2210,8 @@ fn update_editor_asset(
         source_resource_id: asset.source_resource_id,
         thumbnail_src: asset.thumbnail_src,
         generation_cost_mud_points: asset.generation_cost_mud_points,
+        group_task_id: asset.group_task_id,
+        group_task_expected_asset_count: asset.group_task_expected_asset_count,
     });
     ctx.db
         .editor_asset()
@@ -1937,6 +2258,8 @@ fn repair_editor_asset_media(
         source_resource_id: asset.source_resource_id,
         thumbnail_src: asset.thumbnail_src,
         generation_cost_mud_points: asset.generation_cost_mud_points,
+        group_task_id: asset.group_task_id,
+        group_task_expected_asset_count: asset.group_task_expected_asset_count,
     });
 
     ctx.db
@@ -2100,6 +2423,45 @@ fn list_public_editor_showcase_assets(
     Ok(assets)
 }
 
+pub(crate) fn asset_object_has_public_showcase_read_grant(
+    ctx: &ReducerContext,
+    asset_object: &module_assets::AssetObjectUpsertSnapshot,
+) -> bool {
+    let asset_object = module_assets::build_asset_object_record(asset_object.clone());
+    let Some(owner_user_id) = asset_object
+        .owner_user_id
+        .as_deref()
+        .map(str::trim)
+        .filter(|value| !value.is_empty())
+    else {
+        return false;
+    };
+
+    ctx.db
+        .editor_showcase_asset()
+        .by_editor_showcase_asset_owner_user_id()
+        .filter(owner_user_id)
+        .filter(is_public_showcase_asset)
+        .any(|asset| {
+            module_assets::asset_object_matches_public_read_grant(
+                &asset_object,
+                &module_assets::PublicAssetReadGrant {
+                    owner_user_id: asset.owner_user_id,
+                    asset_object_id: asset.asset_object_id,
+                    object_key: asset.object_key,
+                },
+            )
+        })
+}
+
+fn is_public_showcase_asset(asset: &EditorShowcaseAsset) -> bool {
+    asset.review_status == EDITOR_SHOWCASE_STATUS_APPROVED
+        && asset.display_enabled
+        && !asset.asset_deleted_while_pending
+        && (asset.refund_mud_points == 0 || asset.refund_completed_at.is_some())
+        && !asset.image_src.trim().is_empty()
+}
+
 fn admin_list_editor_showcase_assets(
     ctx: &ReducerContext,
     input: EditorShowcaseAssetAdminListInput,
@@ -2205,6 +2567,48 @@ fn admin_review_editor_showcase_asset(
         .ok_or_else(|| "精选审核记录更新失败".to_string())
 }
 
+fn refund_approved_editor_showcase_asset(
+    ctx: &ReducerContext,
+    asset: EditorShowcaseAssetSnapshot,
+    updated_at_micros: i64,
+) -> Result<EditorShowcaseAssetSnapshot, String> {
+    if asset.review_status != EDITOR_SHOWCASE_STATUS_APPROVED
+        || asset.refund_mud_points == 0
+        || asset.refund_completed_at_micros.is_some()
+    {
+        return Ok(asset);
+    }
+    let refund_ledger_id = asset
+        .refund_ledger_id
+        .clone()
+        .ok_or_else(|| "精选返还流水缺失".to_string())?;
+    let refunded_at = Timestamp::from_micros_since_unix_epoch(updated_at_micros);
+    let metadata_json = serde_json::json!({
+        "source": "editor_showcase_approval",
+        "showcaseId": asset.showcase_id.as_str(),
+        "assetId": asset.asset_id.as_str(),
+        "generationCostMudPoints": asset.generation_cost_mud_points,
+    })
+    .to_string();
+    crate::runtime::grant_profile_wallet_points_with_metadata(
+        ctx,
+        asset.owner_user_id.as_str(),
+        asset.refund_mud_points,
+        RuntimeProfileWalletLedgerSourceType::AssetOperationRefund,
+        refund_ledger_id.as_str(),
+        refunded_at,
+        metadata_json.as_str(),
+    )?;
+    mark_editor_showcase_asset_refunded(
+        ctx,
+        EditorShowcaseAssetRefundMarkInput {
+            showcase_id: asset.showcase_id,
+            refund_ledger_id,
+            updated_at_micros,
+        },
+    )
+}
+
 fn update_editor_showcase_asset_display(
     ctx: &ReducerContext,
     input: EditorShowcaseAssetDisplayUpdateInput,
@@ -2891,11 +3295,15 @@ fn build_asset_library_snapshot(
             .then_with(|| left.created_at_micros.cmp(&right.created_at_micros))
             .then_with(|| left.folder_id.cmp(&right.folder_id))
     });
-    let mut assets = ctx
+    let mut asset_rows = ctx
         .db
         .editor_asset()
         .by_editor_asset_owner_user_id()
         .filter(&owner_key)
+        .collect::<Vec<_>>();
+    normalize_legacy_editor_source_costs_across_groups(&mut asset_rows);
+    let mut assets = asset_rows
+        .into_iter()
         .map(|asset| asset_snapshot_from_row(ctx, asset))
         .collect::<Vec<_>>();
     assets.sort_by(|left, right| {
@@ -2906,6 +3314,478 @@ fn build_asset_library_snapshot(
     Ok(EditorAssetLibrarySnapshot { folders, assets })
 }
 
+fn editor_asset_task_group_key(asset: &EditorAsset) -> String {
+    editor_asset_task_group_key_with_task_id(asset, asset.task_id.as_deref())
+}
+
+fn editor_asset_task_group_key_with_task_id(asset: &EditorAsset, task_id: Option<&str>) -> String {
+    task_id
+        .map(str::trim)
+        .filter(|value| !value.is_empty())
+        .map(|value| format!("owner:{}:task:{value}", asset.owner_user_id))
+        .unwrap_or_else(|| format!("asset:{}", asset.asset_id))
+}
+
+fn admin_editor_asset_group_task_id(
+    ctx: &ReducerContext,
+    asset: &EditorAsset,
+    task_id_aliases: &mut BTreeMap<String, String>,
+) -> Option<String> {
+    admin_editor_asset_group_task_id_with(asset, task_id_aliases, |asset, split_task_id| {
+        admin_editor_asset_source_task_id(ctx, asset, split_task_id)
+    })
+}
+
+fn seed_admin_editor_asset_task_aliases<'a>(
+    assets: impl IntoIterator<Item = &'a EditorAsset>,
+    task_id_aliases: &mut BTreeMap<String, String>,
+) {
+    for asset in assets {
+        let Some(task_id) = normalize_optional(asset.task_id.clone()) else {
+            continue;
+        };
+        if !task_id.starts_with(EDITOR_MANUAL_ATLAS_SPLIT_TASK_PREFIX) {
+            continue;
+        }
+        let Some(group_task_id) = normalize_optional(asset.group_task_id.clone()) else {
+            continue;
+        };
+        task_id_aliases
+            .entry(format!("{}:{task_id}", asset.owner_user_id))
+            .and_modify(|current| {
+                if group_task_id < *current {
+                    *current = group_task_id.clone();
+                }
+            })
+            .or_insert(group_task_id);
+    }
+}
+
+fn admin_editor_asset_group_task_id_with(
+    asset: &EditorAsset,
+    task_id_aliases: &mut BTreeMap<String, String>,
+    resolve_source_task_id: impl FnOnce(&EditorAsset, &str) -> Option<String>,
+) -> Option<String> {
+    let task_id = normalize_optional(asset.task_id.clone());
+    if let Some(group_task_id) = normalize_optional(asset.group_task_id.clone()) {
+        if let Some(task_id) = task_id
+            .as_deref()
+            .filter(|task_id| task_id.starts_with(EDITOR_MANUAL_ATLAS_SPLIT_TASK_PREFIX))
+        {
+            task_id_aliases
+                .entry(format!("{}:{task_id}", asset.owner_user_id))
+                .or_insert_with(|| group_task_id.clone());
+        }
+        return Some(group_task_id);
+    }
+
+    let task_id = task_id?;
+    if !task_id.starts_with(EDITOR_MANUAL_ATLAS_SPLIT_TASK_PREFIX) {
+        return Some(task_id);
+    }
+
+    let alias_key = format!("{}:{task_id}", asset.owner_user_id);
+    if let Some(task_id) = task_id_aliases.get(&alias_key) {
+        return Some(task_id.clone());
+    }
+    let group_task_id =
+        resolve_source_task_id(asset, task_id.as_str()).unwrap_or_else(|| task_id.clone());
+    task_id_aliases.insert(alias_key, group_task_id.clone());
+    Some(group_task_id)
+}
+
+fn bound_admin_editor_asset_groups(
+    assets: Vec<(EditorAsset, Option<String>)>,
+    completed_cohort_ids: &BTreeSet<String>,
+) -> Vec<(EditorAsset, Option<String>)> {
+    let mut split_cohorts = BTreeMap::<(String, String), (usize, Option<u32>, bool, bool)>::new();
+    for (asset, _) in &assets {
+        let Some(task_id) = normalize_optional(asset.task_id.clone()) else {
+            continue;
+        };
+        if !task_id.starts_with(EDITOR_MANUAL_ATLAS_SPLIT_TASK_PREFIX) {
+            continue;
+        }
+        let cohort = split_cohorts
+            .entry((asset.owner_user_id.clone(), task_id))
+            .or_insert((0, None, false, true));
+        cohort.0 += 1;
+        match asset.group_task_expected_asset_count {
+            Some(expected_count) => {
+                if cohort.1.is_some_and(|current| current != expected_count) {
+                    cohort.3 = false;
+                } else {
+                    cohort.1 = Some(expected_count);
+                }
+            }
+            None => cohort.2 = true,
+        }
+    }
+
+    let mut root_split_tasks = BTreeMap::<(String, String), (u8, i64, String)>::new();
+    for (asset, group_task_id) in &assets {
+        let Some(task_id) = normalize_optional(asset.task_id.clone()) else {
+            continue;
+        };
+        let Some(group_task_id) = group_task_id.as_deref() else {
+            continue;
+        };
+        if !task_id.starts_with(EDITOR_MANUAL_ATLAS_SPLIT_TASK_PREFIX) || task_id == group_task_id {
+            continue;
+        }
+        let cohort_complete = split_cohorts
+            .get(&(asset.owner_user_id.clone(), task_id.clone()))
+            .is_none_or(
+                |(_actual_count, expected_count, has_missing_count, consistent)| {
+                    expected_count.is_none_or(|_| {
+                        *consistent
+                            && !*has_missing_count
+                            && completed_cohort_ids.contains(&editor_asset_group_cohort_id(
+                                asset.owner_user_id.as_str(),
+                                task_id.as_str(),
+                            ))
+                    })
+                },
+            );
+        if !cohort_complete {
+            continue;
+        }
+        let persisted_priority =
+            if normalize_optional(asset.group_task_id.clone()).as_deref() == Some(group_task_id) {
+                0
+            } else {
+                1
+            };
+        let candidate = (
+            persisted_priority,
+            asset.created_at.to_micros_since_unix_epoch(),
+            task_id,
+        );
+        root_split_tasks
+            .entry((asset.owner_user_id.clone(), group_task_id.to_string()))
+            .and_modify(|current| {
+                if candidate < *current {
+                    *current = candidate.clone();
+                }
+            })
+            .or_insert(candidate);
+    }
+
+    assets
+        .into_iter()
+        .map(|(asset, group_task_id)| {
+            let task_id = normalize_optional(asset.task_id.clone());
+            let bounded_group_task_id = match (task_id.as_deref(), group_task_id.as_deref()) {
+                (Some(task_id), Some(group_task_id))
+                    if task_id.starts_with(EDITOR_MANUAL_ATLAS_SPLIT_TASK_PREFIX)
+                        && task_id != group_task_id =>
+                {
+                    let root_split_task_id = root_split_tasks
+                        .get(&(asset.owner_user_id.clone(), group_task_id.to_string()))
+                        .map(|(_, _, task_id)| task_id.as_str());
+                    if root_split_task_id == Some(task_id) {
+                        group_task_id.to_string()
+                    } else {
+                        task_id.to_string()
+                    }
+                }
+                _ => return (asset, group_task_id),
+            };
+            (asset, Some(bounded_group_task_id))
+        })
+        .collect()
+}
+
+fn editor_asset_group_cohort_id(owner_user_id: &str, task_id: &str) -> String {
+    format!("{owner_user_id}:{task_id}")
+}
+
+fn editor_asset_is_trusted_group_source(asset: &EditorAsset, owner_user_id: &str) -> bool {
+    asset.owner_user_id == owner_user_id
+        && asset.source_type == "generated"
+        && asset.asset_kind.as_deref() == Some("icon-spritesheet")
+        && normalize_optional(asset.source_resource_id.clone()).is_some()
+        && normalize_optional(asset.task_id.clone()).is_some()
+}
+
+fn editor_asset_group_source_lookup_keys<'a>(
+    owner_user_id: &str,
+    source_resource_ids: impl IntoIterator<Item = &'a str>,
+    asset_object_id: Option<&str>,
+    object_key: Option<&str>,
+) -> Vec<String> {
+    let mut keys = source_resource_ids
+        .into_iter()
+        .filter_map(|value| normalize_optional(Some(value.to_string())))
+        .map(|value| format!("{owner_user_id}:resource:{value}"))
+        .collect::<BTreeSet<_>>();
+    if let Some(asset_object_id) =
+        asset_object_id.and_then(|value| normalize_optional(Some(value.to_string())))
+    {
+        keys.insert(format!("{owner_user_id}:asset-object:{asset_object_id}"));
+    }
+    if let Some(object_key) =
+        object_key.and_then(|value| normalize_optional(Some(value.to_string())))
+    {
+        keys.insert(format!("{owner_user_id}:object-key:{object_key}"));
+    }
+    keys.into_iter().collect()
+}
+
+fn register_editor_asset_group_source_provenance(ctx: &ReducerContext, asset: &EditorAsset) {
+    if !editor_asset_is_trusted_group_source(asset, asset.owner_user_id.as_str()) {
+        return;
+    }
+    let Some(task_id) = normalize_optional(asset.task_id.clone()) else {
+        return;
+    };
+    let Some(source_resource_id) = normalize_optional(asset.source_resource_id.clone()) else {
+        return;
+    };
+    let lookup_keys = editor_asset_group_source_lookup_keys(
+        asset.owner_user_id.as_str(),
+        std::iter::once(source_resource_id.as_str()),
+        asset.asset_object_id.as_deref(),
+        asset.object_key.as_deref(),
+    );
+    for lookup_key in lookup_keys {
+        if ctx
+            .db
+            .editor_asset_group_source_provenance()
+            .lookup_key()
+            .find(&lookup_key)
+            .is_some()
+        {
+            continue;
+        }
+        ctx.db
+            .editor_asset_group_source_provenance()
+            .insert(EditorAssetGroupSourceProvenance {
+                lookup_key,
+                owner_user_id: asset.owner_user_id.clone(),
+                asset_id: asset.asset_id.clone(),
+                task_id: task_id.clone(),
+                source_resource_id: source_resource_id.clone(),
+                created_at: asset.created_at,
+            });
+    }
+}
+
+fn persist_missing_editor_asset_group_task_ids(
+    ctx: &ReducerContext,
+    owner_user_id: &str,
+    deleting_resource_ids: &[String],
+) {
+    if deleting_resource_ids.is_empty() {
+        return;
+    }
+    let deleting_resource_ids = deleting_resource_ids.iter().collect::<BTreeSet<_>>();
+    let owner_key = owner_user_id.to_string();
+    let assets = ctx
+        .db
+        .editor_asset()
+        .by_editor_asset_owner_user_id()
+        .filter(&owner_key)
+        .filter(|asset| {
+            asset.source_type == "generated"
+                && normalize_optional(asset.group_task_id.clone()).is_none()
+                && asset.task_id.as_deref().is_some_and(|task_id| {
+                    task_id.starts_with(EDITOR_MANUAL_ATLAS_SPLIT_TASK_PREFIX)
+                })
+                && asset
+                    .source_resource_id
+                    .as_ref()
+                    .is_some_and(|resource_id| deleting_resource_ids.contains(resource_id))
+        })
+        .collect::<Vec<_>>();
+
+    for mut asset in assets {
+        let Some(task_id) = normalize_optional(asset.task_id.clone()) else {
+            continue;
+        };
+        asset.group_task_id = admin_editor_asset_source_task_id(ctx, &asset, task_id.as_str())
+            .or_else(|| Some(task_id));
+        ctx.db.editor_asset().asset_id().update(asset);
+    }
+}
+
+fn admin_editor_asset_source_task_id(
+    ctx: &ReducerContext,
+    asset: &EditorAsset,
+    split_task_id: &str,
+) -> Option<String> {
+    admin_editor_asset_source_task_id_with(asset, split_task_id, |resource_id| {
+        ctx.db
+            .editor_project_resource()
+            .resource_id()
+            .find(resource_id)
+    })
+}
+
+fn admin_editor_asset_source_task_id_with(
+    asset: &EditorAsset,
+    split_task_id: &str,
+    mut find_resource: impl FnMut(&String) -> Option<EditorProjectResource>,
+) -> Option<String> {
+    let mut resource_id = normalize_optional(asset.source_resource_id.clone())?;
+    let mut visited_resource_ids = BTreeSet::new();
+    for _ in 0..4 {
+        if !visited_resource_ids.insert(resource_id.clone()) {
+            return None;
+        }
+        let resource = find_resource(&resource_id)?;
+        if resource.owner_user_id != asset.owner_user_id {
+            return None;
+        }
+        if let Some(task_id) = normalize_optional(resource.task_id.clone())
+            && task_id != split_task_id
+            && !task_id.starts_with(EDITOR_MANUAL_ATLAS_SPLIT_TASK_PREFIX)
+        {
+            return Some(task_id);
+        }
+        resource_id = normalize_optional(resource.source_resource_id)?;
+    }
+    None
+}
+
+fn editor_asset_is_provider_source(asset: &EditorAsset) -> bool {
+    asset.asset_kind.as_deref() == Some(EDITOR_LEGACY_GREEN_SCREEN_SOURCE_ASSET_KIND)
+        || asset
+            .object_key
+            .as_deref()
+            .is_some_and(editor_object_key_is_provider_source)
+}
+
+fn editor_object_key_is_provider_source(object_key: &str) -> bool {
+    let object_key = object_key.trim().to_ascii_lowercase();
+    object_key.contains("green-screen-source")
+        || object_key.contains("provider-source")
+        || object_key.contains("/animation/editor-character-animation/")
+}
+
+fn editor_asset_primary_rank(asset: &EditorAsset) -> u8 {
+    if editor_asset_is_provider_source(asset) {
+        return 0;
+    }
+    let object_key = asset
+        .object_key
+        .as_deref()
+        .unwrap_or_default()
+        .to_ascii_lowercase();
+    if object_key.contains("/icon-spritesheet-assets/") || object_key.contains("/ui-design-assets/")
+    {
+        return 1;
+    }
+    if asset.asset_kind.as_deref() == Some("icon-spritesheet") {
+        return 4;
+    }
+    3
+}
+
+fn editor_asset_primary_index(assets: &[EditorAsset]) -> Option<usize> {
+    assets
+        .iter()
+        .enumerate()
+        .max_by(|(_, left), (_, right)| {
+            editor_asset_primary_rank(left)
+                .cmp(&editor_asset_primary_rank(right))
+                .then_with(|| left.created_at.cmp(&right.created_at))
+                .then_with(|| left.asset_id.cmp(&right.asset_id))
+        })
+        .map(|(index, _)| index)
+}
+
+fn editor_asset_child_rank(asset: &EditorAsset) -> u8 {
+    if editor_asset_is_provider_source(asset) {
+        0
+    } else {
+        1
+    }
+}
+
+fn normalize_legacy_editor_source_costs(assets: &mut [EditorAsset]) {
+    let has_legacy_source = assets.iter().any(|asset| {
+        asset.asset_kind.as_deref() == Some(EDITOR_LEGACY_GREEN_SCREEN_SOURCE_ASSET_KIND)
+    });
+    let task_cost = assets
+        .iter()
+        .map(|asset| asset.generation_cost_mud_points)
+        .max()
+        .unwrap_or_default();
+    for asset in assets {
+        let is_legacy_source =
+            asset.asset_kind.as_deref() == Some(EDITOR_LEGACY_GREEN_SCREEN_SOURCE_ASSET_KIND);
+        if is_legacy_source {
+            asset.asset_kind = normalize_legacy_editor_source_asset_kind(
+                asset.asset_kind.take(),
+                asset.object_key.as_deref(),
+            );
+            asset.generation_cost_mud_points = task_cost;
+        } else if has_legacy_source && asset.generation_cost_mud_points > 0 {
+            asset.generation_cost_mud_points = 0;
+        }
+    }
+}
+
+fn normalize_legacy_editor_source_costs_across_groups(assets: &mut [EditorAsset]) {
+    let mut task_indexes = BTreeMap::<String, Vec<usize>>::new();
+    for (index, asset) in assets.iter().enumerate() {
+        task_indexes
+            .entry(editor_asset_task_group_key(asset))
+            .or_default()
+            .push(index);
+    }
+    for indexes in task_indexes.into_values() {
+        let has_legacy_source = indexes.iter().any(|index| {
+            assets.get(*index).is_some_and(|asset| {
+                asset.asset_kind.as_deref() == Some(EDITOR_LEGACY_GREEN_SCREEN_SOURCE_ASSET_KIND)
+            })
+        });
+        if !has_legacy_source {
+            continue;
+        }
+        let task_cost = indexes
+            .iter()
+            .filter_map(|index| assets.get(*index))
+            .map(|asset| asset.generation_cost_mud_points)
+            .max()
+            .unwrap_or_default();
+        for index in indexes {
+            let asset = &mut assets[index];
+            if asset.asset_kind.as_deref() == Some(EDITOR_LEGACY_GREEN_SCREEN_SOURCE_ASSET_KIND) {
+                asset.asset_kind = normalize_legacy_editor_source_asset_kind(
+                    asset.asset_kind.take(),
+                    asset.object_key.as_deref(),
+                );
+                asset.generation_cost_mud_points = task_cost;
+            } else if asset.generation_cost_mud_points > 0 {
+                asset.generation_cost_mud_points = 0;
+            }
+        }
+    }
+}
+
+fn normalize_legacy_editor_source_asset_kind(
+    asset_kind: Option<String>,
+    object_key: Option<&str>,
+) -> Option<String> {
+    if asset_kind.as_deref() != Some(EDITOR_LEGACY_GREEN_SCREEN_SOURCE_ASSET_KIND) {
+        return asset_kind;
+    }
+    let object_key = object_key.unwrap_or_default().to_ascii_lowercase();
+    if object_key.contains("/character-images/") {
+        return Some("character".to_string());
+    }
+    if object_key.contains("/icon-spritesheets/") || object_key.contains("/ui-design-spritesheets/")
+    {
+        return Some("icon-spritesheet".to_string());
+    }
+    if object_key.contains("/animation/editor-character-animation/") {
+        return Some("character-animation".to_string());
+    }
+    None
+}
+
 fn find_showcase_asset_for_asset(
     ctx: &ReducerContext,
     asset_id: &str,
@@ -3352,10 +4232,14 @@ fn asset_snapshot_from_row(ctx: &ReducerContext, row: EditorAsset) -> EditorAsse
             .map(|asset| asset.review_status.clone()),
         showcase_display_enabled: showcase_asset.as_ref().map(|asset| asset.display_enabled),
         showcase_like_count: showcase_asset.as_ref().map(|asset| asset.like_count),
+        group_task_id: row.group_task_id,
     }
 }
 
-fn admin_asset_snapshot_from_row(row: EditorAsset) -> AdminEditorAssetSnapshot {
+fn admin_asset_snapshot_from_row(
+    row: EditorAsset,
+    group_task_id: Option<String>,
+) -> AdminEditorAssetSnapshot {
     AdminEditorAssetSnapshot {
         asset_id: row.asset_id,
         owner_user_id: row.owner_user_id,
@@ -3379,6 +4263,7 @@ fn admin_asset_snapshot_from_row(row: EditorAsset) -> AdminEditorAssetSnapshot {
         generation_cost_mud_points: row.generation_cost_mud_points,
         created_at_micros: row.created_at.to_micros_since_unix_epoch(),
         updated_at_micros: row.updated_at.to_micros_since_unix_epoch(),
+        group_task_id,
     }
 }
 
@@ -3404,12 +4289,27 @@ fn matches_admin_editor_asset_keyword(asset: &EditorAsset, keyword: Option<&str>
         asset.generation_inputs_json.as_deref().unwrap_or_default(),
         asset.source_resource_id.as_deref().unwrap_or_default(),
         asset.thumbnail_src.as_deref().unwrap_or_default(),
+        asset.group_task_id.as_deref().unwrap_or_default(),
     ]
     .join(" ")
     .to_lowercase();
     haystack.contains(keyword)
 }
 
+fn matches_admin_editor_asset_group_keyword(
+    assets: &[EditorAsset],
+    group_task_id: Option<&str>,
+    keyword: Option<&str>,
+) -> bool {
+    let Some(keyword) = keyword else {
+        return true;
+    };
+    assets
+        .iter()
+        .any(|asset| matches_admin_editor_asset_keyword(asset, Some(keyword)))
+        || group_task_id.is_some_and(|group_task_id| group_task_id.to_lowercase().contains(keyword))
+}
+
 fn find_asset_source_project_resource(
     ctx: &ReducerContext,
     row: &EditorAsset,
@@ -3581,6 +4481,8 @@ fn normalize_media_ref(value: &str) -> String {
 }
 
 fn resource_snapshot_from_row(row: EditorProjectResource) -> EditorProjectResourceSnapshot {
+    let asset_kind =
+        normalize_legacy_editor_source_asset_kind(row.asset_kind, row.object_key.as_deref());
     EditorProjectResourceSnapshot {
         resource_id: row.resource_id,
         project_id: row.project_id,
@@ -3597,7 +4499,7 @@ fn resource_snapshot_from_row(row: EditorProjectResource) -> EditorProjectResour
         provider: row.provider,
         task_id: row.task_id,
         source_resource_id: row.source_resource_id,
-        asset_kind: row.asset_kind,
+        asset_kind,
         generation_inputs_json: row.generation_inputs_json,
         public_showcase_enabled: row.public_showcase_enabled,
         created_at_micros: row.created_at.to_micros_since_unix_epoch(),
@@ -4089,6 +4991,47 @@ mod tests {
     use super::*;
     use serde_json::json;
 
+    fn public_showcase_asset() -> EditorShowcaseAsset {
+        let now = Timestamp::from_micros_since_unix_epoch(1_000_000);
+        EditorShowcaseAsset {
+            showcase_id: "editor-showcase:asset-1".to_string(),
+            asset_id: "asset-1".to_string(),
+            owner_user_id: "user-owner".to_string(),
+            label: "精选素材".to_string(),
+            asset_object_id: Some("asset-object-1".to_string()),
+            image_src: "/generated-characters/editor/asset-1.png".to_string(),
+            object_key: Some("generated-characters/editor/asset-1.png".to_string()),
+            width: 1024,
+            height: 1024,
+            source_type: "generated".to_string(),
+            prompt: None,
+            actual_prompt: None,
+            model: None,
+            provider: None,
+            task_id: None,
+            source_resource_id: None,
+            asset_kind: Some("character".to_string()),
+            generation_inputs_json: None,
+            thumbnail_src: None,
+            generation_cost_mud_points: 5,
+            refund_mud_points: 3,
+            review_status: EDITOR_SHOWCASE_STATUS_APPROVED.to_string(),
+            display_enabled: true,
+            like_count: 0,
+            asset_deleted_while_pending: false,
+            reviewed_by_admin_user_id: Some("admin".to_string()),
+            review_note: None,
+            refund_ledger_id: Some("editor-showcase-refund:editor-showcase:asset-1".to_string()),
+            refund_completed_at: Some(now),
+            submitted_at: now,
+            reviewed_at: Some(now),
+            approved_at: Some(now),
+            rejected_at: None,
+            updated_at: now,
+            showcase_category: Some("characters".to_string()),
+        }
+    }
+
     fn tiered_pricing(model: &str, unit: &str, tiers: &[&str]) -> EditorGenerationModelPricing {
         EditorGenerationModelPricing {
             model: model.to_string(),
@@ -4139,6 +5082,71 @@ mod tests {
         models
     }
 
+    fn generated_editor_asset(
+        asset_id: &str,
+        task_id: &str,
+        asset_kind: &str,
+        object_key: &str,
+        generation_cost_mud_points: u64,
+        created_at_micros: i64,
+    ) -> EditorAsset {
+        EditorAsset {
+            asset_id: asset_id.to_string(),
+            owner_user_id: "user-1".to_string(),
+            folder_id: "project".to_string(),
+            label: asset_id.to_string(),
+            asset_object_id: Some(format!("object-{asset_id}")),
+            image_src: format!("/{object_key}"),
+            object_key: Some(object_key.to_string()),
+            width: 512,
+            height: 512,
+            source_type: "generated".to_string(),
+            prompt: None,
+            actual_prompt: None,
+            model: None,
+            provider: None,
+            task_id: Some(task_id.to_string()),
+            created_at: Timestamp::from_micros_since_unix_epoch(created_at_micros),
+            updated_at: Timestamp::from_micros_since_unix_epoch(created_at_micros),
+            asset_kind: Some(asset_kind.to_string()),
+            generation_inputs_json: None,
+            source_resource_id: None,
+            thumbnail_src: None,
+            generation_cost_mud_points,
+            group_task_id: None,
+            group_task_expected_asset_count: None,
+        }
+    }
+
+    fn generated_editor_project_resource(
+        resource_id: &str,
+        task_id: &str,
+        source_resource_id: Option<&str>,
+    ) -> EditorProjectResource {
+        EditorProjectResource {
+            resource_id: resource_id.to_string(),
+            project_id: "project-1".to_string(),
+            owner_user_id: "user-1".to_string(),
+            asset_object_id: Some(format!("object-{resource_id}")),
+            image_src: format!("/{resource_id}.png"),
+            object_key: Some(format!("generated/{resource_id}.png")),
+            width: 512,
+            height: 512,
+            source_type: "generated".to_string(),
+            prompt: None,
+            actual_prompt: None,
+            model: None,
+            provider: None,
+            task_id: Some(task_id.to_string()),
+            source_resource_id: source_resource_id.map(str::to_string),
+            created_at: Timestamp::from_micros_since_unix_epoch(1),
+            updated_at: Timestamp::from_micros_since_unix_epoch(1),
+            asset_kind: Some("icon".to_string()),
+            generation_inputs_json: None,
+            public_showcase_enabled: false,
+        }
+    }
+
     #[test]
     fn normalize_editor_generation_pricing_models_accepts_complete_matrix() {
         let normalized =
@@ -4430,4 +5438,400 @@ mod tests {
             cursor.as_ref()
         ));
     }
+
+    #[test]
+    fn public_showcase_read_grant_requires_approved_displayed_refunded_media() {
+        assert!(is_public_showcase_asset(&public_showcase_asset()));
+
+        assert!(!is_public_showcase_asset(&EditorShowcaseAsset {
+            review_status: EDITOR_SHOWCASE_STATUS_PENDING.to_string(),
+            ..public_showcase_asset()
+        }));
+        assert!(!is_public_showcase_asset(&EditorShowcaseAsset {
+            display_enabled: false,
+            ..public_showcase_asset()
+        }));
+        assert!(!is_public_showcase_asset(&EditorShowcaseAsset {
+            refund_completed_at: None,
+            ..public_showcase_asset()
+        }));
+        assert!(!is_public_showcase_asset(&EditorShowcaseAsset {
+            image_src: String::new(),
+            ..public_showcase_asset()
+        }));
+    }
+
+    #[test]
+    fn editor_asset_task_group_uses_final_output_as_primary() {
+        let assets = vec![
+            generated_editor_asset(
+                "source",
+                "task-1",
+                "icon-spritesheet",
+                "generated-icon-spritesheets/editor/provider-source-task-1.png",
+                9,
+                1,
+            ),
+            generated_editor_asset(
+                "slice",
+                "task-1",
+                "icon",
+                "generated-icon-spritesheet-assets/editor/slice-1.png",
+                0,
+                3,
+            ),
+            generated_editor_asset(
+                "final",
+                "task-1",
+                "icon-spritesheet",
+                "generated-icon-spritesheets/editor/spritesheet-task-1.png",
+                0,
+                2,
+            ),
+        ];
+
+        let primary_index = editor_asset_primary_index(&assets).expect("primary asset");
+
+        assert_eq!(assets[primary_index].asset_id, "final");
+        assert_eq!(
+            editor_asset_task_group_key(&assets[0]),
+            "owner:user-1:task:task-1"
+        );
+        assert!(editor_asset_is_provider_source(&assets[0]));
+        assert!(!editor_asset_is_provider_source(&assets[1]));
+    }
+
+    #[test]
+    fn admin_editor_asset_group_links_manual_atlas_slices_to_source_task() {
+        let split_task_id = "editor-atlas-split-operation-1";
+        let source_task_id = "vector-engine-source-task-1";
+        let mut slice = generated_editor_asset(
+            "slice-26",
+            split_task_id,
+            "icon",
+            "generated-character-drafts/editor/icon-spritesheet-slices/editor-atlas-split-operation-1/asset-026.png",
+            0,
+            3,
+        );
+        slice.source_resource_id = Some("slice-resource-26".to_string());
+        let mut resources = BTreeMap::from([
+            (
+                "slice-resource-26".to_string(),
+                generated_editor_project_resource(
+                    "slice-resource-26",
+                    split_task_id,
+                    Some("source-spritesheet-resource"),
+                ),
+            ),
+            (
+                "source-spritesheet-resource".to_string(),
+                generated_editor_project_resource(
+                    "source-spritesheet-resource",
+                    source_task_id,
+                    None,
+                ),
+            ),
+        ]);
+
+        let resolved_task_id =
+            admin_editor_asset_source_task_id_with(&slice, split_task_id, |resource_id| {
+                resources.remove(resource_id)
+            });
+
+        assert_eq!(resolved_task_id.as_deref(), Some(source_task_id));
+        assert_eq!(
+            editor_asset_task_group_key_with_task_id(&slice, resolved_task_id.as_deref()),
+            "owner:user-1:task:vector-engine-source-task-1"
+        );
+    }
+
+    #[test]
+    fn admin_editor_asset_group_survives_resource_deletion_and_preserves_real_task_id() {
+        let split_task_id = "editor-atlas-split-operation-1";
+        let source_task_id = "vector-engine-source-task-1";
+        let mut slice = generated_editor_asset(
+            "slice-26",
+            split_task_id,
+            "icon",
+            "generated-character-drafts/editor/icon-spritesheet-slices/editor-atlas-split-operation-1/asset-026.png",
+            0,
+            3,
+        );
+        slice.source_resource_id = Some("deleted-slice-resource-26".to_string());
+        slice.group_task_id = Some(source_task_id.to_string());
+        let mut task_id_aliases = BTreeMap::new();
+
+        let group_task_id =
+            admin_editor_asset_group_task_id_with(&slice, &mut task_id_aliases, |_, _| {
+                panic!("persisted group must not depend on project resources")
+            });
+        let snapshot = admin_asset_snapshot_from_row(slice, group_task_id);
+
+        assert_eq!(snapshot.task_id.as_deref(), Some(split_task_id));
+        assert_eq!(snapshot.group_task_id.as_deref(), Some(source_task_id));
+    }
+
+    #[test]
+    fn admin_editor_asset_keyword_matches_effective_historical_group_task_id() {
+        let slice = generated_editor_asset(
+            "slice-26",
+            "editor-atlas-split-operation-1",
+            "icon",
+            "generated/slice-26.png",
+            0,
+            3,
+        );
+
+        assert!(matches_admin_editor_asset_group_keyword(
+            std::slice::from_ref(&slice),
+            Some("vector-engine-source-task-1"),
+            Some("source-task-1"),
+        ));
+        assert!(!matches_admin_editor_asset_group_keyword(
+            std::slice::from_ref(&slice),
+            Some("vector-engine-source-task-1"),
+            Some("missing-task"),
+        ));
+    }
+
+    #[test]
+    fn admin_editor_asset_owner_filter_uses_owner_branch() {
+        let by_owner_calls = std::cell::Cell::new(0);
+        let all_rows_calls = std::cell::Cell::new(0);
+
+        let rows = select_admin_editor_asset_rows(
+            Some("user-1"),
+            |owner_user_id| {
+                by_owner_calls.set(by_owner_calls.get() + 1);
+                vec![format!("{owner_user_id}:asset-1")]
+            },
+            || {
+                all_rows_calls.set(all_rows_calls.get() + 1);
+                vec!["user-2:asset-2".to_string()]
+            },
+        );
+
+        assert_eq!(rows, vec!["user-1:asset-1"]);
+        assert_eq!(by_owner_calls.get(), 1);
+        assert_eq!(all_rows_calls.get(), 0);
+    }
+
+    #[test]
+    fn repeated_manual_atlas_splits_keep_groups_bounded_without_dropping_assets() {
+        let root_task_id = "vector-engine-source-task-1";
+        let first_split_task_id = "editor-atlas-split-operation-1";
+        let second_split_task_id = "editor-atlas-split-operation-2";
+        let third_split_task_id = "editor-atlas-split-operation-3";
+
+        let mut first_slice = generated_editor_asset(
+            "first-slice",
+            first_split_task_id,
+            "icon",
+            "generated/first-slice.png",
+            0,
+            1,
+        );
+        first_slice.group_task_id = Some(root_task_id.to_string());
+        let same_operation_slice = generated_editor_asset(
+            "first-slice-2",
+            first_split_task_id,
+            "icon",
+            "generated/first-slice-2.png",
+            0,
+            2,
+        );
+        let second_slice = generated_editor_asset(
+            "second-slice",
+            second_split_task_id,
+            "icon",
+            "generated/second-slice.png",
+            0,
+            3,
+        );
+        let third_slice = generated_editor_asset(
+            "third-slice",
+            third_split_task_id,
+            "icon",
+            "generated/third-slice.png",
+            0,
+            4,
+        );
+        let bounded_assets = bound_admin_editor_asset_groups(
+            vec![
+                (first_slice, Some(root_task_id.to_string())),
+                (same_operation_slice, Some(root_task_id.to_string())),
+                (second_slice, Some(root_task_id.to_string())),
+                (third_slice, Some(root_task_id.to_string())),
+            ],
+            &BTreeSet::new(),
+        );
+
+        assert_eq!(bounded_assets.len(), 4);
+        assert_eq!(
+            bounded_assets
+                .iter()
+                .map(|(asset, group_task_id)| (
+                    asset.task_id.as_deref().unwrap_or_default(),
+                    group_task_id.as_deref().unwrap_or_default(),
+                ))
+                .collect::<Vec<_>>(),
+            vec![
+                (first_split_task_id, root_task_id),
+                (first_split_task_id, root_task_id),
+                (second_split_task_id, second_split_task_id),
+                (third_split_task_id, third_split_task_id),
+            ]
+        );
+    }
+
+    #[test]
+    fn incomplete_manual_atlas_split_never_displaces_complete_retry_from_root_group() {
+        let root_task_id = "vector-engine-source-task-1";
+        let incomplete_task_id = "editor-atlas-split-incomplete";
+        let complete_task_id = "editor-atlas-split-complete";
+        let mut incomplete_slice = generated_editor_asset(
+            "incomplete-slice",
+            incomplete_task_id,
+            "icon",
+            "generated/incomplete-slice.png",
+            0,
+            1,
+        );
+        incomplete_slice.group_task_id = Some(root_task_id.to_string());
+        incomplete_slice.group_task_expected_asset_count = Some(2);
+        let mut complete_slice_1 = generated_editor_asset(
+            "complete-slice-1",
+            complete_task_id,
+            "icon",
+            "generated/complete-slice-1.png",
+            0,
+            2,
+        );
+        complete_slice_1.group_task_id = Some(root_task_id.to_string());
+        complete_slice_1.group_task_expected_asset_count = Some(2);
+        let mut complete_slice_2 = generated_editor_asset(
+            "complete-slice-2",
+            complete_task_id,
+            "icon",
+            "generated/complete-slice-2.png",
+            0,
+            3,
+        );
+        complete_slice_2.group_task_id = Some(root_task_id.to_string());
+        complete_slice_2.group_task_expected_asset_count = Some(2);
+
+        let completed_cohort_ids =
+            BTreeSet::from([editor_asset_group_cohort_id("user-1", complete_task_id)]);
+        let bounded_assets = bound_admin_editor_asset_groups(
+            vec![
+                (incomplete_slice, Some(root_task_id.to_string())),
+                (complete_slice_1, Some(root_task_id.to_string())),
+                (complete_slice_2, Some(root_task_id.to_string())),
+            ],
+            &completed_cohort_ids,
+        );
+
+        assert_eq!(
+            bounded_assets
+                .iter()
+                .map(|(asset, effective_group_task_id)| (
+                    asset.task_id.as_deref().unwrap_or_default(),
+                    asset.group_task_id.as_deref().unwrap_or_default(),
+                    effective_group_task_id.as_deref().unwrap_or_default(),
+                ))
+                .collect::<Vec<_>>(),
+            vec![
+                (incomplete_task_id, root_task_id, incomplete_task_id),
+                (complete_task_id, root_task_id, root_task_id),
+                (complete_task_id, root_task_id, root_task_id),
+            ]
+        );
+    }
+
+    #[test]
+    fn completed_manual_atlas_split_stays_on_root_after_a_slice_is_deleted() {
+        let root_task_id = "vector-engine-source-task-1";
+        let split_task_id = "editor-atlas-split-complete";
+        let mut remaining_slice = generated_editor_asset(
+            "remaining-slice",
+            split_task_id,
+            "icon",
+            "generated/remaining-slice.png",
+            0,
+            1,
+        );
+        remaining_slice.group_task_id = Some(root_task_id.to_string());
+        remaining_slice.group_task_expected_asset_count = Some(2);
+        let completed_cohort_ids =
+            BTreeSet::from([editor_asset_group_cohort_id("user-1", split_task_id)]);
+
+        let bounded_assets = bound_admin_editor_asset_groups(
+            vec![(remaining_slice, Some(root_task_id.to_string()))],
+            &completed_cohort_ids,
+        );
+
+        assert_eq!(bounded_assets.len(), 1);
+        assert_eq!(bounded_assets[0].1.as_deref(), Some(root_task_id));
+    }
+
+    #[test]
+    fn modern_manual_atlas_split_without_trusted_source_stays_standalone() {
+        let split_task_id = "editor-atlas-split-standalone";
+        let mut slice = generated_editor_asset(
+            "standalone-slice",
+            split_task_id,
+            "icon",
+            "generated/standalone-slice.png",
+            0,
+            1,
+        );
+        slice.group_task_id = Some(split_task_id.to_string());
+        slice.group_task_expected_asset_count = Some(2);
+
+        let bounded_assets = bound_admin_editor_asset_groups(
+            vec![(slice, Some(split_task_id.to_string()))],
+            &BTreeSet::new(),
+        );
+
+        assert_eq!(bounded_assets.len(), 1);
+        assert_eq!(bounded_assets[0].1.as_deref(), Some(split_task_id));
+    }
+
+    #[test]
+    fn legacy_provider_source_uses_real_type_and_carries_task_cost() {
+        let mut assets = vec![
+            generated_editor_asset(
+                "source",
+                "task-1",
+                EDITOR_LEGACY_GREEN_SCREEN_SOURCE_ASSET_KIND,
+                "generated-character-drafts/editor/character-images/character-green-screen-source.png",
+                0,
+                1,
+            ),
+            generated_editor_asset(
+                "final",
+                "task-1",
+                "character",
+                "generated-character-drafts/editor/character-images/character.png",
+                9,
+                2,
+            ),
+        ];
+
+        normalize_legacy_editor_source_costs_across_groups(&mut assets);
+
+        assert_eq!(assets[0].asset_kind.as_deref(), Some("character"));
+        assert_eq!(assets[0].generation_cost_mud_points, 9);
+        assert_eq!(assets[1].generation_cost_mud_points, 0);
+        assert_eq!(
+            normalize_legacy_editor_source_asset_kind(
+                Some(EDITOR_LEGACY_GREEN_SCREEN_SOURCE_ASSET_KIND.to_string()),
+                Some(
+                    "generated-character-drafts/layer/animation/editor-character-animation/task/preview.mp4",
+                ),
+            )
+            .as_deref(),
+            Some("character-animation")
+        );
+    }
 }
diff --git a/server-rs/crates/spacetime-module/src/lib.rs b/server-rs/crates/spacetime-module/src/lib.rs
index 9f596ffcc..42cbe20cf 100644
--- a/server-rs/crates/spacetime-module/src/lib.rs
+++ b/server-rs/crates/spacetime-module/src/lib.rs
@@ -23,6 +23,8 @@ pub(crate) use shared_kernel::format_timestamp_micros;
 pub use spacetimedb::{
     Identity, ProcedureContext, ReducerContext, ScheduleAt, SpacetimeType, Table, Timestamp,
 };
+mod admin_account_storage;
+mod admin_dashboard;
 mod ai;
 mod asset_metadata;
 mod auth;
@@ -48,6 +50,8 @@ mod square_hole;
 mod visual_novel;
 mod wooden_fish;
 
+pub use admin_account_storage::*;
+pub use admin_dashboard::*;
 pub use ai::*;
 pub use asset_metadata::*;
 pub use auth::*;
diff --git a/server-rs/crates/spacetime-module/src/migration.rs b/server-rs/crates/spacetime-module/src/migration.rs
index 96a0506c6..c1f42861f 100644
--- a/server-rs/crates/spacetime-module/src/migration.rs
+++ b/server-rs/crates/spacetime-module/src/migration.rs
@@ -176,6 +176,7 @@ macro_rules! migration_tables {
         $macro_name! {
             $($arg,)*
             auth_store_projection_meta,
+            admin_account,
             user_account,
             auth_identity,
             refresh_session,
@@ -1345,20 +1346,6 @@ fn normalize_migration_row(table_name: &str, value: &serde_json::Value) -> serde
                 .or_insert(serde_json::Value::Null);
         }
     }
-    if table_name == "profile_recharge_refund" {
-        if let Some(object) = next_value.as_object_mut() {
-            // 中文注释：退款人工复核审计字段晚于退款事实表加入，旧迁移包按尚未处理兼容。
-            object
-                .entry("manual_review_resolved_by_admin_user_id".to_string())
-                .or_insert(serde_json::Value::Null);
-            object
-                .entry("manual_review_resolution_reason".to_string())
-                .or_insert(serde_json::Value::Null);
-            object
-                .entry("manual_review_resolved_at".to_string())
-                .or_insert(serde_json::Value::Null);
-        }
-    }
     if table_name == "external_generation_job_summary" {
         if let Some(object) = next_value.as_object_mut() {
             // 中文注释：非阻断完成告警晚于轻量任务摘要表加入，旧迁移包按无告警兼容。
@@ -1547,6 +1534,13 @@ fn normalize_migration_row(table_name: &str, value: &serde_json::Value) -> serde
             object
                 .entry("thumbnail_src".to_string())
                 .or_insert(serde_json::Value::Null);
+            // 中文注释：后台任务归组晚于账号素材表加入，旧素材按未固化归组兼容。
+            object
+                .entry("group_task_id".to_string())
+                .or_insert(serde_json::Value::Null);
+            object
+                .entry("group_task_expected_asset_count".to_string())
+                .or_insert(serde_json::Value::Null);
         }
     }
     next_value
@@ -1676,56 +1670,6 @@ mod migration_bootstrap_secret_tests {
         assert_eq!(normalized["warning_message"], serde_json::Value::Null);
     }
 
-    #[test]
-    fn old_profile_recharge_refund_rows_import_with_empty_manual_review_audit() {
-        let row = ProfileRechargeRefund {
-            out_refund_no: "refund-legacy".to_string(),
-            provider_refund_id: "wx-refund-legacy".to_string(),
-            order_id: "order-legacy".to_string(),
-            provider_transaction_id: "wx-transaction-legacy".to_string(),
-            user_id: Some("user-legacy".to_string()),
-            provider_status: RuntimeProfileRechargeRefundStatus::Success,
-            total_cents: 600,
-            refund_cents: 300,
-            payer_total_cents: 600,
-            payer_refund_cents: 300,
-            success_at: Some(Timestamp::from_micros_since_unix_epoch(200)),
-            first_observed_at: Timestamp::from_micros_since_unix_epoch(100),
-            updated_at: Timestamp::from_micros_since_unix_epoch(200),
-            last_observation_source: RuntimeProfileRechargeRefundObservationSource::Query,
-            last_observation_id: "observation-legacy".to_string(),
-            order_settled_at: None,
-            target_recovery_points: 30,
-            recovered_points: 30,
-            unrecovered_points: 0,
-            recovery_status: RuntimeProfileRechargeRefundRecoveryStatus::Applied,
-            last_recovery_ledger_id: Some("ledger-legacy".to_string()),
-            last_error_code: None,
-            manual_review_resolved_by_admin_user_id: None,
-            manual_review_resolution_reason: None,
-            manual_review_resolved_at: None,
-        };
-        let mut legacy_value = row_to_json(&row).expect("退款旧行应可序列化");
-        let object = legacy_value
-            .as_object_mut()
-            .expect("退款迁移行应为 JSON object");
-        object.remove("manual_review_resolved_by_admin_user_id");
-        object.remove("manual_review_resolution_reason");
-        object.remove("manual_review_resolved_at");
-
-        let normalized = normalize_migration_row("profile_recharge_refund", &legacy_value);
-        let restored = row_from_json::<ProfileRechargeRefund>(
-            "profile_recharge_refund",
-            &normalized,
-            &mut Vec::new(),
-        )
-        .expect("缺少人工复核字段的旧退款行应可导入");
-
-        assert!(restored.manual_review_resolved_by_admin_user_id.is_none());
-        assert!(restored.manual_review_resolution_reason.is_none());
-        assert!(restored.manual_review_resolved_at.is_none());
-    }
-
     #[test]
     fn bootstrap_secret_sha256_is_stable_and_does_not_contain_plaintext() {
         let secret = "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef";
diff --git a/server-rs/crates/spacetime-module/src/runtime/profile.rs b/server-rs/crates/spacetime-module/src/runtime/profile.rs
index 706139824..3e5df5323 100644
--- a/server-rs/crates/spacetime-module/src/runtime/profile.rs
+++ b/server-rs/crates/spacetime-module/src/runtime/profile.rs
@@ -512,6 +512,8 @@ pub struct ProfileRechargeRefund {
     pub(crate) manual_review_resolution_reason: Option<String>,
     #[default(None::<Timestamp>)]
     pub(crate) manual_review_resolved_at: Option<Timestamp>,
+    #[default(None::<String>)]
+    pub(crate) manual_review_resolved_error_code: Option<String>,
 }
 
 #[spacetimedb::table(
@@ -2727,6 +2729,7 @@ mod tests {
             manual_review_resolved_by_admin_user_id: None,
             manual_review_resolution_reason: None,
             manual_review_resolved_at: None,
+            manual_review_resolved_error_code: None,
         }
     }
 
@@ -2751,7 +2754,7 @@ mod tests {
     }
 
     #[test]
-    fn confirmed_manual_review_suppresses_only_the_order_match_conflict() {
+    fn confirmed_manual_review_suppresses_only_the_approved_order_match_conflict() {
         let order = recharge_order_for_refund(RuntimeProfileRechargeOrderStatus::Paid);
         let mut refund = recharge_refund_for_order(&order);
         refund.provider_transaction_id = "wx-transaction-other".to_string();
@@ -2761,6 +2764,8 @@ mod tests {
         );
 
         refund.manual_review_resolved_at = Some(Timestamp::from_micros_since_unix_epoch(300));
+        refund.manual_review_resolved_error_code =
+            Some("provider_transaction_id_mismatch".to_string());
         assert_eq!(
             unresolved_profile_recharge_refund_order_match_error(&order, &refund),
             None
@@ -2769,6 +2774,85 @@ mod tests {
             validate_profile_recharge_refund_order_match(&order, &refund),
             Err("provider_transaction_id_mismatch".to_string())
         );
+
+        refund.total_cents = order.amount_cents + 1;
+        assert_eq!(
+            unresolved_profile_recharge_refund_order_match_error(&order, &refund),
+            Some("order_total_mismatch".to_string())
+        );
+
+        refund.manual_review_resolved_error_code = Some("order_total_mismatch".to_string());
+        assert_eq!(
+            unresolved_profile_recharge_refund_order_match_error(&order, &refund),
+            Some("provider_transaction_id_mismatch".to_string())
+        );
+    }
+
+    #[test]
+    fn manual_review_request_matches_current_and_resolved_state() {
+        let order = recharge_order_for_refund(RuntimeProfileRechargeOrderStatus::Paid);
+        let mut refund = recharge_refund_for_order(&order);
+        refund.last_error_code = Some("provider_transaction_id_mismatch".to_string());
+
+        assert!(
+            validate_profile_recharge_refund_manual_review_request(
+                &refund,
+                "provider_transaction_id_mismatch",
+                "admin-1",
+                "已核对商户平台",
+            )
+            .is_ok()
+        );
+        assert!(
+            validate_profile_recharge_refund_manual_review_request(
+                &refund,
+                "order_total_mismatch",
+                "admin-1",
+                "已核对商户平台",
+            )
+            .is_err()
+        );
+
+        refund.manual_review_resolved_at = Some(Timestamp::from_micros_since_unix_epoch(300));
+        refund.manual_review_resolved_error_code = Some("order_total_mismatch".to_string());
+        refund.manual_review_resolved_by_admin_user_id = Some("admin-1".to_string());
+        refund.manual_review_resolution_reason = Some("已核对商户平台".to_string());
+        assert!(
+            validate_profile_recharge_refund_manual_review_request(
+                &refund,
+                "order_total_mismatch",
+                "admin-1",
+                "已核对商户平台",
+            )
+            .is_ok()
+        );
+        assert!(
+            validate_profile_recharge_refund_manual_review_request(
+                &refund,
+                "provider_transaction_id_mismatch",
+                "admin-1",
+                "已核对商户平台",
+            )
+            .is_err()
+        );
+        assert!(
+            validate_profile_recharge_refund_manual_review_request(
+                &refund,
+                "order_total_mismatch",
+                "admin-2",
+                "已核对商户平台",
+            )
+            .is_err()
+        );
+        assert!(
+            validate_profile_recharge_refund_manual_review_request(
+                &refund,
+                "order_total_mismatch",
+                "admin-1",
+                "另一份核对意见",
+            )
+            .is_err()
+        );
     }
 
     #[test]
@@ -4589,6 +4673,7 @@ fn resolve_profile_recharge_refund_manual_review(
         input.out_refund_no,
         input.admin_user_id,
         input.reason,
+        input.expected_error_code,
     )?;
     let mut refund = ctx
         .db
@@ -4596,6 +4681,12 @@ fn resolve_profile_recharge_refund_manual_review(
         .out_refund_no()
         .find(&validated.out_refund_no)
         .ok_or_else(|| "退款记录不存在".to_string())?;
+    validate_profile_recharge_refund_manual_review_request(
+        &refund,
+        &validated.expected_error_code,
+        &validated.admin_user_id,
+        &validated.reason,
+    )?;
     if refund.manual_review_resolved_at.is_some() {
         let settlement = ctx
             .db
@@ -4617,10 +4708,10 @@ fn resolve_profile_recharge_refund_manual_review(
     }
     let review_code = refund
         .last_error_code
-        .as_deref()
+        .clone()
         .ok_or_else(|| "退款缺少人工复核原因".to_string())?;
     if !matches!(
-        review_code,
+        review_code.as_str(),
         "provider_transaction_id_mismatch" | "order_total_mismatch"
     ) {
         return Err(format!(
@@ -4636,10 +4727,20 @@ fn resolve_profile_recharge_refund_manual_review(
     if order.kind != RuntimeProfileRechargeProductKind::Points {
         return Err("会员退款不能使用泥点钱包人工复核入口".to_string());
     }
+    if let Some(remaining_code) = profile_recharge_refund_order_match_error_except(
+        &order,
+        &refund,
+        Some(review_code.as_str()),
+    ) {
+        return Err(format!(
+            "确认当前退款冲突后仍存在未获批准的订单不匹配: {remaining_code}"
+        ));
+    }
 
     refund.manual_review_resolved_by_admin_user_id = Some(validated.admin_user_id);
     refund.manual_review_resolution_reason = Some(validated.reason);
     refund.manual_review_resolved_at = Some(ctx.timestamp);
+    refund.manual_review_resolved_error_code = Some(review_code);
     refund.updated_at = ctx.timestamp;
     let (settlement, resolution_code) = reconcile_profile_recharge_refund_success(ctx, &mut refund);
     if refund.recovery_status == RuntimeProfileRechargeRefundRecoveryStatus::ManualReview {
@@ -4661,6 +4762,32 @@ fn resolve_profile_recharge_refund_manual_review(
     ))
 }
 
+fn validate_profile_recharge_refund_manual_review_request(
+    refund: &ProfileRechargeRefund,
+    expected_error_code: &str,
+    admin_user_id: &str,
+    reason: &str,
+) -> Result<(), String> {
+    let current_error_code = if refund.manual_review_resolved_at.is_some() {
+        refund.manual_review_resolved_error_code.as_deref()
+    } else {
+        refund.last_error_code.as_deref()
+    };
+    if current_error_code != Some(expected_error_code) {
+        return Err(format!(
+            "退款人工复核状态已变化，当前错误码为 {}",
+            current_error_code.unwrap_or("-")
+        ));
+    }
+    if refund.manual_review_resolved_at.is_some()
+        && (refund.manual_review_resolved_by_admin_user_id.as_deref() != Some(admin_user_id)
+            || refund.manual_review_resolution_reason.as_deref() != Some(reason))
+    {
+        return Err("退款人工复核已由其他审计内容处理".to_string());
+    }
+    Ok(())
+}
+
 fn build_profile_admin_wallet_snapshot(
     ctx: &ReducerContext,
     user_id: &str,
@@ -5041,6 +5168,7 @@ fn record_profile_recharge_refund_observation(
             manual_review_resolved_by_admin_user_id: None,
             manual_review_resolution_reason: None,
             manual_review_resolved_at: None,
+            manual_review_resolved_error_code: None,
         },
     };
 
@@ -5211,10 +5339,19 @@ fn reconcile_profile_recharge_refund_success(
     (Some(settlement), resolution_code.to_string())
 }
 
+#[cfg(test)]
 fn validate_profile_recharge_refund_order_match(
     order: &ProfileRechargeOrder,
     refund: &ProfileRechargeRefund,
 ) -> Result<(), String> {
+    profile_recharge_refund_order_match_error_except(order, refund, None).map_or(Ok(()), Err)
+}
+
+fn profile_recharge_refund_order_match_error_except(
+    order: &ProfileRechargeOrder,
+    refund: &ProfileRechargeRefund,
+    approved_error_code: Option<&str>,
+) -> Option<String> {
     if !matches!(
         order.payment_channel.as_str(),
         PROFILE_RECHARGE_PAYMENT_CHANNEL_WECHAT_MINI_PROGRAM
@@ -5222,7 +5359,7 @@ fn validate_profile_recharge_refund_order_match(
             | PROFILE_RECHARGE_PAYMENT_CHANNEL_WECHAT_H5
             | PROFILE_RECHARGE_PAYMENT_CHANNEL_WECHAT_NATIVE
     ) {
-        return Err("payment_channel_not_v3".to_string());
+        return Some("payment_channel_not_v3".to_string());
     }
     if order.paid_at.is_none()
         || !matches!(
@@ -5230,24 +5367,31 @@ fn validate_profile_recharge_refund_order_match(
             RuntimeProfileRechargeOrderStatus::Paid | RuntimeProfileRechargeOrderStatus::Refunded
         )
     {
-        return Err("order_not_paid".to_string());
+        return Some("order_not_paid".to_string());
     }
-    if order.provider_transaction_id.as_deref() != Some(refund.provider_transaction_id.as_str()) {
-        return Err("provider_transaction_id_mismatch".to_string());
+    if order.provider_transaction_id.as_deref() != Some(refund.provider_transaction_id.as_str())
+        && approved_error_code != Some("provider_transaction_id_mismatch")
+    {
+        return Some("provider_transaction_id_mismatch".to_string());
     }
-    if order.amount_cents != refund.total_cents {
-        return Err("order_total_mismatch".to_string());
+    if order.amount_cents != refund.total_cents
+        && approved_error_code != Some("order_total_mismatch")
+    {
+        return Some("order_total_mismatch".to_string());
     }
-    Ok(())
+    None
 }
 
 fn unresolved_profile_recharge_refund_order_match_error(
     order: &ProfileRechargeOrder,
     refund: &ProfileRechargeRefund,
 ) -> Option<String> {
-    validate_profile_recharge_refund_order_match(order, refund)
-        .err()
-        .filter(|_| refund.manual_review_resolved_at.is_none())
+    let approved_error_code = refund
+        .manual_review_resolved_at
+        .is_some()
+        .then_some(refund.manual_review_resolved_error_code.as_deref())
+        .flatten();
+    profile_recharge_refund_order_match_error_except(order, refund, approved_error_code)
 }
 
 fn mark_profile_recharge_refund_manual_review(
@@ -8536,6 +8680,28 @@ pub(crate) fn grant_profile_wallet_points(
     )
 }
 
+pub(crate) fn grant_profile_wallet_points_with_metadata(
+    ctx: &ReducerContext,
+    user_id: &str,
+    amount_delta: u64,
+    source_type: RuntimeProfileWalletLedgerSourceType,
+    ledger_id: &str,
+    created_at: Timestamp,
+    metadata_json: &str,
+) -> Result<u64, String> {
+    apply_profile_wallet_signed_delta(
+        ctx,
+        user_id,
+        convert_runtime_profile_wallet_unsigned_delta(amount_delta)
+            .map_err(|error| error.to_string())?,
+        source_type,
+        ledger_id,
+        created_at,
+        true,
+        metadata_json,
+    )
+}
+
 fn apply_profile_wallet_adjustment(
     ctx: &ReducerContext,
     input: RuntimeProfileWalletAdjustmentInput,
@@ -9823,6 +9989,7 @@ fn build_profile_recharge_refund_snapshot_from_row(
         manual_review_resolved_at_micros: row
             .manual_review_resolved_at
             .map(|value| value.to_micros_since_unix_epoch()),
+        manual_review_resolved_error_code: row.manual_review_resolved_error_code.clone(),
     }
 }
 
diff --git a/src/components/image-editor/ImageCanvasBasicGenerationComposerView.test.tsx b/src/components/image-editor/ImageCanvasBasicGenerationComposerView.test.tsx
index 596ea1135..b1dfa2bee 100644
--- a/src/components/image-editor/ImageCanvasBasicGenerationComposerView.test.tsx
+++ b/src/components/image-editor/ImageCanvasBasicGenerationComposerView.test.tsx
@@ -58,7 +58,6 @@ function BasicGenerationHarness({
         onSubmit={onSubmit}
       />
       <output aria-label="当前提示词">{dialog.prompt}</output>
-      <output aria-label="当前资源名称">{dialog.assetLabel ?? '-'}</output>
       <output aria-label="当前比例">{dialog.aspectRatio}</output>
       <output aria-label="当前尺寸">{dialog.imageSize}</output>
       <output aria-label="当前模型">{dialog.imageModel}</output>
@@ -87,25 +86,21 @@ describe('ImageCanvasBasicGenerationComposerView', () => {
     fireEvent.change(screen.getByLabelText('生成提示词'), {
       target: { value: '新的提示' },
     });
-    fireEvent.change(screen.getByLabelText('资源名称'), {
-      target: { value: '自定义主视觉' },
-    });
     const panel = screen.getByRole('dialog', { name: '生成图片' });
+    expect(
+      within(panel).queryByRole('textbox', { name: '资源名称' }),
+    ).toBeNull();
     fireEvent.click(within(panel).getByRole('button', { name: '添加参考图' }));
     fireEvent.click(screen.getByRole('menuitem', { name: '上传图片' }));
     fireEvent.click(screen.getByRole('button', { name: '生成' }));
 
     expect(screen.getByLabelText('当前提示词').textContent).toBe('新的提示');
-    expect(screen.getByLabelText('当前资源名称').textContent).toBe(
-      '自定义主视觉',
-    );
     expect(screen.getByLabelText('当前状态').textContent).toBe('idle');
     expect(screen.getByLabelText('当前错误').textContent).toBe('-');
     expect(requestUpload).toHaveBeenCalledWith('generation-reference');
     expect(submitGeneration).toHaveBeenCalledWith(
       expect.objectContaining({
         prompt: '新的提示',
-        assetLabel: '自定义主视觉',
         status: 'idle',
       }),
     );
diff --git a/src/components/image-editor/ImageCanvasBasicGenerationComposerView.tsx b/src/components/image-editor/ImageCanvasBasicGenerationComposerView.tsx
index e21d649cc..ce63f14c6 100644
--- a/src/components/image-editor/ImageCanvasBasicGenerationComposerView.tsx
+++ b/src/components/image-editor/ImageCanvasBasicGenerationComposerView.tsx
@@ -18,7 +18,6 @@ import type {
   GenerateDialogState,
   UploadTarget,
 } from './ImageCanvasEditorTypes';
-import { ImageCanvasGenerationAssetNameField } from './ImageCanvasGenerationAssetNameField';
 import { ImageCanvasGenerationImageOptionsView } from './ImageCanvasGenerationImageOptionsView';
 import { ImageCanvasReferenceSlot } from './ImageCanvasReferenceSlot';
 import { calculateEditorImageGenerationPrice } from './ImageCanvasGenerationModel';
@@ -268,20 +267,6 @@ export function ImageCanvasBasicGenerationComposerView({
             )
           }
         />
-        <ImageCanvasGenerationAssetNameField
-          value={dialog.assetLabel}
-          disabled={dialog.status === 'generating'}
-          onChange={(assetLabel) =>
-            setGenerateDialog((currentDialog) =>
-              currentDialog
-                ? {
-                    ...resetFailedDialogStatus(currentDialog),
-                    assetLabel,
-                  }
-                : currentDialog,
-            )
-          }
-        />
         <div className={finalFooterClassName}>
           <ImageCanvasGenerationImageOptionsView
             dialog={dialog}
diff --git a/src/components/image-editor/ImageCanvasCharacterAnimationPanelView.tsx b/src/components/image-editor/ImageCanvasCharacterAnimationPanelView.tsx
index 09704e136..0482a424a 100644
--- a/src/components/image-editor/ImageCanvasCharacterAnimationPanelView.tsx
+++ b/src/components/image-editor/ImageCanvasCharacterAnimationPanelView.tsx
@@ -24,7 +24,6 @@ import type {
   CanvasLayer,
   CharacterAnimationPanelState,
 } from './ImageCanvasEditorTypes';
-import { ImageCanvasGenerationAssetNameField } from './ImageCanvasGenerationAssetNameField';
 import {
   CHARACTER_ANIMATION_ACTION_PROMPTS,
   CHARACTER_ANIMATION_DURATION_OPTIONS,
@@ -207,16 +206,11 @@ export function ImageCanvasCharacterAnimationPanelView({
           placeholder="你希望角色做什么动作？"
           size="sm"
           density="compact"
-          className="image-canvas-editor__generation-prompt image-canvas-editor__generation-prompt--borderless image-canvas-editor__character-animation-textarea"
+          className="image-canvas-editor__generation-prompt image-canvas-editor__character-animation-textarea"
           onChange={(event) =>
             updatePanel({ promptText: event.target.value.slice(0, 4000) })
           }
         />
-        <ImageCanvasGenerationAssetNameField
-          value={panel.assetLabel}
-          disabled={isGenerating}
-          onChange={(assetLabel) => updatePanel({ assetLabel })}
-        />
         <div className="image-canvas-editor__character-animation-presets">
           {CHARACTER_ANIMATION_ACTION_PROMPTS.map((preset) => (
             <button
diff --git a/src/components/image-editor/ImageCanvasCharacterGenerationComposerView.test.tsx b/src/components/image-editor/ImageCanvasCharacterGenerationComposerView.test.tsx
index d98475f29..e7a60f11a 100644
--- a/src/components/image-editor/ImageCanvasCharacterGenerationComposerView.test.tsx
+++ b/src/components/image-editor/ImageCanvasCharacterGenerationComposerView.test.tsx
@@ -93,7 +93,7 @@ function CharacterGenerationHarness({
 }
 
 describe('ImageCanvasCharacterGenerationComposerView', () => {
-  it('keeps the prompt as a borderless single text input with a question placeholder', () => {
+  it('keeps the prompt as a bordered single text input with a question placeholder', () => {
     render(<CharacterGenerationHarness />);
 
     const panel = screen.getByRole('dialog', { name: '生成角色形象' });
@@ -105,7 +105,8 @@ describe('ImageCanvasCharacterGenerationComposerView', () => {
         .join(''),
     ).not.toContain('角色设定');
     expect(prompt.getAttribute('placeholder')).toBe('你希望角色如何设计？');
-    expect(prompt.className).toContain(
+    expect(prompt.className).toContain('image-canvas-editor__generation-prompt');
+    expect(prompt.className).not.toContain(
       'image-canvas-editor__generation-prompt--borderless',
     );
   });
diff --git a/src/components/image-editor/ImageCanvasCharacterGenerationComposerView.tsx b/src/components/image-editor/ImageCanvasCharacterGenerationComposerView.tsx
index bfad99f04..2ddc374dd 100644
--- a/src/components/image-editor/ImageCanvasCharacterGenerationComposerView.tsx
+++ b/src/components/image-editor/ImageCanvasCharacterGenerationComposerView.tsx
@@ -20,7 +20,6 @@ import type {
   SpecGenerationType,
   UploadTarget,
 } from './ImageCanvasEditorTypes';
-import { ImageCanvasGenerationAssetNameField } from './ImageCanvasGenerationAssetNameField';
 import { ImageCanvasGenerationImageOptionsView } from './ImageCanvasGenerationImageOptionsView';
 import { calculateEditorImageGenerationPrice } from './ImageCanvasGenerationModel';
 import { useImageCanvasFloatingOptionDismiss } from './useImageCanvasFloatingOptionDismiss';
@@ -263,7 +262,7 @@ export function ImageCanvasCharacterGenerationComposerView({
           placeholder="你希望角色如何设计？"
           size="sm"
           density="compact"
-          className="image-canvas-editor__generation-prompt image-canvas-editor__generation-prompt--borderless"
+          className="image-canvas-editor__generation-prompt"
           onChange={(event) =>
             setGenerateDialog((currentDialog) =>
               currentDialog?.mode === 'character'
@@ -276,20 +275,6 @@ export function ImageCanvasCharacterGenerationComposerView({
           }
         />
       </label>
-      <ImageCanvasGenerationAssetNameField
-        value={dialog.assetLabel}
-        disabled={dialog.status === 'generating'}
-        onChange={(assetLabel) =>
-          setGenerateDialog((currentDialog) =>
-            currentDialog?.mode === 'character'
-              ? {
-                  ...resetFailedDialogStatus(currentDialog),
-                  assetLabel,
-                }
-              : currentDialog,
-          )
-        }
-      />
       {dialog.status === 'failed' ? (
         <PlatformStatusMessage
           tone="error"
diff --git a/src/components/image-editor/ImageCanvasContextMenusView.test.tsx b/src/components/image-editor/ImageCanvasContextMenusView.test.tsx
index 824bb0301..b93c848a4 100644
--- a/src/components/image-editor/ImageCanvasContextMenusView.test.tsx
+++ b/src/components/image-editor/ImageCanvasContextMenusView.test.tsx
@@ -266,21 +266,28 @@ describe('ImageCanvasContextMenusView', () => {
     expect(props.onDeleteLayerById).toHaveBeenCalledWith(layer.id);
   });
 
-  it.each(['icon', 'icon-spritesheet'] as const)(
-    'hides quick edit from the standalone menu for %s assets',
-    (assetKind) => {
-      const layer = createLayer({ assetKind });
-      renderContextMenus({
-        imageContextMenu: { layerId: layer.id, x: 20, y: 22 },
-        imageContextMenuLayer: layer,
-      });
+  it('hides quick edit from the standalone menu for individual icons', () => {
+    const layer = createLayer({ assetKind: 'icon' });
+    renderContextMenus({
+      imageContextMenu: { layerId: layer.id, x: 20, y: 22 },
+      imageContextMenuLayer: layer,
+    });
 
-      expect(screen.queryByRole('menuitem', { name: '快速编辑' })).toBeNull();
-      expect(
-        screen.getByRole('menuitem', { name: '查看图片信息' }),
-      ).toBeTruthy();
-    },
-  );
+    expect(screen.queryByRole('menuitem', { name: '快速编辑' })).toBeNull();
+    expect(
+      screen.getByRole('menuitem', { name: '查看图片信息' }),
+    ).toBeTruthy();
+  });
+
+  it('keeps quick edit in the standalone menu for icon spritesheets', () => {
+    const layer = createLayer({ assetKind: 'icon-spritesheet' });
+    renderContextMenus({
+      imageContextMenu: { layerId: layer.id, x: 20, y: 22 },
+      imageContextMenuLayer: layer,
+    });
+
+    expect(screen.getByRole('menuitem', { name: '快速编辑' })).toBeTruthy();
+  });
 
   it('keeps quick edit in the standalone menu for icon specs', () => {
     const layer = createLayer({ assetKind: 'icon-spec' });
diff --git a/src/components/image-editor/ImageCanvasEditorGenerationIntegration.test.tsx b/src/components/image-editor/ImageCanvasEditorGenerationIntegration.test.tsx
index d571c98bf..7a75928b8 100644
--- a/src/components/image-editor/ImageCanvasEditorGenerationIntegration.test.tsx
+++ b/src/components/image-editor/ImageCanvasEditorGenerationIntegration.test.tsx
@@ -2019,12 +2019,19 @@ describe('ImageCanvasEditorView generation integration', () => {
       { target: { value: '返回按钮\n设置按钮\n提示按钮' } },
     );
 
+    const iconPrompt = within(iconPanel).getByRole('textbox', {
+      name: '素材描述',
+    });
+    expect(iconPrompt.tagName).toBe('TEXTAREA');
+    expect(iconPrompt.className).toContain(
+      'image-canvas-editor__generation-prompt',
+    );
+    expect(iconPrompt.className).not.toContain(
+      'image-canvas-editor__generation-prompt--borderless',
+    );
     expect(
-      within(iconPanel).getByRole('textbox', { name: '素材描述' }).tagName,
-    ).toBe('TEXTAREA');
-    expect(
-      within(iconPanel).getByRole('textbox', { name: '资源名称' }),
-    ).toBeTruthy();
+      within(iconPanel).queryByRole('textbox', { name: '资源名称' }),
+    ).toBeNull();
     expect(
       within(iconPanel).queryByRole('button', { name: '添加素材描述' }),
     ).toBeNull();
diff --git a/src/components/image-editor/ImageCanvasEditorModel.ts b/src/components/image-editor/ImageCanvasEditorModel.ts
index 83b30e4c5..503b318d6 100644
--- a/src/components/image-editor/ImageCanvasEditorModel.ts
+++ b/src/components/image-editor/ImageCanvasEditorModel.ts
@@ -1146,7 +1146,6 @@ export function canvasAssetKindOrNull(value: unknown): CanvasAssetKind | null {
     value === 'icon' ||
     value === 'icon-spritesheet' ||
     value === 'icon-spec' ||
-    value === 'editor_green_screen_source' ||
     value === 'publication-material' ||
     value === 'ui-design' ||
     value === 'video' ||
diff --git a/src/components/image-editor/ImageCanvasEditorTypes.ts b/src/components/image-editor/ImageCanvasEditorTypes.ts
index 683810a2e..429a7d172 100644
--- a/src/components/image-editor/ImageCanvasEditorTypes.ts
+++ b/src/components/image-editor/ImageCanvasEditorTypes.ts
@@ -20,7 +20,6 @@ export type CanvasAssetKind =
   | 'icon'
   | 'icon-spritesheet'
   | 'icon-spec'
-  | 'editor_green_screen_source'
   | 'publication-material'
   | 'ui-design'
   | 'video'
diff --git a/src/components/image-editor/ImageCanvasGenerationAssetNameField.test.tsx b/src/components/image-editor/ImageCanvasGenerationAssetNameField.test.tsx
deleted file mode 100644
index cc64caeca..000000000
--- a/src/components/image-editor/ImageCanvasGenerationAssetNameField.test.tsx
+++ /dev/null
@@ -1,63 +0,0 @@
-// @vitest-environment jsdom
-
-import { fireEvent, render, screen } from '@testing-library/react';
-import { describe, expect, it, vi } from 'vitest';
-
-import {
-  IMAGE_CANVAS_GENERATION_ASSET_NAME_MAX_LENGTH,
-  ImageCanvasGenerationAssetNameField,
-} from './ImageCanvasGenerationAssetNameField';
-
-describe('ImageCanvasGenerationAssetNameField', () => {
-  it('renders as a controlled optional name input', () => {
-    const onChange = vi.fn();
-    const { rerender } = render(
-      <ImageCanvasGenerationAssetNameField
-        value="角色立绘"
-        onChange={onChange}
-      />,
-    );
-
-    const input = screen.getByRole('textbox', {
-      name: '资源名称',
-    }) as HTMLInputElement;
-    expect(input.value).toBe('角色立绘');
-    expect(input.getAttribute('maxlength')).toBe(
-      String(IMAGE_CANVAS_GENERATION_ASSET_NAME_MAX_LENGTH),
-    );
-
-    fireEvent.change(input, { target: { value: '新名称' } });
-    expect(onChange).toHaveBeenCalledWith('新名称');
-    expect(input.value).toBe('角色立绘');
-
-    rerender(
-      <ImageCanvasGenerationAssetNameField
-        value="新名称"
-        onChange={onChange}
-      />,
-    );
-    expect(input.value).toBe('新名称');
-  });
-
-  it('limits callback values to 80 characters and supports disabled state', () => {
-    const onChange = vi.fn();
-    render(
-      <ImageCanvasGenerationAssetNameField
-        value=""
-        disabled
-        onChange={onChange}
-      />,
-    );
-
-    const input = screen.getByRole('textbox', {
-      name: '资源名称',
-    }) as HTMLInputElement;
-    expect(input.disabled).toBe(true);
-
-    fireEvent.change(input, { target: { value: '名'.repeat(90) } });
-    expect(onChange).toHaveBeenCalledWith('名'.repeat(80));
-
-    fireEvent.change(input, { target: { value: '🎨'.repeat(90) } });
-    expect(onChange).toHaveBeenLastCalledWith('🎨'.repeat(80));
-  });
-});
diff --git a/src/components/image-editor/ImageCanvasGenerationAssetNameField.tsx b/src/components/image-editor/ImageCanvasGenerationAssetNameField.tsx
deleted file mode 100644
index dedaaf43a..000000000
--- a/src/components/image-editor/ImageCanvasGenerationAssetNameField.tsx
+++ /dev/null
@@ -1,46 +0,0 @@
-import { PlatformFieldLabel } from '../common/PlatformFieldLabel';
-import { PlatformTextField } from '../common/PlatformTextField';
-import { EDITOR_GENERATED_ASSET_LABEL_MAX_CHARS } from './ImageCanvasGenerationSubmissionModel';
-
-export const IMAGE_CANVAS_GENERATION_ASSET_NAME_MAX_LENGTH =
-  EDITOR_GENERATED_ASSET_LABEL_MAX_CHARS;
-
-type ImageCanvasGenerationAssetNameFieldProps = {
-  value?: string | null;
-  disabled?: boolean;
-  onChange: (value: string) => void;
-};
-
-export function ImageCanvasGenerationAssetNameField({
-  value,
-  disabled = false,
-  onChange,
-}: ImageCanvasGenerationAssetNameFieldProps) {
-  return (
-    <label className="image-canvas-editor__generation-asset-name-field">
-      <PlatformFieldLabel
-        variant="form"
-        className="image-canvas-editor__field-title"
-      >
-        资源名称
-      </PlatformFieldLabel>
-      <PlatformTextField
-        aria-label="资源名称"
-        value={value ?? ''}
-        maxLength={IMAGE_CANVAS_GENERATION_ASSET_NAME_MAX_LENGTH}
-        disabled={disabled}
-        placeholder="例如：勇者立绘"
-        size="sm"
-        density="compact"
-        className="image-canvas-editor__generation-asset-name-input"
-        onChange={(event) =>
-          onChange(
-            Array.from(event.target.value)
-              .slice(0, IMAGE_CANVAS_GENERATION_ASSET_NAME_MAX_LENGTH)
-              .join(''),
-          )
-        }
-      />
-    </label>
-  );
-}
diff --git a/src/components/image-editor/ImageCanvasGenerationComposerView.tsx b/src/components/image-editor/ImageCanvasGenerationComposerView.tsx
index 1c8652c3c..3049a31e5 100644
--- a/src/components/image-editor/ImageCanvasGenerationComposerView.tsx
+++ b/src/components/image-editor/ImageCanvasGenerationComposerView.tsx
@@ -53,7 +53,6 @@ import {
   resizeGenerationPlaceholderToVideoSelection,
   SPEC_TYPE_LABEL,
 } from './ImageCanvasGenerationModel';
-import { ImageCanvasGenerationAssetNameField } from './ImageCanvasGenerationAssetNameField';
 import { ImageCanvasIconSpritesheetComposerView } from './ImageCanvasIconSpritesheetComposerView';
 import { ImageCanvasPublicationMaterialsDemoPanelView } from './ImageCanvasPublicationMaterialsDemoPanelView';
 import { getPublicationMaterialsWorkflow } from './ImageCanvasPublicationMaterialsModel';
@@ -402,11 +401,6 @@ function ImageCanvasVideoGenerationComposerView({
             updateVideoDialog({ prompt: event.target.value })
           }
         />
-        <ImageCanvasGenerationAssetNameField
-          value={dialog.assetLabel}
-          disabled={isGenerating}
-          onChange={(assetLabel) => updateVideoDialog({ assetLabel })}
-        />
         <div className="image-canvas-editor__generation-composer-footer">
           <div className="image-canvas-editor__option-popover-anchor image-canvas-editor__option-popover-anchor--dimensions">
             <PlatformInlineOptionButton
@@ -793,11 +787,6 @@ function ImageCanvasAudioGenerationComposerView({
         className="image-canvas-editor__generation-prompt"
         onChange={(event) => updateAudioDialog({ prompt: event.target.value })}
       />
-      <ImageCanvasGenerationAssetNameField
-        value={dialog.assetLabel}
-        disabled={isGenerating}
-        onChange={(assetLabel) => updateAudioDialog({ assetLabel })}
-      />
       {dialog.status === 'failed' ? (
         <PlatformStatusMessage
           tone="error"
diff --git a/src/components/image-editor/ImageCanvasGenerationModel.test.ts b/src/components/image-editor/ImageCanvasGenerationModel.test.ts
index 492b04497..d80c7ed02 100644
--- a/src/components/image-editor/ImageCanvasGenerationModel.test.ts
+++ b/src/components/image-editor/ImageCanvasGenerationModel.test.ts
@@ -42,6 +42,7 @@ import {
   getGenerationFrameAriaLabel,
   getGenerationFrameLabel,
   IMAGE_MODEL_GPT_IMAGE_2,
+  isQuickEditUnsupportedAssetKind,
   resolveCharacterAnimationSourceImageSrc,
   resolveImageGenerationErrorMessage,
   VIDEO_MODEL_KLING_3,
@@ -392,6 +393,18 @@ describe('ImageCanvasGenerationModel', () => {
       },
       { label: 'gpt-image-2', value: 'gpt-image-2' },
     ]);
+    expect(
+      isQuickEditUnsupportedAssetKind({
+        ...buildSourceLayer(),
+        assetKind: 'icon',
+      }),
+    ).toBe(true);
+    expect(
+      isQuickEditUnsupportedAssetKind({
+        ...buildSourceLayer(),
+        assetKind: 'icon-spritesheet',
+      }),
+    ).toBe(false);
   });
 
   it('adds reference image semantics and snapshots for spec generation references', () => {
diff --git a/src/components/image-editor/ImageCanvasGenerationModel.ts b/src/components/image-editor/ImageCanvasGenerationModel.ts
index 9c6657f7e..105528bbd 100644
--- a/src/components/image-editor/ImageCanvasGenerationModel.ts
+++ b/src/components/image-editor/ImageCanvasGenerationModel.ts
@@ -556,7 +556,7 @@ export function buildQuickEditModelOptions(currentModel: string) {
 }
 
 export function isQuickEditUnsupportedAssetKind(layer: CanvasLayer) {
-  return layer.assetKind === 'icon' || layer.assetKind === 'icon-spritesheet';
+  return layer.assetKind === 'icon';
 }
 
 export function buildCharacterSpecPrompt(values: SpecFormValues) {
diff --git a/src/components/image-editor/ImageCanvasIconSpritesheetComposerView.tsx b/src/components/image-editor/ImageCanvasIconSpritesheetComposerView.tsx
index 8c4474e64..10cc79936 100644
--- a/src/components/image-editor/ImageCanvasIconSpritesheetComposerView.tsx
+++ b/src/components/image-editor/ImageCanvasIconSpritesheetComposerView.tsx
@@ -18,7 +18,6 @@ import type {
   SpecGenerationType,
   UploadTarget,
 } from './ImageCanvasEditorTypes';
-import { ImageCanvasGenerationAssetNameField } from './ImageCanvasGenerationAssetNameField';
 import { ImageCanvasGenerationImageOptionsView } from './ImageCanvasGenerationImageOptionsView';
 import {
   calculateEditorIconSpritesheetPrice,
@@ -220,32 +219,10 @@ export function ImageCanvasIconSpritesheetComposerView({
           placeholder="你需要哪些图标？"
           size="sm"
           density="compact"
-          className="image-canvas-editor__generation-prompt image-canvas-editor__generation-prompt--borderless"
+          className="image-canvas-editor__generation-prompt"
           onChange={(event) => onUpdateIconDescriptionText(event.target.value)}
         />
       </label>
-      <ImageCanvasGenerationAssetNameField
-        value={dialog.assetLabel}
-        disabled={dialog.status === 'generating'}
-        onChange={(assetLabel) =>
-          setGenerateDialog((currentDialog) =>
-            currentDialog?.mode === 'icon'
-              ? {
-                  ...currentDialog,
-                  status:
-                    currentDialog.status === 'failed'
-                      ? 'idle'
-                      : currentDialog.status,
-                  errorMessage:
-                    currentDialog.status === 'failed'
-                      ? undefined
-                      : currentDialog.errorMessage,
-                  assetLabel,
-                }
-              : currentDialog,
-          )
-        }
-      />
       {dialog.status === 'failed' ? (
         <PlatformStatusMessage
           tone="error"
diff --git a/src/components/image-editor/ImageCanvasPublicationMaterialsDemoPanelView.tsx b/src/components/image-editor/ImageCanvasPublicationMaterialsDemoPanelView.tsx
index 4ccb83913..8d96176ad 100644
--- a/src/components/image-editor/ImageCanvasPublicationMaterialsDemoPanelView.tsx
+++ b/src/components/image-editor/ImageCanvasPublicationMaterialsDemoPanelView.tsx
@@ -21,7 +21,6 @@ import type {
   PublicationMaterialsGameInfo,
   UploadTarget,
 } from './ImageCanvasEditorTypes';
-import { ImageCanvasGenerationAssetNameField } from './ImageCanvasGenerationAssetNameField';
 import { ImageCanvasGenerationImageOptionsView } from './ImageCanvasGenerationImageOptionsView';
 import {
   buildPublicationMaterialsPrompt,
@@ -287,21 +286,6 @@ export function ImageCanvasPublicationMaterialsDemoPanelView({
         </label>
       </div>
 
-      <ImageCanvasGenerationAssetNameField
-        value={dialog.assetLabel}
-        disabled={dialog.status === 'generating'}
-        onChange={(assetLabel) =>
-          setGenerateDialog((currentDialog) =>
-            currentDialog?.mode === 'publication'
-              ? {
-                  ...resetFailedDialogStatus(currentDialog),
-                  assetLabel,
-                }
-              : currentDialog,
-          )
-        }
-      />
-
       {dialog.status === 'failed' ? (
         <PlatformStatusMessage
           tone="error"
diff --git a/src/components/image-editor/ImageCanvasQuickEditPanelView.test.tsx b/src/components/image-editor/ImageCanvasQuickEditPanelView.test.tsx
index 776d1fbac..f5b06841a 100644
--- a/src/components/image-editor/ImageCanvasQuickEditPanelView.test.tsx
+++ b/src/components/image-editor/ImageCanvasQuickEditPanelView.test.tsx
@@ -124,6 +124,27 @@ describe('ImageCanvasQuickEditPanelView', () => {
     expect(rememberImageModel).toHaveBeenCalledWith('gpt-image-2');
   });
 
+  it('renders the failure message inside the quick edit alert', () => {
+    render(
+      <QuickEditPanelHarness
+        initialPanel={{
+          sourceLayerId: 'layer-a',
+          prompt: '调整图集布局',
+          size: '1024x1024',
+          aspectRatio: '1:1',
+          imageSize: '1K',
+          model: 'gpt-image-2',
+          status: 'failed',
+          errorMessage: '图集快速编辑失败',
+        }}
+      />,
+    );
+
+    expect(screen.getByRole('alert').textContent).toContain(
+      '图集快速编辑失败',
+    );
+  });
+
   it('submits without rendering a standalone close button', () => {
     const submitQuickEdit = vi.fn();
     render(
diff --git a/src/components/image-editor/ImageCanvasQuickEditPanelView.tsx b/src/components/image-editor/ImageCanvasQuickEditPanelView.tsx
index b95d23b8b..66953ef42 100644
--- a/src/components/image-editor/ImageCanvasQuickEditPanelView.tsx
+++ b/src/components/image-editor/ImageCanvasQuickEditPanelView.tsx
@@ -53,6 +53,7 @@ function createQuickEditDialog(
     mode: isQuickEdit ? 'quick-edit' : 'generate',
     prompt: panel.prompt,
     status: panel.status,
+    errorMessage: panel.errorMessage,
     sourceLayerId: panel.sourceLayerId,
     generationReferences: panel.quickEditReferences,
     assetLabel: panel.assetLabel,
diff --git a/src/components/image-editor/ImageCanvasSelectedLayerToolbarView.test.tsx b/src/components/image-editor/ImageCanvasSelectedLayerToolbarView.test.tsx
index feb573752..9ab35425c 100644
--- a/src/components/image-editor/ImageCanvasSelectedLayerToolbarView.test.tsx
+++ b/src/components/image-editor/ImageCanvasSelectedLayerToolbarView.test.tsx
@@ -137,6 +137,7 @@ describe('ImageCanvasSelectedLayerToolbarView', () => {
     const buttons = within(toolbar).getAllByRole('button');
 
     expect(buttons.map((button) => button.getAttribute('aria-label'))).toEqual([
+      '快速编辑',
       '裁扩按钮',
       '去除背景按钮',
       '拆分图集',
@@ -258,16 +259,22 @@ describe('ImageCanvasSelectedLayerToolbarView', () => {
     expect(screen.queryByRole('button', { name: '生成动画' })).toBeNull();
   });
 
-  it.each(['icon', 'icon-spritesheet'] as const)(
-    'hides quick edit for %s assets',
-    (assetKind) => {
-      renderSelectedToolbar({
-        selectedLayer: createLayer({ assetKind }),
-      });
+  it('hides quick edit only for individual icon assets', () => {
+    renderSelectedToolbar({
+      selectedLayer: createLayer({ assetKind: 'icon' }),
+    });
 
-      expect(screen.queryByRole('button', { name: '快速编辑' })).toBeNull();
-    },
-  );
+    expect(screen.queryByRole('button', { name: '快速编辑' })).toBeNull();
+  });
+
+  it('keeps quick edit and manual split available for icon spritesheets', () => {
+    renderSelectedToolbar({
+      selectedLayer: createLayer({ assetKind: 'icon-spritesheet' }),
+    });
+
+    expect(screen.getByRole('button', { name: '快速编辑' })).toBeTruthy();
+    expect(screen.getByRole('button', { name: '拆分图集' })).toBeTruthy();
+  });
 
   it('keeps quick edit available for icon specs', () => {
     renderSelectedToolbar({
diff --git a/src/components/image-editor/ImageCanvasSpecGenerationPanelView.test.tsx b/src/components/image-editor/ImageCanvasSpecGenerationPanelView.test.tsx
index 42a1cbbbc..e10eb5428 100644
--- a/src/components/image-editor/ImageCanvasSpecGenerationPanelView.test.tsx
+++ b/src/components/image-editor/ImageCanvasSpecGenerationPanelView.test.tsx
@@ -138,7 +138,8 @@ describe('ImageCanvasSpecGenerationPanelView', () => {
     ).toBe(true);
     expect(panel.textContent).not.toContain('UI设计要求');
     expect(prompt.getAttribute('placeholder')).toBe('你希望这个 UI 长什么样？');
-    expect(prompt.className).toContain(
+    expect(prompt.className).toContain('image-canvas-editor__generation-prompt');
+    expect(prompt.className).not.toContain(
       'image-canvas-editor__generation-prompt--borderless',
     );
     const submitButton = screen.getByRole('button', { name: '生成UI设计图' });
diff --git a/src/components/image-editor/ImageCanvasSpecGenerationPanelView.tsx b/src/components/image-editor/ImageCanvasSpecGenerationPanelView.tsx
index adf1f05f4..4bba9f068 100644
--- a/src/components/image-editor/ImageCanvasSpecGenerationPanelView.tsx
+++ b/src/components/image-editor/ImageCanvasSpecGenerationPanelView.tsx
@@ -25,7 +25,6 @@ import type {
   SpecGenerationType,
   UploadTarget,
 } from './ImageCanvasEditorTypes';
-import { ImageCanvasGenerationAssetNameField } from './ImageCanvasGenerationAssetNameField';
 import { ImageCanvasGenerationImageOptionsView } from './ImageCanvasGenerationImageOptionsView';
 import {
   calculateEditorSpecGenerationPrice,
@@ -258,7 +257,7 @@ export function ImageCanvasSpecGenerationPanelView({
                 placeholder="你希望这个 UI 长什么样？"
                 size="sm"
                 density="compact"
-                className="image-canvas-editor__generation-prompt image-canvas-editor__generation-prompt--borderless"
+                className="image-canvas-editor__generation-prompt"
                 onChange={(event) => {
                   const nextPrompt = event.target.value;
                   if (setGenerateDialog) {
@@ -416,30 +415,6 @@ export function ImageCanvasSpecGenerationPanelView({
             </>
           )}
         </div>
-        <ImageCanvasGenerationAssetNameField
-          value={dialog.assetLabel}
-          disabled={isGenerating}
-          onChange={(assetLabel) =>
-            setGenerateDialog?.((currentDialog) =>
-              currentDialog &&
-              (currentDialog.mode === 'spec' ||
-                currentDialog.mode === 'ui-design')
-                ? {
-                    ...currentDialog,
-                    status:
-                      currentDialog.status === 'failed'
-                        ? 'idle'
-                        : currentDialog.status,
-                    errorMessage:
-                      currentDialog.status === 'failed'
-                        ? undefined
-                        : currentDialog.errorMessage,
-                    assetLabel,
-                  }
-                : currentDialog,
-            )
-          }
-        />
         {dialog.status === 'failed' ? (
           <PlatformStatusMessage
             tone="error"
diff --git a/src/components/image-editor/ImageCanvasTopbarView.test.tsx b/src/components/image-editor/ImageCanvasTopbarView.test.tsx
index 1bbf80ec6..c9eb10d4b 100644
--- a/src/components/image-editor/ImageCanvasTopbarView.test.tsx
+++ b/src/components/image-editor/ImageCanvasTopbarView.test.tsx
@@ -108,9 +108,6 @@ describe('ImageCanvasTopbarView', () => {
     });
 
     expect(walletChip.textContent).toBe('泥点 1.2万');
-    expect(walletChip.querySelector('img')?.getAttribute('src')).toBe(
-      '/creation-home/topbar-wallet.png',
-    );
 
     await user.hover(walletChip);
     const details = screen.getByRole('dialog', { name: '泥点账户详情' });
diff --git a/src/components/image-editor/ImageCanvasTopbarView.tsx b/src/components/image-editor/ImageCanvasTopbarView.tsx
index 72fa0e4ab..ba20c2e4c 100644
--- a/src/components/image-editor/ImageCanvasTopbarView.tsx
+++ b/src/components/image-editor/ImageCanvasTopbarView.tsx
@@ -7,8 +7,9 @@ import {
   X,
 } from 'lucide-react';
 
+import { PlatformMudPointWalletEntry } from '@/packages/shared/src/components/PlatformMudPointWalletEntry.tsx';
+
 import type { ProfileMudPointBalance } from '../../../packages/shared/src/contracts/runtime';
-import { PlatformMudPointWalletEntry } from '../common/PlatformMudPointWalletEntry';
 import { PlatformStatusMessage } from '../common/PlatformStatusMessage';
 import { PlatformTextField } from '../common/PlatformTextField';
 import { EditorIconButton } from './ImageCanvasEditorPrimitives';
diff --git a/src/components/image-editor/ImageCanvasWorldView.test.tsx b/src/components/image-editor/ImageCanvasWorldView.test.tsx
index f73afc989..5c9977ab9 100644
--- a/src/components/image-editor/ImageCanvasWorldView.test.tsx
+++ b/src/components/image-editor/ImageCanvasWorldView.test.tsx
@@ -285,7 +285,7 @@ describe('ImageCanvasWorldView', () => {
           id: 'layer-source',
           resourceId: 'resource-source',
           title: '角色原图',
-          assetKind: 'editor_green_screen_source',
+          assetKind: 'character',
         }),
       ],
     });
@@ -298,7 +298,7 @@ describe('ImageCanvasWorldView', () => {
 
     expect(within(layerButton).getByText('未知')).toBeTruthy();
     expect(within(characterButton).getByText('角色')).toBeTruthy();
-    expect(within(sourceButton).getByText('原图')).toBeTruthy();
+    expect(within(sourceButton).getByText('角色')).toBeTruthy();
   });
 
   it('renders snap guides, marquee and floating generation status', () => {
diff --git a/src/components/image-editor/ImageCanvasWorldView.tsx b/src/components/image-editor/ImageCanvasWorldView.tsx
index 39c52b17c..a28d6401b 100644
--- a/src/components/image-editor/ImageCanvasWorldView.tsx
+++ b/src/components/image-editor/ImageCanvasWorldView.tsx
@@ -205,11 +205,6 @@ const CANVAS_ASSET_KIND_TAG_OPTIONS: Array<{
   { value: 'icon', label: '图标', className: 'icon' },
   { value: 'icon-spritesheet', label: '图集', className: 'icon-spritesheet' },
   { value: 'icon-spec', label: '图标规范', className: 'icon-spec' },
-  {
-    value: 'editor_green_screen_source',
-    label: '原图',
-    className: 'source-image',
-  },
   {
     value: 'publication-material',
     label: '宣发素材',
diff --git a/src/components/image-editor/useImageCanvasGenerationSubmissionWorkflow.test.tsx b/src/components/image-editor/useImageCanvasGenerationSubmissionWorkflow.test.tsx
index dadeda990..119962679 100644
--- a/src/components/image-editor/useImageCanvasGenerationSubmissionWorkflow.test.tsx
+++ b/src/components/image-editor/useImageCanvasGenerationSubmissionWorkflow.test.tsx
@@ -639,6 +639,37 @@ describe('useImageCanvasGenerationSubmissionWorkflow', () => {
     );
   });
 
+  it('allows direct quick edit submission for icon spritesheets', async () => {
+    editEditorImageMock.mockResolvedValueOnce(
+      createGenerated({ prompt: '调整图集布局' }),
+    );
+    render(
+      <SubmissionWorkflowHarness
+        initialLayers={[
+          createLayer({ assetKind: 'icon-spritesheet' }),
+        ]}
+        initialQuickEditPanel={{
+          mode: 'quick-edit',
+          sourceLayerId: 'layer-source',
+          prompt: '调整图集布局',
+          size: '1024x1024',
+          aspectRatio: '1:1',
+          imageSize: '1K',
+          model: 'gpt-image-2',
+          status: 'idle',
+        }}
+      />,
+    );
+
+    fireEvent.click(screen.getByRole('button', { name: '提交快速编辑' }));
+
+    await waitFor(() => {
+      expect(editEditorImageMock).toHaveBeenCalledWith(
+        expect.objectContaining({ prompt: '调整图集布局' }),
+      );
+    });
+  });
+
   it('clears quick edit panel after a queued edit reloads the project snapshot', async () => {
     const applyProjectSnapshot = vi.fn();
     const refreshTaskList = vi.fn();
@@ -1397,7 +1428,7 @@ describe('useImageCanvasGenerationSubmissionWorkflow', () => {
             width: 1024,
             height: 1024,
             sourceType: 'generated',
-            assetKind: 'editor_green_screen_source',
+            assetKind: 'character',
           },
         ],
         updatedAt: '2026-06-21T12:16:22.000Z',
@@ -1472,7 +1503,7 @@ describe('useImageCanvasGenerationSubmissionWorkflow', () => {
             }),
             expect.objectContaining({
               resourceId: 'editor-resource-character-source',
-              assetKind: 'editor_green_screen_source',
+              assetKind: 'character',
             }),
           ]),
         }),
diff --git a/src/components/image-editor/useImageCanvasGenerationWorkflow.test.tsx b/src/components/image-editor/useImageCanvasGenerationWorkflow.test.tsx
index c30c5db1a..860ad19ac 100644
--- a/src/components/image-editor/useImageCanvasGenerationWorkflow.test.tsx
+++ b/src/components/image-editor/useImageCanvasGenerationWorkflow.test.tsx
@@ -974,6 +974,20 @@ describe('useImageCanvasGenerationWorkflow', () => {
     );
   });
 
+  it('opens quick edit for icon spritesheets', () => {
+    render(
+      <GenerationWorkflowHarness
+        initialLayers={[createLayer({ assetKind: 'icon-spritesheet' })]}
+      />,
+    );
+
+    fireEvent.click(screen.getByRole('button', { name: '打开快速编辑' }));
+
+    expect(screen.getByTestId('quick-edit').textContent).toBe(
+      'layer-source:idle:-',
+    );
+  });
+
   it('calculates character animation button price from the model pricing config', () => {
     render(<GenerationWorkflowHarness />);
 
diff --git a/src/components/platform-entry/PlatformProfileRechargeModal.tsx b/src/components/platform-entry/PlatformProfileRechargeModal.tsx
index 26964cc30..f5acb0023 100644
--- a/src/components/platform-entry/PlatformProfileRechargeModal.tsx
+++ b/src/components/platform-entry/PlatformProfileRechargeModal.tsx
@@ -1,6 +1,8 @@
 import QRCode from 'qrcode';
 import { useCallback, useEffect, useState } from 'react';
 
+import { formatMudPointCount } from '@/packages/shared/src/utils/format.ts';
+
 import type {
   ProfileRechargeCenterResponse,
   ProfileRechargeProduct,
@@ -8,7 +10,6 @@ import type {
 import { PlatformActionButton } from '../common/PlatformActionButton';
 import { PlatformAsyncStatePanel } from '../common/PlatformAsyncStatePanel';
 import { PlatformEmptyState } from '../common/PlatformEmptyState';
-import { formatMudPointCount } from '../common/platformMudPointWalletModel';
 import { PlatformPillBadge } from '../common/PlatformPillBadge';
 import { PlatformProfileSkeletonList } from '../common/PlatformProfileSkeletonList';
 import { PlatformStatusMessage } from '../common/PlatformStatusMessage';
diff --git a/src/components/rpg-entry/RpgEntryHomeView.recharge.test.tsx b/src/components/rpg-entry/RpgEntryHomeView.recharge.test.tsx
index 336dded05..d9873356c 100644
--- a/src/components/rpg-entry/RpgEntryHomeView.recharge.test.tsx
+++ b/src/components/rpg-entry/RpgEntryHomeView.recharge.test.tsx
@@ -4338,9 +4338,6 @@ test('logged in create tab shows real wallet balance beside the brand', () => {
   expect(walletEntry?.className).toContain(
     'platform-mobile-create-wallet-chip',
   );
-  expect(walletButton.querySelector('img')?.getAttribute('src')).toBe(
-    '/creation-home/topbar-wallet.png',
-  );
   expect(
     within(topbar as HTMLElement).getByRole('button', { name: '充值' }),
   ).toBeTruthy();
diff --git a/src/components/rpg-entry/RpgEntryHomeView.tsx b/src/components/rpg-entry/RpgEntryHomeView.tsx
index f89ca01c8..876b95c67 100644
--- a/src/components/rpg-entry/RpgEntryHomeView.tsx
+++ b/src/components/rpg-entry/RpgEntryHomeView.tsx
@@ -40,6 +40,8 @@ import {
   useState,
 } from 'react';
 
+import { PlatformMudPointWalletEntry } from '@/packages/shared/src/components/PlatformMudPointWalletEntry.tsx';
+
 import profileClockImage from '../../../media/profile/_Image (1).png';
 import profileGamepadImage from '../../../media/profile/_Image (2).png';
 import profileStillLifeImage from '../../../media/profile/_Image (3).png';
@@ -90,7 +92,6 @@ import { PlatformAsyncStatePanel } from '../common/PlatformAsyncStatePanel';
 import { PlatformEmptyState } from '../common/PlatformEmptyState';
 import { PlatformFilterToolbar } from '../common/PlatformFilterToolbar';
 import { PlatformIconButton } from '../common/PlatformIconButton';
-import { PlatformMudPointWalletEntry } from '../common/PlatformMudPointWalletEntry';
 import { PlatformNavigableListItem } from '../common/PlatformNavigableListItem';
 import { PlatformPillBadge } from '../common/PlatformPillBadge';
 import {
diff --git a/src/index.css b/src/index.css
index 463ba71b3..86b43d828 100644
--- a/src/index.css
+++ b/src/index.css
@@ -6714,30 +6714,6 @@ html[data-mobile-keyboard-open='true'] .platform-mobile-bottom-dock {
   color: #94a3b8;
 }
 
-.image-canvas-editor__generation-asset-name-field {
-  display: grid;
-  grid-column: 1 / -1;
-  gap: 0.24rem;
-  min-width: 0;
-}
-
-.image-canvas-editor__generation-asset-name-input {
-  width: 100%;
-  min-width: 0;
-}
-
-.image-canvas-editor__generation-prompt--borderless {
-  border-color: transparent;
-  background: transparent;
-  box-shadow: none;
-}
-
-.image-canvas-editor__generation-prompt--borderless:focus {
-  border-color: transparent;
-  background: transparent;
-  box-shadow: none;
-}
-
 .image-canvas-editor__video-prompt {
   grid-column: 1 / -1;
   min-height: 4.1rem;
diff --git a/vitest.config.ts b/vitest.config.ts
index 400b18151..01034295e 100644
--- a/vitest.config.ts
+++ b/vitest.config.ts
@@ -1,6 +1,14 @@
+import path from 'node:path';
+
 import {defineConfig} from 'vitest/config';
 
 export default defineConfig({
+  resolve: {
+    alias: {
+      // Keep shared components' application-root imports resolvable in tests.
+      '@': path.resolve(__dirname, '.'),
+    },
+  },
   test: {
     environment: 'node',
     globals: true,
@@ -13,6 +21,7 @@ export default defineConfig({
       'miniprogram/**/*.test.js',
       'scripts/**/*.test.ts',
       'packages/shared/src/**/*.test.ts',
+      'packages/shared/src/**/*.test.tsx',
     ],
   },
 });